CPSO AI Disclosure to Patients: When, How, and What to Document (2026)

Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.

Note: the clinic, the family physician, and the consent script below are composites drawn from four Ontario clinic engagements between late 2025 and early 2026. Names are changed. The CPSO citations, the consent elements, and the chart-note structure are real.

Book a Free Clinic IT Consultation

This post builds on the PHIPA-compliant AI playbook for Ontario clinics. Read that first if your clinic has not yet landed on a sanctioned AI scribe and a written AI use policy.

My question here is narrower, and I get asked it more than any other by Ontario clinic owners. At the moment a physician walks into the exam room with an AI tool running, what does CPSO require be said to the patient? What gets written down? What would an auditor look for if that chart were pulled tomorrow?

I’m an MSP, not a physician and not a regulator. Put the language below in front of your professional-responsibility counsel and your CMPA contact before adopting it. What follows is the disclosure architecture I’ve helped four Ontario clinics put into production.

The CPSO Advice on AI in Clinical Practice: What It Does and Doesn’t Say

---

The Advice is a companion document rather than a free-standing policy. It interprets what physicians already owe patients and applies it to AI. CPSO says so plainly. Although there is not currently a specific law or policy addressing AI, the core expectations of physicians remain unchanged.

Three operative duties come out of that for every Ontario physician. Inform the patient how AI will be used. Obtain consent before recording. Stay accountable for whatever the tool produces, whatever the vendor claims.

What the Advice leaves open matters just as much. It does not label the consent express or implied. It prescribes no chart-note template, approves no vendor, and sets no retention period for the scribe’s audio. Those gaps are where Ontario clinic audit risk lives.

Neighbouring CPSO policies fill them. Consent to Treatment supplies the express-versus-implied framing. Medical Records Management sets the retention floor at 10 years from the last entry for adult records. Paediatric records run 10 years past the day the patient reached or would have reached 18 (CPSO Medical Records Management, June 2022).

The Three Disclosure Triggers

---

Across our 4 Ontario clinic client engagements in 2025 and 2026, three workflows reliably crossed the CPSO disclosure threshold. The rest of a clinic’s AI footprint usually did not. The written AI use policy has to name which tool sits on which side of that line.

• Trigger 1, an AI scribe recording the encounter. The patient is recorded and that recording feeds a model that drafts the note. Consent before the recording starts, every time.
• Trigger 2, AI-driven clinical decision support. A tool reads history, vitals, imaging or labs and returns a differential, a recommendation or a risk score the physician leans on. Tell the patient AI is in the loop, and keep independent judgment over the output.
• Trigger 3, AI billing and coding automation. PHI leaves the EMR to generate OHIP codes, prior-authorization narratives or insurer documentation. A PHIPA agent agreement plus patient-facing notice, usually at clinic-policy level rather than visit level.

Trigger 1 is the live decision in most Ontario family practices right now, because the province has actively encouraged adoption. The measured upside is large and it is documented (OntarioMD, AI scribes, 2024 evaluation).

The benefit is real. The consent step is what keeps it defensible. For the vendor-by-vendor view of data residency, PHIPA agent terms and audit-log retention, see the AI scribe PHIPA comparison for Ontario family doctors.

Implied vs Express Consent for AI Use

---

That list is where most Ontario clinic policies go wrong, because an AI scribe recording appears on none of it. Reading the recording as a treatment question sends you hunting for the wrong authority.

Why the Health Care Consent Act is the wrong lens

The practical consequence is small and load-bearing. Because this is a PHIPA consent rather than a treatment consent, it is knowledge-based, withdrawable at any time, and the clinic carries the burden of showing the patient actually knew. Silence in the chart is the failure mode.

Implied consent, meaning the patient is sitting in the room so they must be fine with the microphone, does not meet that burden. Express consent does, and CPSO accepts it orally. That single line is why verbal consent plus a chart note is a workable Ontario standard.

Decision support and billing automation sit differently. A clinic can describe AI billing the way it describes its EMR vendor or the lab it sends bloodwork to. Notice at intake, on a posted sign, and in the website privacy policy generally satisfies PHIPA transparency. Visit-by-visit verbal consent belongs to the scribe.

The 30-Second Disclosure Script

---

The script below is the one I’ve helped four Ontario clinics put on the exam-room wall and on the back of the intake clipboard. It also lives inside the EMR template physicians click at the first visit of the day. It runs about 30 seconds.

Three things make it work in an Ontario exam room. It names the tool, so the patient can look it up. It answers residency and retention in one breath, so nothing sounds dodged. And it puts the right to refuse on the table before the patient has to ask.

The script is the front half of the transaction. The chart note is the back half, and the two have to agree. Under PHIPA, a verbal consent obtained and never written down is indistinguishable from no consent at all.

If you want the script localized to your EMR, your sanctioned scribe vendor and your data-residency posture, book a clinic IT consultation with Mike Pearlstein, CISSP, and we’ll send the version we run with our Ontario healthcare clients.

