CPSO AI Policy Template: Free Download for Ontario Medical Clinics
Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
This is the clause-by-clause AI use policy that Ontario medical clinics can adapt and adopt. Every clause operationalizes a named obligation: the CPSO’s Using Artificial Intelligence in Clinical Practice advice (August 2025), PHIPA’s custodian duties and breach-notification rule, and the IPC’s January 2026 AI-scribe guidance. The download is an editable Word document plus a one-page implementation checklist.
It’s the artifact a physician lead can hand to the clinic’s privacy officer for sign-off, or to an underwriter on the next cyber insurance renewal.
What’s in this download
- Twelve numbered policy clauses covering accountability, patient consent, PHI handling, output verification, vendor diligence, training, and breach response, each tied to the CPSO advice, PHIPA, or IPC guidance it operationalizes.
- An approved-and-prohibited tools matrix built around the Ontario AI Scribe Program Vendor of Record list (Supply Ontario Tender-20123, 30 qualified vendors as of August 2026), with a hard prohibition row for consumer chatbots and PHI.
- A consent and disclosure kit: the 30-second scribe script, re-consent wording for follow-up visits, and chart-note documentation lines for consent, decline, and mid-visit withdrawal.
- A 20-question vendor due-diligence intake, a privacy impact assessment starter, a staff training outline with acknowledgement form, and an incident runbook keyed to PHIPA’s actual notification rule.
What the CPSO expects, and how the template answers it
According to the CPSO’s Using Artificial Intelligence in Clinical Practice (August 2025), physicians remain ultimately accountable for their use of AI tools, and must obtain patient consent before recording a clinical encounter with an AI scribe. The advice replaced the College’s earlier scribe-only guidance and now covers decision support, intake, and triage tools as well.
CPSO keeps the accountability with the physician. If an AI scribe records a visit, get express consent first. The template gives staff the rule and a chart-note line to document it, and it names an AI Lead so the clinic knows who owns the process.
The breach clause is written from the statute, not from a U.S. template. PHIPA section 12(2) requires notifying the affected patient at the first reasonable opportunity; the only 60-day period anywhere in PHIPA is a ministerial comment window. A U.S. HIPAA 60-day clock does not belong in an Ontario clinic policy.
The tools matrix ships with worked rows. Vendor of Record scribes are the preferred lane; the program has already done privacy, security, and contract diligence for Ontario practices, at program pricing. EMR-embedded AI features are the second lane.
And a prohibition row answers the question every clinic staff member eventually asks about pasting patient details into a free chatbot. The answer is no.
“The clinics that struggle with an AI incident are never the ones missing a fancy policy. They are the ones where nobody could say which tools were approved, who consented, and where the audio went. A one-page tools matrix with named owners answers all three before anyone asks.”
Mike Pearlstein, CISSP, CEO, Fusion Computing
On the productivity side, the public evidence is real. OntarioMD’s 2024 AI scribe study of 150 primary care providers reported 70 to 90 percent less time on documentation, three to four hours returned per clinical week.
The OMA’s April 2026 primer endorses adoption while warning that scribe accuracy is not 100 percent. The template’s output-verification clause lets a clinic pursue those savings while requiring a clinician to review every AI-drafted note before it enters the chart.
Who is this for?
This template is for the physician lead or clinic manager of an Ontario community practice, family medicine, specialist, or multi-physician clinic, that is adopting an AI scribe or already has one running informally and needs the governance to catch up. If staff are already using AI and the clinic’s only control is a verbal “be careful,” this gives you a concrete starting point for putting governance around it.
It’s also for allied-health and multi-disciplinary clinics that operate as health information custodians under PHIPA. The PHIPA clauses, the vendor diligence intake, and the tools matrix apply to any custodian; the CPSO-specific clauses are marked so a chiropody, physiotherapy, or psychology practice can adapt them to its own college’s expectations.
It’s not a substitute for legal advice, and it’s not intended for hospitals, which have their own governance machinery. Clinics outside Ontario should replace the PHIPA and IPC references with their provincial equivalents before adopting.
