AI receptionist privacy checklist: 12 questions to ask any vendor

The short checklist: 12 questions to ask any vendor

Ask each vendor these twelve questions before go-live, and ask for the answers in writing so your team can compare vendors fairly.

1. What exactly do callers hear about recording, and in what words? Callers should hear that the call is recorded and why.
2. What does the agent collect? Is any of it more than your clinic needs?
3. Where is the information stored and processed? Include anywhere outside Canada or the US.
4. How long are recordings and transcripts retained? How is deletion done, and how is it confirmed?
5. Who at the vendor can see calls, recordings and transcripts?
6. Which subcontractors handle the information, and where are they based?
7. What does the written agreement say? Look for permitted uses, subcontractors, and secure disposal at your request.
8. If something goes wrong, how fast will the vendor tell you? What will the notice include?
9. What are callers told about speaking with an AI?
10. Can your team see, export and correct what the agent collected?
11. What happens to recordings, transcripts and records when the contract ends?
12. Can the vendor put all of this in writing for your clinic?

If an answer is vague, ask again in writing. The sections below explain the official rules behind these questions.

Telling callers a call is recorded

Tell callers up front that the call is recorded and why. If they stay on the line knowing that, consent is usually implied.

The federal privacy commissioner's guidance on recording customer calls is short and practical.

• The organization should tell the caller the call is recorded and state the purpose, “as clearly and narrowly as possible,” covering each use of the recording.
• In most cases, a caller who carries on after a clear notice has given implied consent.
• Callers should be given a choice about whether their voice is recorded.
• Voiceprints or other sensitive information can raise the bar to express consent.

What to ask a vendor: what is the exact opening line, who writes it, and can your clinic change it? What happens when a caller declines recording? Does the agent create voiceprints?

Which law applies to your clinic depends on where you are and how you are set up. Your privacy adviser can confirm.

Ontario: PHIPA and the AI scribe guidance

Under PHIPA, a clinic that is a custodian stays responsible for patient information its vendor handles and must take reasonable steps to protect it.

PHIPA basics for clinics using a vendor

Ontario's Personal Health Information Protection Act (PHIPA) sets rules for health information custodians. Health care practitioners are custodians, and so are people who run a group practice of them. Whether PHIPA applies to your clinic depends on who provides care there, so check with your privacy adviser.

• Reasonable steps. A custodian must take “steps that are reasonable in the circumstances” to protect health information against theft, loss and unauthorized use or disclosure (section 12(1)).
• Agents. An agent acts for the custodian, with its authorization, for the custodian's purposes and not its own. Whether a given vendor is an agent depends on the facts. Ask your privacy adviser.
• Responsibility stays with the clinic. A custodian remains responsible for information its agents handle, and can set conditions on what they do (section 17).
• Breach notice. The custodian must tell the individual at the first reasonable opportunity about theft, loss or unauthorized use or disclosure, and say the person can complain to the Commissioner. The Commissioner is notified when the prescribed requirements are met (section 12(2) and (3)). Ask your adviser about those thresholds.

What to ask a vendor: how fast will you tell us about an incident, and what will you tell us?

What Ontario's regulator says about AI scribes

In January 2026, Ontario's Information and Privacy Commissioner published AI Scribes: Key Considerations for the Health Sector. It is about AI scribes in care visits, not phone lines. Treat it as a useful signal, not a rule for phone agents. The points that carry over:

• Consent is generally required, because no provision explicitly permits an AI scribe to handle health information without it.
• Tell patients about the vendor's involvement, whether information is processed or stored outside Canada, and whether recordings or transcripts are retained.
• The vendor contract should require the vendor to “securely dispose of the records” at the custodian's request, and should cover subcontractors.
• Retain information only as long as it is needed for the purpose.

A phone agent can hear names, symptoms and treatment questions, so the same questions about notice, retention and contracts are worth asking.

Information stored or processed outside Canada

PIPEDA and PHIPA do not bar processing abroad. Say plainly that it may happen and that foreign authorities may be able to access it.

The federal privacy commissioner's guidelines on processing personal data across borders say PIPEDA does not prohibit sending personal information to another country for processing. The organization should “make it plain” that information may be processed abroad and may be accessible to that country's authorities, ideally when it is collected. The organization stays accountable, mainly through the contract.

That guidance dates from 2009 and covers PIPEDA only. It does not address provincial private-sector laws.

For Ontario health information, the same IPC document says PHIPA does not prevent storage outside Ontario or Canada. The custodian is still responsible, and needs to be satisfied that the risks are appropriate, for example through strong contracts.

What to ask a vendor: in which countries is information stored and processed? Where do subcontractors and support staff work? How is the clinic told if that changes?

Other provinces: Alberta and beyond

In Alberta, custodians must prepare a privacy impact assessment before a new system and sign a written agreement with an information manager.

Alberta's Health Information Act asks two things of a custodian that bear on a new AI agent.

• Privacy impact assessment (section 64). Before introducing a new administrative practice or information system for individually identifying health information, the custodian prepares an assessment and submits it to the Commissioner for review and comment.
• Information manager agreement (section 66). A custodian must enter a written agreement with an information manager, which covers a person who provides information technology services that require the use of health information. The custodian remains responsible for following the Act.

Other provinces have their own health privacy laws, and this page does not summarize them. Check the one that applies to your clinic.

What to ask a vendor: will you support the assessment and sign the agreement your province requires?

US clinics: HIPAA and business associate agreements

A covered entity sharing protected health information with a business associate needs a written agreement, called a business associate agreement.

The business associate agreement

Under HIPAA, a covered entity can share protected health information with a business associate only with “satisfactory assurances” in a written contract or other written arrangement. That document is called a business associate agreement, or BAA.

HHS lists examples of business associates, including app developers that provide patient messaging and cloud service providers. It does not list AI phone agents by name, so applying the rule to a phone agent is an inference. Confirm it with your privacy adviser.

Why a HIPAA badge proves little

HHS says nothing requires a covered entity to certify that it follows the Security Rule, and that it does not endorse or recognize private organizations' certifications. A badge on a vendor's site is not a substitute for the agreement. Ask for the BAA terms instead.

Telling callers they are speaking with an AI

We found no federal or Ontario law in force that requires a private-sector phone line to say it is an AI. Your clinic decides what callers hear.

As of October 2026, we found no Canadian federal or Ontario law in force that requires a private-sector phone line to tell callers it is an AI. That is what we found, not a promise that none exists. This page does not cover US state rules.

• Bill C-27, which included the Artificial Intelligence and Data Act, did not pass.
• Bill C-36, introduced June 15, 2026, is at second reading and is not in force. As introduced, its text deals with automated decision systems, not phone calls.

Two related points do apply. Callers should hear the recording notice described above, and the Ontario AI scribe guidance expects patients to know when an AI scribe is in use.

So the choice is the clinic's, ideally made with your privacy adviser. What to ask a vendor: what do callers hear, can our clinic change the wording, and can a caller ask for a person?

How Aida by Attainment answers these questions

Our answer to each question is confirmed in writing for your clinic during setup, because the right answer depends on how your clinic is set up.

Aida is the AI agent Attainment builds for clinics. This page does not give a blanket answer to the twelve questions, because the right answer depends on the clinic's setup.

For your clinic, our answer to each question is confirmed in writing during setup. Ask us for that written answer before go-live, then put the same twelve questions to any other vendor you are considering.

Want these answers for your clinic?

Request a tailored demo and ask for our written answers to these twelve questions. They are confirmed for your clinic during setup.