Privacy & Security Tips

July, 2026

New Federal Direction on Privacy and AI in Health Care

Last month, the federal government introduced Bill C-36, the Protecting Privacy and Consumer Data Act, unveiled its national AI strategy, AI for All, and announced a $100 million investment in VITAL, a new collaborative health data platform based at Unity Health in Toronto. VITAL will connect more than 160 hospitals across Ontario, Alberta, and Quebec, serving over 20 million Canadians.

Together, these initiatives signal a clear federal commitment to strengthening privacy protections and public trust. As a cornerstone of the AI strategy, VITAL will securely connect de-identified hospital data across Canada to support research, clinical trials, and AI-enabled health technologies within a robust governance and privacy framework to protect patient privacy and maintain patient control over their health data. The AI strategy also highlights health care as a priority sector for AI innovation and investment, while emphasizing safe, transparent, and accountable deployment. While Bill C-36 is currently before Parliament, it marks a shift toward stronger privacy protections, greater organizational accountability, and increased expectations for responsible AI use.

For Ontario primary care clinicians, these federal initiatives do not change existing obligations under the Personal Health Information Protection Act (PHIPA) but reinforce the increasing use of AI-enabled tools in clinical practice and the need for transparency, privacy, and accountability.

To date, provincial attention has been focused on mitigating the clinical, legal, privacy and security risks related to AI scribes through the Ontario AI Scribe Program.  More recently, OntarioMD, Ontario Health and the Centre for Effective Practice have been examining AI Clinical Decision Support Systems. The conversations on AI tools in health care are just getting started, with many novel opportunities to support clinical workflow available.  However, before adopting a new digital tool, clinicians should ask how patient data is collected, used, and protected, to ensure the technology supports rather than replaces their clinical judgment.