Checklist for Healthcare Organizations Considering the use of an AI Scribe
Checklist for Healthcare Organizations Considering the use of an AI Scribe
CHECKLIST FOR HEALTHCARE ORGANIZATIONS CONSIDERING THE USE OF AN AI SCRIBE
This checklist is meant to assist healthcare organizations in Saskatchewan through a privacy and security self-assessment to determine readiness for AI scribe implementation. We recommend checking off each task as it is completed:
1. Assessing Collection, Use and Disclosure of Personal Information
- Do you have a good understanding of how your chosen AI scribe product works, and all the capabilities/features it offers?
- Do you understand all the personal health information elements that your organization will be collecting, using and disclosing when using the AI scribe product?
- Do you understand all the personal health information elements that the AI scribe vendor will be collecting, using and disclosing when you use the AI scribe product?
- Is there legal authority under HIPA1 for each of the planned collections, uses and disclosures of personal health information in connection with the AI scribe product?
- Have you assessed whether each of the planned collections, uses and disclosures of personal health information would be “reasonably necessary” as provided in section 23(1) of HIPA?
If you or your organization cannot identify a HIPA authority for each of the collections, uses or disclosures of personal health information involved in your initiative, then it is best not to forge ahead
2. Reviewing the AI Scribe Vendor’s Privacy Policy and Service Agreement
- Have you carefully examined the AI scribe company’s policies and service agreement?
- Carefully examine the AI scribe company’s statement with respect to the collection, use or disclosure of personal health information. Examine for clauses that would violate HIPA such as if the vendor represents in the contract that it will use the personal health information for secondary purposes or disclose personal health information to third parties. Know that most AI scribe vendor contracts in Canada at the moment are drafted to comply with the federal PIPEDA2 but this does not satisfy the unique privacy requirements of the province of Saskatchewan.
- Check to ensure that all the vendor’s practices are compliant with HIPA.
- Ensure that the company will provide you and your organization with timely notification if it plans to introduce new AI capabilities or make other changes that will directly impact on the privacy of your patient’s personal health information.
- Please consult with your privacy officer and the Saskatchewan Office of the Information and Privacy Commissioner (Sask. OIPC) and/or seek independent legal advice before entering into a contract with a vendor if you are unsure.
3. Conducting a Privacy Impact Assessment (PIA)
- Have you completed a privacy impact assessment for your AI scribe product? See the OIPC guidance document on our website here.
- Have you identified risks and developed appropriate mitigation strategies to address those risks?
4. Obtaining Patient Consent
- Have you developed a protocol for obtaining and documenting express written consent from patients before using the AI scribe?
- If using a consent form, is the content and language at an appropriate level for patients to understand? (Forms supplied by AI scribe vendors may have to be scrutinized and amended).
- Ensure that patients are provided with the following information during the consent process:
-
A clear explanation of what the AI scribe is and how it works;
-
Details about how and why their personal health information will be collected, used and disclosed (by both your organization and the AI scribe vendor) as per section 9 of HIPA;
-
Open and transparent information about any potential risks to their privacy (such as what can happen if there is a privacy breach);
-
Open and transparent information about the extent to which the tool will be used to make decisions about them – if at all;
-
The fact they may refuse the use of the AI scribe during their visits and may also withdraw their consent at any time, without it changing the quality of the health care you intend to provide, as per section 7 of HIPA;
- They have a right to complain to you as well as the Sask. OIPC; and
-
- If the patient withholds consent to the use of the AI scribe, ensure that there is staff available to take manual notes.
- Ensure your organization has a policy to re-evaluate the consent protocol in order to assess the “function creep” in the AI scribe product you have chosen so that any new privacy implications will be acknowledged and consent will be addressed on an on-going basis.
5. Accessing the Accuracy of the AI Scribe’s Product
- Have you assessed the accuracy rate and validity of your chose AI scribe product?
- Have you developed policies requiring active and continuous human oversight of the AI scribe’s outputs before they are used in clinical care? A human must always be involved in an oversight position.
- Commit to regular audits of the AI scribe product to ensure the accuracy of the AI scribe’s output.
- Ensure there is a mechanism in place to report observations about inaccuracies, biases or any other potential harms back to the AI scribe vendor for the purposes of evaluation and improvement.
6. Securing Personal Health Information
- Do you and the AI scribe vendor have security arrangements in place that will ensure your duty to protect the personal health information is paramount as per section 16 of HIPA. This duty to protect personal health information cannot be contracted out and is still your prime responsibility as indicated in section 18 of HIPA.
- Ensure the AI scribe vendor is contractually obligated to report any privacy breaches on their end to you and your organization upon discovery.
7. Implementation of Privacy Policies and Procedures
- Ensure that you have established written policies concerning the retention and destruction of personal health information as mandated by section 17 of HIPA so that you may respond to privacy complaints and requests for access and the correction of the personal health information.
- Ensure that you conduct regular reviews of your policies and procedures and that you examine for “function creep” in the AI scribe product which can result in morphing privacy implications over time.
1 The Health Information Protection Act, SS Chapter H-0.021, as amended.
2 Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, as amended.