Download the CPSO AI Policy Template
Fill in the three fields below. You get download links for the Word template and the PDF checklist on screen as soon as you submit, and we email you both files as a backup.
FREE DOWNLOAD
The CPSO-Aligned AI Use Policy Template for Ontario Clinics (2026)
Twelve clauses, the VoR tools matrix, the consent kit, and the implementation checklist. Editable Word document plus a one-page PDF.
Written by Mike Pearlstein, CISSP. No sales call required. Prefer to talk it through? Book a consultation.
Form not loading? Email us directly and we’ll send the template the same business day.
Related deep dives
- CPSO AI disclosure to patients: the Ontario clinic playbook: the disclosure triggers, the 30-second script, and the consent rules the template’s Clause 5 operationalizes.
- AI scribes for Ontario family doctors: the PHIPA comparison: the vendor landscape behind the template’s tools matrix.
- The PHIPA breach notification SOP: what “first reasonable opportunity” means operationally when Clause 10 fires.
- AI for Canadian healthcare clinics: the strategic roadmap the policy sits inside.
- Claude for healthcare clinic back offices: what admin-side AI adoption looks like under a policy like this one.
Frequently Asked Questions
What’s the download?
An editable Microsoft Word policy template (twelve clauses with numbered sub-clauses, roughly 3,900 words) with the approved-and-prohibited tools matrix, the consent and disclosure kit, the 20-question vendor due-diligence intake, a privacy impact assessment starter, a training outline with acknowledgement form, and an incident runbook. Plus a separate one-page PDF implementation checklist. The Word document is editable; the PDF is ready to print or share. Both are written for adoption by Ontario clinics.
How will my data be used?
Your name, clinic name, and email go into Fusion Computing’s contact system. The download links appear on screen right after you submit. We also email the template files as a backup. We do not sell your contact information. We use service providers, including our CRM and email systems, to process the form and deliver the files.
We may send occasional updates relevant to Ontario clinic IT and AI governance, no more than once a month. Any ongoing marketing email includes an unsubscribe link. See our Privacy Policy for details.
Is this just a sales pitch?
No. The Word template and the checklist are the deliverable, and they work without our involvement. You do not need to speak to us to use them. We make it free because regulator-anchored documents are how Ontario clinics find out we exist. If you later want help with the Microsoft 365 configuration behind the PHI-handling clause (Clause 6), or with vendor selection from the VoR list, you can reach out on your own timeline.
Is this template CPSO-approved?
No, and be wary of anything that claims to be. The CPSO publishes advice and policies; it does not certify third-party templates or AI tools. This template is CPSO-aligned: each clause cites the specific advice, statute, or guidance it operationalizes, so your privacy officer and, where needed, your lawyer can verify the mapping themselves.
Can I share it with colleagues or my privacy officer?
Yes. Share it inside your clinic, with your privacy officer, your college advisor, your broker, or your IT vendor. Attribution to Mike Pearlstein and Fusion Computing must remain on the title page; beyond that, adapt it freely to your clinic’s specifics. No resale.
Who wrote this?
Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. The template was written against the CPSO’s August 2025 AI advice, the text of PHIPA and O. Reg. 329/04, the IPC’s January 2026 AI-scribe guidance and the joint IPC-OHRC responsible AI principles, the OMA’s April 2026 primer, and the Supply Ontario Vendor of Record arrangement, all verified against the primary sources in August 2026.
Bottom line
The CPSO has not mandated a written AI policy. It has made clear that physicians are accountable for their AI use, that express consent precedes AI-scribe recording, and that privacy obligations follow the tool wherever the data goes.
If a complaint or privacy incident puts AI use under review, the clinic should be able to show which tools were approved, how consent was recorded, and who owned the response. A written policy is how you get there.
Start with the template, then decide whether the clinic needs outside help to implement the controls behind it.
If you want help with the Microsoft 365 and Purview configuration that sits behind the PHI-handling clause (Clause 6), scribe-vendor selection from the VoR list, or the monitoring that keeps Clause 11 defensible, that is work Fusion does for Ontario clinics.