Documentation Requirements: The Chart-Note Template

---

The template below is the one I put in front of clinic owners. It is what a CPSO audit, an IPC inquiry or a CMPA claims file would expect attached to the first encounter where the scribe ran. 5 fields, 2 lines in any modern EMR, built as an auto-text macro at every clinic we deploy.

The five fields, and what each one proves

An auditor looks for a note from the first encounter onward with all 5 populated, dated and attributable. What the IPC position warns against is a clinic-wide blanket consent that bundles the scribe in with every other registration form.

Bundled consent carries neither the informed element nor the specificity PHIPA requires. Visit-level verbal consent does, and the chart note ties the two together. For the parallel PHIPA documentation set, see the IPC AI in Healthcare checklist walked through with a four-doctor clinic.

If your clinic is mid-deployment and the chart notes are already running silent, talk to a CISSP-led clinic IT team before the backfill gets any larger.

When Disclosure Is Not Required (And the Audit-Defensible Reasoning)

Not every AI tool in an Ontario clinic reaches the patient. Drawing the line explicitly is the point. A clinic that over-discloses turns every visit into a 90-second preamble, and a clinic that under-discloses ends up explaining itself to CPSO or the IPC. The line sits in one of three places.

The three exemption categories

• The tool sees only de-identified data. A population-health model running over a de-identified panel implicates no individual patient’s consent. The de-identification has to be real. Stripping a name while leaving date of birth and postal code in place is not de-identification.
• The tool runs entirely on the physician’s device. Local dictation that never ships audio to a vendor and stores no PHI off the device does not cross a PHIPA transfer line. Telling the patient anyway is good practice rather than an obligation.
• The tool is administrative with no clinical influence. Scheduling optimization reading appointment slots, an SMS reminder bot on a clinic rule set, or inbox triage that never opens clinical content can be handled at policy level with notice at intake.

The reasoning is the deliverable in all 3 cases. The policy names every tool, assigns a category, states why, and gets signed and reviewed annually. IPC guidance is clear that an absent consent step has to be reasoned, written and reviewable.

I have yet to see a clinic get the administrative category right on the first pass. “We don’t need consent because the tool is administrative” collapses the moment that tool turns out to be reading referral letters and posting them to a US-hosted summarization API. Our engineers found exactly that at 2 of our clients.

The 5-Step Rollout: From Policy to Audit

The rollout below is the one I’ve walked four Ontario clinics through, and each step constrains the next. Train physicians before the policy exists and disclosure comes out inconsistent. Ship a consent form before the chart template exists and the charts are unauditable. Order is doing most of the work here.

1. Week 1, write the AI use policy. Name every AI tool in use. Categorize each as recording, decision support, billing automation, administrative or de-identified. Map the data flow per tool: where PHI goes, who processes it, how long it is kept, and whether a PHIPA agent agreement exists.
2. Week 2, train physicians and staff. Walk every physician through the script and every front-desk staff member through the intake changes. Walk the owner and privacy officer through the CPSO Advice and the IPC guidance. Training lands before the consent form goes out.
3. Week 3, update consent and intake materials. Add an AI disclosure section to the intake form, a visible notice in each exam room, and tool use, residency and retention to the website privacy policy. The patient meets the disclosure three times.
4. Week 4, deploy the chart-note template. Build the five fields as an EMR auto-text macro. Train physicians to fire it at every first encounter with the scribe running and at any visit where the scope changes. Audit the first 20 encounters.
5. Week 12 and each quarter after, audit. Pull 30 random charts from the prior quarter. Confirm consent documentation on every encounter where the scribe ran. Re-train the physicians whose notes show gaps, sign the audit off, and file it. That file is what the owner hands an investigator.

What the 12-week timeline actually costs

Four weeks of clinic-side effort spread over 12 calendar weeks is the usual price. In our experience the payoff is that the paperwork reduction OntarioMD measured becomes bankable, instead of turning into an audit exposure that surfaces two years later with interest.

“When a Mississauga family physician asked whether her AI scribe disclosure needed a signed form, the scribe had already been running about six weeks. The CPSO Advice had been live for months. Her chart notes said nothing about consent at all.”

“We rebuilt the disclosure language for active patients and retrained the front desk on the 30-second script. The practice manager shipped the chart-note template the same week. The defensible position was back before the question ever reached the College.”

Mike Pearlstein, CEO, Fusion Computing. Anonymized client data, Ontario family-practice engagement, Q1 2026.

The Fusion Computing benchmark across those four rollouts points the same way. Clinics that close a documentation gap on their own schedule spend a fraction of what the same fix costs once a complaint has started the clock.

Do and Don’t: The Consent Rules Explained

Four pairs cover most of what an Ontario clinic gets wrong in its first year with an AI scribe. Every Don’t below is something we have found live in a real clinic policy, and each Do is what replaced it. Fusion Computing recommends taping this list inside the policy binder.

If you want a discovery call to map your current disclosure posture against these 5 steps, book a free clinic IT consultation with our Ontario healthcare team and we’ll walk it with you.

Peer Regulator View: How Other Provinces Approach AI Disclosure

CPSO does not answer every AI question itself. The Advice points physicians toward the Canadian Medical Protective Association and the Ontario Medical Association for further guidance. CPSO also leans on CMPA’s own account of where AI can assist with elements of care (CMPA, advice and publications).

