PHIPA Compliance for Canadian Dental Practices — A 2026 Checklist

What PHIPA actually says (in plain English)

The Personal Health Information Protection Act, 2004 (PHIPA) governs how personal health information (PHI) is collected, used, and disclosed in Ontario. Dentists are explicitly named as Health Information Custodians (HICs) under section 3(1). That means the legal accountability for every patient record, radiograph, perio chart, and chairside conversation that gets transcribed sits with the dentist — not the vendor, not the cloud provider, not the AI model.

PHIPA is principle-based rather than prescriptive. It does not list "use a specific encryption algorithm" or "host in Toronto." Instead it requires you to take reasonable steps to: limit collection to what's necessary, secure the information against theft and unauthorized access, log accesses, obtain consent (express or implied depending on context), and retain or destroy records appropriately. The Information and Privacy Commissioner of Ontario (IPC) enforces it, and its guidance documents are where most of the practical detail lives.

Outside Ontario, similar laws apply — PIPA in British Columbia and Alberta, the Personal Health Information Act in Manitoba and New Brunswick, and PIPEDA federally for inter-provincial work. PHIPA is the strictest of the bunch for dental practices, so meeting PHIPA generally satisfies the others.

The 2026 dental-practice checklist

Use this as a self-audit you can complete in an afternoon. If a vendor or platform handles any of these on your behalf, get the answer in writing — not on a sales call.

• Data residency: every system that touches PHI (practice management, imaging, AI scribe, backups) processes and stores data in Canada. If a vendor uses sub-processors, they are named and Canadian-resident.
• Encryption: at rest (minimum AES-256) and in transit (TLS 1.2 or higher) — for charts, radiographs, and any AI-generated text.
• Access controls: role-based, with unique logins per staff member and mandatory MFA on anything reachable from the open internet.
• Audit logs: every access to a patient record is logged with user, timestamp, and action. Logs are retained for at least the same period as the underlying chart.
• Consent: documented, plain-language consent at intake for digital radiography, AI-assisted documentation, and any data sharing. Consent is revocable; revocation is logged and acted on within a reasonable timeframe.
• Retention: charts are retained for 10 years post-last-visit (RCDSO guidance for Ontario dentists), and destroyed securely after. AI metadata is retained alongside the chart for traceability.
• Vendor agreements: every PHI-touching vendor signs a PHIPA-aligned agreement that defines purpose, sub-processors, breach notification timelines, and a zero-training clause.
• Breach response: a written plan exists, the practice principal can execute it, and the IPC contact path is documented.

Where AI scribes complicate the picture

An AI scribe records the chairside conversation, transcribes it, and writes a structured note. Three PHIPA-relevant questions appear the moment you turn one on: where does the audio go, who can read it, and is it used to train a model.

Audio routing matters because the recording itself is PHI the second it captures a patient's voice and clinical context. If the vendor streams audio to a US-based transcription service, you've effectively disclosed PHI to a US sub-processor — which is permissible under PHIPA only with appropriate safeguards and (usually) explicit consent. Practices that want to stay on the safe side of the IPC's published guidance keep audio entirely in Canada.

Model training is the silent risk. Many AI vendors reserve the right to use customer data to improve their models. For a dental practice that is a problem: clinical conversations could end up in a training set that powers a product sold to your competitors, or worse, leak verbatim back to another user via prompt injection. A zero-training contractual clause is the only durable fix.

What "PHIPA-aligned" should mean from a vendor

"PHIPA-aligned" is marketing language unless it's backed by specific commitments. The minimum bar in 2026:

• Canadian data residency (provable — region name, sub-processor list).
• Encryption in transit and at rest with current standards.
• Zero-training policy in the contract, not just on the website.
• Per-practice audit logs you can export.
• Named breach notification timelines (24–72 hours is the modern standard).
• Right to delete on contract termination, with timeline and method specified.
• A privacy/security contact who responds to PHIPA questions within one business day.

Putting it together — a practical 30-day rollout

If your practice is starting from scratch, you don't have to boil the ocean. A pragmatic 30-day plan: Week 1 — inventory every system that touches PHI and map where data physically lives. Week 2 — pull vendor contracts, flag missing PHIPA clauses, and start the renegotiation. Week 3 — turn on MFA everywhere, audit user accounts, and prune anyone who shouldn't have access. Week 4 — document the breach response plan and run a tabletop exercise.

After that, PHIPA compliance becomes a quarterly review rather than a project. Nurvivo Dental ships with the contractual and infrastructure pieces in place (Canadian residency on AWS Toronto, AES-256, audit logs, zero-training) so the practice's residual work is mostly process: consent, training, and the breach plan.