Office of the Information and Privacy Commissioner – Report A-2026-001 Released

In December 2024, a hospital reported a privacy breach to the Ontario IPC after an AI scribe tool (Otter.ai) recorded a clinical rounds meeting without authorization, due to unapproved use and security gaps. The IPC outlined required safeguards, including robust AI governance, updated policies, offboarding audits, enhanced privacy training, vendor…

A public hospital discovered that a physician accessed three patients’ PHI without authorization, and disclosed PHI to other staff in one instance, prompting a report to the IPC under PHIPA. The IPC found there were gaps in privacy training and policies at the time, but due to remedial actions and corrective measures, a Part VI review was not warranted.

The Office of the Information and Privacy Commissioner (OIPC) released Report A-2026-001. The news release announces the availability of this report and its findings.