A Quebec dental clinic that puts an AI agent on its phone line answers to two privacy laws, its own Ordre, the Charter of the French language and an unresolved certification question. Here is what each one asks of you, in plain words, with the source for every line.
Short answer
Patient information in a dental clinic falls under Quebec's health information law (R-22.1), not only Law 25. Before any patient information goes to a provider outside Quebec, including Toronto, the clinic must assess the arrangement and sign a contract with specific terms. The Ordre des dentistes requires significant phone communications to be entered in the record, kept at least five years from the last entry. Callers must be told what is collected and why. Whether an AI receptionist needs Quebec's health technology certification has not been settled.
This is a guide for clinic owners, not legal advice. Every line points to the law or the regulator's own page, checked on 2026-10-26. Where we could not confirm something, the page says so.
Quebec has two privacy laws, and which one applies depends on the record.
What this means for the clinic. A Law 25 checklist is not the whole answer for a dental clinic. The health law sets the rules for what callers say about their teeth, their pain and their appointments.
Toronto is outside Quebec. So is every cloud region outside the province.
What this means for the clinic. Processing outside Quebec is not banned, and a vendor's hosting label does not do the clinic's assessment for it. The clinic needs the vendor's real data map (phone network, audio, transcription, storage, backups, every subcontractor) to complete its own assessment.
In the Ordre's standards directory, record-keeping guide, code of ethics and 2024-25 annual report, we found no standard written for AI or call recording. That is what we read, not proof that none exists. Its existing duties apply either way.
What this means for the clinic. The clinic decides what from each call enters the patient record and who verifies it, keeps that record itself for at least five years, and makes sure it can export records before a vendor deletes anything.
What this means for the clinic. Decide exactly what callers hear before anything is collected or recorded, cover minors and representatives, document each purpose and keep evidence of consent. “This call is recorded” on its own is not a consent process.
When a decision about a person is based exclusively on automated processing, the clinic must tell the person by the time it communicates the decision, give on request the information used and the reasons, allow corrections, and let the person make observations to someone who can review the decision.
What this means for the clinic. An AI voice on the line does not by itself trigger this duty. A workflow in which the agent refuses or ranks an appointment with no person involved might. Classify each workflow.
A confidentiality incident involving health information must be contained and, where there is a risk of serious injury, reported diligently to the Minister, to the Commission d'acces a l'information and to the people affected. The clinic must assess the risk and keep an incident register. For non-health information under P-39.1, the notices go to the Commission and the people affected.
What this means for the clinic. There is no verified blanket 72-hour deadline in these sections. The duty is prompt notice.
Quebec certifies technology products and services that handle health information (the TGV program). The government's page describes broad categories. Its October 2026 guidance on AI transcription says those tools need the supplier's certification plus the acquiring organization's own privacy assessment, verbal patient consent at least, and notice that AI is used. The older network rule that the certification page links names private physician offices and laboratories, not ordinary dental offices.
What this means for the clinic. Whether an AI receptionist that transcribes calls for a private dental clinic falls inside the certification requirement has not been settled by any published source we read. A written answer from the certification office, or counsel's opinion, is needed. Nothing here claims an exemption, and nothing here claims any product is certified.
Drawn from the rules above. The sources are the health information act, its governance regulation and the dental record-keeping regulation.
Aida is Attainment's AI agent for clinic phones and messages. Each practice sets its opening notice, its AI disclosure and its call handling before launch, using its own state or province rules; what the law requires is not optional, and this guide does not replace that check. The guide stands on its own whether or not you look at the product.