Regulated and healthcare

The billing article starts from the EMR you already have. For a practice with one or two providers, its billing module is often enough. The gaps open as a clinic grows. Rejected OHIP claims sit in a queue until they pass the three-month window for resubmitting them, and fees for uninsured services, such as sick notes and third-party forms, get delivered and never collected. Software built beside the EMR can make both visible.

Before any AI tool sees patient information, the PHIPA checklist asks where that information goes and who can reach it. Putting patient details into a consumer chatbot almost certainly breaches PHIPA. The article sets out four ways to keep the data under your control, from removing identifying details before anything leaves the clinic to running the model on hardware the clinic controls, and ends with eleven checks to go through with any vendor.

PHIPA covers patient records. The rest of your business, such as your mailing list and your website forms, falls under federal privacy law. Bill C-36 would replace PIPEDA with a new act and a new regulator, and it is not law yet. Two duties already apply today: reporting a breach that creates a real risk of significant harm, and keeping a log of every breach for 24 months.

None of this is legal advice. Your privacy officer and your lawyer make the compliance decision; the articles are there so you can put the right questions to a developer before you commit.