The Scribe Rules, Read for the Phone

Over the past year the privacy commissioners of three provinces each wrote down what a clinic has to do before it lets an AI scribe into the exam room. Alberta's office went first, last fall. Ontario's and British Columbia's followed. Read them side by side and they do not quite agree — on who is covered, on what has to be assessed, on what the contract must say. The law firms summarizing them have started calling the result fragmented, and they are right.

But there is one sentence all three share, and it is the one I keep coming back to, because it was written about a tool that listens in the exam room and it applies just as hard to a tool that is starting to answer the clinic's phone.

The sentence they agree on

The custodian remains accountable. That is Alberta's phrasing, and the others say the same thing in their own words. The clinic, or the physician, is the custodian of the health information. Bringing in a vendor does not move that duty. Alberta's commissioner has said a custodian must complete a privacy impact assessment under the Health Information Act before using an AI scribe, and that the Act probably does not permit a vendor to train its models on the patient information a custodian provides. The other two reach the same place by their own routes. Different mechanics, same spine: the clinic answers for what the tool does with the record.

I think that is exactly right, and I say that as a vendor. A rule that let a clinic hand its accountability to a software company would be a rule written for software companies.

The exam room is not the only room

The guidance was written about scribes because scribes arrived first. But the question has already moved to a second room. Last December a Quebec company announced that its medical AI voice agent — an AI that answers a clinic's phone — had been certified by the province's health ministry. In Europe, since August, the AI Act's transparency duty requires that a caller be told early in the call that they are speaking with a machine. The phone has become the second place a patient meets an AI, and it is a harder place than the exam room in one respect: in the exam room, a clinician is present. On the phone, the AI may be the only one there.

Nothing in the scribe guidance stops applying when the microphone is a telephone. The custodian is still accountable. The assessment still has to be done. The contract still has to say where the information goes and what is done with it there. What changes is what the clinic has to ask about, because a phone agent does things a scribe never does: it speaks to the patient, it acts on the calendar, it decides when to hand the call to a person.

What we do, so you can check it

Our phone assistant says what it is in its first sentence: the clinic's automated assistant. It says it before the patient has said anything. A patient who says “front desk” at any point is handed to a person, and the hand-off is one sentence, not a menu. The call is never recorded; the assistant's own rules refuse the carrier's recording options outright. What the clinic keeps is the record a custodian needs — that a call happened, what was booked or cancelled, when a person took over — and that record lives in the clinic's own silo, in the region the clinic chose, where the clinic can read it.

Where the processing happens is written into the agreement the clinic signs, because that is the custodian's question to ask and ours to answer plainly. The clinic owns the consent conversation with its patients; our part is to make the disclosure accurate enough that the clinic can have it.

Questions to ask of us, and of everyone else

I have been keeping a list of questions a clinic should put to any AI vendor, and the phone adds four. They are the questions I would want answered if I were the custodian, so they are the ones we have made sure we can answer.

• Does the patient know it is a machine, and when? Before they speak, or after?
• How does a patient reach a person, and how many steps does it take? One sentence is the right answer.
• Is the call recorded, and if so, where does the recording go? “It isn't” is also an answer.
• Where does the record of the call live, and can the clinic read it without asking the vendor?

The provinces will keep writing their guidance, and I expect the phone to get its own chapter within the year. Until then, the scribe rules are the rules. Read them for the phone, and they hold up.