IntegrationsWorks with Accuro, OSCAR, TELUS and hospital EMRs.
PsychiatryCardiologyGastroenterologyOncologyFamily Medicine and Walk-inHospital Triage
Pricing
TeamNewsCareersSickKids x AthelContact
Get startedBook a 15-minute demo

Go back

Article

Oct 9, 2026

Athel, Your AI Co-Clinician: The PHIPA and PIPEDA Questions Canadian Clinics Ask Us Most

Athel is your AI Co-Clinician. See how it protects patient data in Canada: PHIPA in Ontario, PIPEDA nationwide, consent and model training, answered.

Physician reviewing a structured patient summary on a tablet before an appointment, clinic setting.

Short answer: yes, when the AI vendor is built for it. Athel is your AI Co-Clinician — it handles the calls and intake work around a visit so physicians can focus on the visit itself — and patient data deserves the same protection whether it's written on a chart or spoken into a phone. Athel is compliant with the Personal Health Information Protection Act (PHIPA) in Ontario, and with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) — or the applicable provincial equivalent — everywhere else in Canada. Below are the specific questions physicians and practice managers raise before every demo, answered directly. If you'd rather see it in action first, book a discovery call.

Is Athel PHIPA and PIPEDA compliant?

Yes, across the country, not just in Ontario. Athel meets PHIPA in Ontario and PIPEDA everywhere else in Canada — or a province's own health-specific privacy law where one applies instead. A small number of provinces (New Brunswick, Newfoundland and Labrador, and Nova Scotia, alongside Ontario) have their own health information acts recognized as equivalent to PIPEDA; Athel is built to meet whichever framework applies to your clinic, not just the Ontario one. (OPC) Ontario's Information and Privacy Commissioner (IPC) published new guidance for AI in the health sector in January 2026, telling clinics to verify a vendor's governance, data handling, and contractual safeguards before adoption — the questions below are ours, answered in that spirit.

Does Athel's AI train on our patient data?

No. Patient information is de-identified before it's sent to the AI, and Athel has contractual agreements in place with its AI model providers that specifically prohibit them from using that data to train or fine-tune their models. This is the one question we noticed several AI scribe vendors list on their own privacy pages and then leave unanswered. It shouldn't be optional information.

Where is our patient data stored, and does it stay in Canada?

Yes. Canadian clinic data is hosted on Canadian-region infrastructure and never leaves the country — US clinic data is kept separately on its own US-region infrastructure, so nothing is commingled across the border. Each clinic's records sit in dedicated database instances with logical segregation between clinics — one clinic's patients are never queryable from another's account. Data in transit is encrypted with TLS 1.3; PHI, records, and audit logs are encrypted at rest with AES-256.

Do you record and store call audio, and for how long?

Call recordings and transcripts become part of the patient's record in your dashboard, protected the same way as the rest of your clinic's data — encrypted at rest, access-controlled, and logged. Every read, write, and export of that record is captured in an immutable audit log, so there's a permanent trail of who accessed it and when. Athel retains call audio and transcripts for a minimum of 10 years from the date of the last entry — matching CPSO and CMPA guidance (16 years in British Columbia).

What consent do we need from patients?

This is a physician obligation, not a vendor one — though Athel is built to make it straightforward. Consent is built into the product itself: for the pre-visit interview, patients give consent on Athel's own intake form before any callback happens; for inbound calls, callers are told up front that they're speaking with an AI assistant, not a human receptionist. In Ontario, CPSO guidance requires physicians to get patient consent before an AI tool collects, uses, or discloses personal health information, and the CMPA — which advises physicians across Canada — recommends documenting that consent the way you'd document consent for any clinical recording. What you're disclosing to patients is narrow and answerable: a PHIPA- and PIPEDA-compliant system processes the call, doesn't use it to train any model, and only your clinic can access the record.

Who can access our data, and how is it secured?

Access follows role-based access control: staff see only what their role requires, and every clinical or admin account requires multi-factor authentication. Every read, write, and export of a patient file is captured in an immutable audit log. Patient records are isolated per clinic in dedicated database instances — cross-clinic access isn't architecturally possible, not just policy-disallowed.

What happens to our data if we stop using Athel?

All PHI is securely deleted or returned, whichever your clinic prefers, and we retain zero copies beyond what the law requires us to keep. That's a contractual commitment, not a policy we can quietly revise.

How would we find out about a breach?

Within 24 hours of Athel becoming aware of it — our contractual notification window to your clinic. We also run daily automated backups across multiple zones, with a documented disaster-recovery plan and a target recovery point objective under one hour, so an incident doesn't also mean losing your data.

Does Athel diagnose or make clinical decisions on its own?

No. Athel provides clinical decision support: it captures symptoms, structures a summary, and gets that information to you before the patient's appointment. It does not independently diagnose or treat, and the clinical decision stays with the physician — the same as if a nurse had taken the intake notes. Athel is designed to qualify as non-device clinical decision support under Canadian and US frameworks, a narrower and more conservative category than a diagnostic tool.

How should we vet an AI vendor like Athel?

Ontario's IPC put it plainly in its January 2026 guidance: not all AI solutions are built the same way, and part of the responsibility for checking sits with the clinic. Ask any AI vendor four things: proof of PHIPA and/or PIPEDA compliance, a direct answer on whether patient data trains their models, a written breach-notification commitment, and — if you're outside Ontario — whether they know which provincial law actually applies to your clinic. If a vendor can't answer those with a specific policy — not a badge — that's your answer. See Athel's pricing for what's included at every tier, or book a discovery call to run it against your own workflow.

Sources

© 2026 Athel AI. All rights reserved.

© 2026 Athel AI. All rights reserved.