Canada’s health AI privacy call: questions patients can ask

Cover: AI-generated editorial illustration, not an event photograph or product screenshot.

Canada’s privacy regulators used a 29 October announcement to press for stronger oversight of artificial intelligence in health care and health research. For patients, the useful question is what happens to information after a tool receives it: who controls the record, which additional uses are allowed, and who can correct an inaccurate result.

The Office of the Privacy Commissioner of Canada announced a joint resolution calling for responsible development, purchasing and use of health AI. This is a call for action by governments and organizations, rather than an announcement that a new nationwide AI law has taken effect. VPNBlade has reviewed the published documents; we have not assessed a hospital, tested an AI scribe or determined any organization’s legal compliance.

The announcement and the adoption date are different

The public announcement is dated 29 October 2026. The underlying resolution says it was adopted in Ottawa on 15 September 2026. That distinction matters: October’s development is the public announcement, not evidence that every proposed safeguard began operating that day.

The regulators address governments, developers, service providers, health organizations and researchers. Their announcement recognizes possible benefits from AI while warning that weak protections and oversight can undermine privacy and patient trust. It also asks governments to work on governance requirements. Readers should distinguish that requested legislative action from the rules already applicable to a particular provider in its own jurisdiction.

Six principles, followed by practical accountability questions

The resolution organizes its approach around privacy, validity and reliability, safety, human rights, transparency and accountability. It covers a system’s entire life cycle. Its recommendations include ongoing risk assessments, understandable explanations, human oversight and ways to challenge consequential outputs. It also addresses unapproved employee use of AI tools, sometimes called shadow AI.

An interesting detail is that its definition of health AI reaches beyond a conversational chatbot. It includes diagnostic and classification tools and AI scribes. Accordingly, a conversation about “our AI policy” is more useful when the organization identifies the particular application and task. A policy for appointment administration does not, by itself, explain the handling of a recorded consultation.

The following questions are VPNBlade’s practical reading of that accountability problem. They are prompts for discussion, not a statement that every patient has an identical legal entitlement or that any named organization has failed a requirement.

AI scribes already have a separate guidance history

Ontario’s Information and Privacy Commissioner released AI-scribe guidance on 28 January 2026, alongside a companion checklist. That earlier publication is background, rather than a new October product launch. The commissioner described both the potential administrative benefits and the privacy, security and human-rights risks of irresponsible adoption.

The Ontario announcement emphasizes governance and accountability across the life cycle, with attention to bias and inaccuracies as well as information handling. This gives readers a useful way to distinguish a software demonstration from an organization’s deployment decision. Seeing a tool generate tidy notes does not establish how the clinic has arranged access, review or responsibility for the finished record.

For example, imagine a demonstration using an invented appointment. That can show the appearance of a draft note without showing the actual clinic’s data arrangements. Before treating the demonstration as evidence of privacy protection, a decision-maker would still need answers about the intended working environment. This example is illustrative; VPNBlade has not observed such a demonstration at a named clinic.

Consent, necessity and access remain separate questions

The regulators’ older 7 December 2023 generative-AI principles provide additional context. They say organizations must identify their legal authority and make consent meaningful where consent is the relevant authority. They also discuss whether the use is necessary and proportionate, transparency about secondary training uses, and procedures for access and correction. Those principles explicitly recognize that obligations vary with the organization and activity.

Our reading is that a patient-facing explanation should help someone understand a specific information flow. “We use AI” leaves unanswered whether a system receives a recording, a transcript or a selected extract. Equally, naming a supplier does not explain which purpose the clinic has approved. Clear descriptions make the discussion more concrete without requiring a patient to inspect source code.

A useful distinction is between disagreement with a generated statement and a concern about information handling. The first concerns whether the output describes someone accurately. The second concerns the information that was collected, retained or passed on. The same person may have both concerns, so a response that addresses only the wording of a note may leave the handling question unanswered.

What this means for VPN users

A VPN changes part of a network connection. It does not decide what a health service or AI supplier may do with information after receiving it, and it does not review a generated note for accuracy. Buying a VPN therefore cannot substitute for asking the organization about the workflow. This article includes no deal recommendation because a purchase would not resolve the governance questions raised by this announcement.

For context on where network privacy ends, read our guide to deciding whether to use a VPN. Our explanation of data leaks and data breaches distinguishes different exposure problems, while the work-from-home guide discusses approved access and the limits of consumer tools in an employer’s workflow.

The practical next step is to ask the health organization for its explanation and the appropriate privacy contact when an AI tool is involved. Keep that conversation focused on the tool’s purpose, information handling and review process. The October announcement supports a wider accountability discussion; it does not establish that a particular clinic has adopted a system, that a product has passed an independent assessment, or that a future recommendation is already implemented.