Contract Guidance

Under the province’s Vendor of Record Program, contract terms have already been negotiated, alleviating this responsibility.

If you are not using an AI scribe through the VOR, it’s important to look at the vendor’s contract as a whole, there are specific clauses potential AI scribe users should keep in mind:

• PHIPA Compliance: Whatever tool you are considering, ensure the vendor contractually confirms their compliance with PHIPA specifically. Their compliance with PIPEDA (Canadian federal privacy law), HIPAA (US health privacy law) or GDPR (European Union data regulations) is not enough.
• Data Ownership and Control: The contract should indicate that you, as the Health Information Custodian (HIC), have custody and control over the patient data. It’s essential that you, as the HIC, retain ownership of the data and that the vendor is only there to support you and only able to access and process the data in order to serve your practice.  The vendor should have no ability to de-identify or continue to use or disclose data for any other purpose.
• Vendor Activity: The vendor should have no ability to de-identify or continue to use or disclose data for any purpose other than supporting you. Some AI scribe vendors try to include terms that you will get patient consent to allow them to use or disclose patient data for purposes like training their AI model, quality improvement, product development or even their own marketing.  OntarioMD does not recommend accepting those terms. It might mean you decide to choose a different AI scribe.
• Data Location: Where does the vendor host data? If data is being held outside Ontario, notice of this should be included in the agreement so you can reflect this in your own privacy policy and notice to patients.
• Data Retention and Disposal: The contract must have clear data retention terms in order to prevent unnecessary data exposure and ensure patient information is retained for no longer than is necessary. No recordings of patient encounters should be retained by the vendor (they should be immediately deleted after generation of SOAP notes). Similarly, any transcription and draft SOAP note should be destroyed after a short period of time (less than 30 days). Pay attention to how long you must rely on the storage of the transitory audio recordings, transcripts or summary notes if you do not intend to complete your SOAP notes after every encounter. You could lose access to those files after a certain number of hours or days.
• Privacy Incident: The contract must require the vendor to notify you in case of any privacy or security incident. The contract should specify who is responsible in the event of a data breach and how the vendor will support you.
• Indemnification: Indemnification is a legal term that shifts the financial risk of harm, loss or damages from one party to another. Ideally, the vendor would indemnify you for its actions if it does something wrong. At a minimum, do not accept contract terms for you to indemnify the vendor.
• Liability Limitations: Vendors will often limit their liability in case of technology errors or security breaches. Be sure to review these limitations to ensure they are reasonable and don’t leave you solely responsible for issues beyond your control. Having fair liability terms prevents your practice from shouldering disproportionate risk.
• Intellectual Property Rights: This clause outlines who owns any intellectual property (IP), such as your notes, templates, or other data. It’s important that this ownership doesn’t infringe on your rights to your data and that any IP created through your data use is clearly attributed. This helps protect both your practice and patient confidentiality.
• Term and Termination: Especially if you are new to using an AI scribe, you may want flexibility in testing the product for a while without a long-term commitment.  

Limiting the vendor’s ability to share data with third parties without consent is also critical for maintaining your compliance with privacy obligations. As the individual or organization signing the agreement, it remains your responsibility to ensure you understand all the terms in the vendor contract. For questions or concerns about the terms of a vendor contract, you can also contact the OMA or consider seeking legal counsel to assist you in reviewing it.