On vendors, CPSO is explicit that it cannot recommend specific AI applications. It points instead at two procurement lists. The Ontario AI Scribe Program run with Supply Ontario and OntarioMD, and Canada Health Infoway’s AI Scribe Program, whose vendors cleared a pan-Canadian procurement process.

For telehealth across a provincial line, meet the strictest regime you touch. Apply the CPSO script and the five-field chart note as the floor, then add Quebec’s Law 25 transfer notice when the patient is in Quebec. See the cross-border PHI guide.

Further reading and primary sources

• Personal Health Information Protection Act, 2004 (PHIPA). The governing statute for every Ontario custodian of personal health information.
• Health Care Consent Act, 1996. Sets the elements of valid consent to treatment, and defines what treatment excludes.
• CPSO, Protecting Personal Health Information. The policy CPSO cross-references from the AI Advice.
• IPC and OHRC, Principles for the responsible use of artificial intelligence (January 21, 2026). Joint privacy and human-rights principles for AI adoption in Ontario.
• Ontario Medical Association practice and professional support. Practical guidance and contract templates for Ontario clinic owners.

Frequently Asked Questions

Does CPSO require written consent, or is verbal consent enough for an AI scribe?

Verbal consent, documented in the chart, is enough for routine visits. CPSO’s Consent to Treatment policy defines express consent as agreement that is direct and explicit, and says plainly that it can be given orally or in writing. The AI Advice requires consent before recording without prescribing a form.

Written consent earns its keep in an Ontario clinic when the visit is sensitive. Mental health, sexual health, and paediatric assessments involving both parent and child are the usual cases.

Can I take one consent at intake and rely on it for every future visit?

Intake consent works as the policy-level disclosure, but each visit where the scribe runs should still produce a line in the chart confirming the patient was informed and agreed that day. PHIPA consent attaches to the collection, and each recorded encounter is a fresh collection.

The rule we put in production is intake consent plus a single-line re-confirmation at each visit, worded “AI scribe consent re-confirmed, verbal”. It costs about 5 seconds and it closes the audit gap.

What if the patient refuses the AI scribe?

Accept it with no consequence to their care. Voluntariness is a consent requirement under both the CPSO framing and PHIPA, and a refusal that changes how a patient is treated is not a refusal the clinic can defend.

Document it (“patient declined AI scribe, manual note”), run the encounter without the scribe, and leave the question alone for that visit. PHIPA treats a withheld consent the same way it treats a withdrawn one.

Does CPSO require disclosure of AI billing automation?

AI billing that processes PHI to produce OHIP codes, prior-authorization narratives or insurer documentation usually reaches the patient at clinic-policy level rather than in the exam room. The Ontario clinic privacy policy and the intake form should describe it.

Visit-by-visit verbal consent is generally optional here. The PHIPA agent agreement with the billing vendor is not, and it stands regardless of how the notice is handled.

Does the vendor’s “PHIPA compliant” claim discharge my consent obligation?

No. The August 2025 CPSO Advice states that physicians are ultimately accountable for their use of AI tools, including for medical documentation. A vendor’s compliance claim is where your due diligence starts, not where your obligation ends.

Verify the PHIPA agent terms, data residency, audit-log retention and breach commitments yourself. IPC guidance treats vendor assessment as a custodian responsibility.

How long should I keep the AI scribe audio recording?

The 10-year CPSO retention floor attaches to the clinical note the scribe produces, because that note becomes the medical record. Adults are 10 years from the last entry. Paediatric records run 10 years past the day the patient reached or would have reached 18.

The audio is a different question. Most clinic-grade scribes delete it once the note is final, and some hold it for a short audit window. Whatever the answer, it belongs in the Ontario clinic’s AI use policy and in the consent script.

Can I keep the audio to train the AI model on our clinic’s patterns?

Generally no, unless the patient has been told specifically and has agreed to that use. Recording for clinical documentation is one purpose. Training a model is a second purpose, and PHIPA consent attaches to the purpose.

Most clinic-grade scribes disable training on customer data by contract. Confirm yours says so explicitly. Contributing data to model improvement is a separate purpose under PHIPA, and it needs its own consent.

If CPSO audits me, what will they ask about AI use?

Expect 5 questions. Which AI tools are in clinical use. What the written AI use policy says. How consent is obtained and documented. What a representative chart note looks like. How often the clinic audits itself. The rollout above produces the evidence pack that answers all 5.

Deep vendor-technical questions are more IPC territory in Ontario. CPSO’s interest is professional responsibility: was consent obtained, was it written down, is the documentation defensible.

Bottom Line: What CPSO Requires and What It Doesn’t

CPSO requires four things and prescribes none of the paperwork. Inform the patient how AI will be used. Take consent before recording. Stay accountable for the output. Keep the record. The 30-second script, the five-field chart note and the 12-week rollout are what turn those four duties into something an Ontario clinic can hand an auditor.

Mike Pearlstein, CISSP, runs this rollout with Ontario clinics end to end.

Schedule Your Free Clinic Consultation