Canada's privacy regulators have written a to-do list for AI in health care. It isn't law yet, but it likely shows where the law is heading.
On October 29, the federal, provincial and territorial privacy commissioners and ombuds published a joint resolution on responsible AI in health and health research (opens in a new tab). Among other things, it asks governments to legally require AI governance and accountability frameworks from everyone who develops, buys or uses AI in health.
The section for health providers is the practical part. A few of its ten items:
- Name a contact person people can go to with concerns about how AI uses their information, and give them a practical way to challenge decisions it informs.
- Where consent is required, explain clearly how information will be used, and where practicable, offer an opt-out before the system goes live.
- Write vendor contracts that limit how vendors and subcontractors can use and disclose information, including a ban on unauthorized commercialization.
- Train staff, and take steps to prevent "shadow AI": tools people bring in on their own, outside the organization's policies.
- Keep a person reviewing AI outputs for as long as the system is in use.
Very little of that is about the technology itself. It's about who's accountable, what the contracts say, and what staff are actually using.
Most organizations could answer some of these today. Few could answer all of them. Which one would take your team the longest?
What this means for health organizations
Most health organizations don't build AI. They buy it, or their staff start using it. The resolution's list for health providers is written for exactly that position, and almost none of it depends on the technology: a named contact, plain-language explanations, contracts with real limits, staff training, and human review that doesn't stop after the pilot.
The resolution isn't binding on its own. But the regulators are asking governments to make AI governance frameworks a legal requirement, and they've committed to coordinating enforcement, guidance and public education across jurisdictions. Organizations that work through the list now will have less to scramble for later.
