Ease AIMost AI receptionist vendors are American. They write compliance content for HIPAA. That does not help you in Ontario.
PHIPA—the Personal Health Information Protection Act—is different. It defines personal health information more broadly. It permits fewer exceptions. And it places the accountability squarely on you as the health information custodian, not on the vendor supplying the tool.
This post explains where the line sits, what an AI receptionist can safely do in an Ontario clinic, and how to design the handoff so the line is never crossed.
What PHIPA defines as personal health information
PHIPA treats as personal health information any identifying information about an individual in oral or recorded form if it relates to their physical or mental health, the provision of health care, or payments for health care.
That includes a patient's name combined with the fact that they have an appointment. It includes their phone number if it appears in your clinic records. It includes the reason for their visit, their symptoms, their diagnosis, their medication and their payment method.
It does not include anonymous scheduling data with no patient identifiers. But the moment you can connect a name to a time slot, you are handling personal health information.
American vendors often tout "HIPAA compliance" as though it transfers. It does not. PHIPA has no safe harbour for de-identified data. It requires explicit consent or statutory authority for every collection, use and disclosure. The penalties are higher, and the Information and Privacy Commissioner of Ontario enforces them.
What an AI receptionist can do
An AI receptionist can book, reschedule and cancel appointments. It can confirm the date and time. It can collect a patient's name and contact details if the patient provides them voluntarily and you have obtained valid consent to collect that information for the purpose of appointment scheduling.
It can answer frequently asked questions about clinic hours, location, parking and fees. It can provide general information about the services you offer. It can triage calls by asking whether the caller is a new patient or an existing one, and route accordingly.
It can handle these tasks by voice or text, on your website, by SMS or through a phone system integration.
It cannot record symptoms. It cannot ask why the patient is calling beyond a basic triage question that determines which staff member should take over. It cannot access your electronic medical record to pull up a patient's history, medication list or outstanding lab results. It cannot tell a patient what their test results were, even if the system technically has access.
The distinction is this: scheduling is administrative. Everything else is clinical. PHIPA permits you to delegate administrative tasks to a third party under a written agreement that meets the requirements of section 12. Clinical tasks require far more restrictive handling.
Where most vendors cross the line
Many AI receptionist platforms marketed to clinics offer "intelligent triage" or "symptom collection." They prompt the patient to describe their concern so the system can prioritise the appointment or route it to the right provider.
That is personal health information. The moment the system asks "What brings you in today?" and records the answer, you are collecting health data. If that data is processed by a vendor's server in another jurisdiction, you have disclosed it. PHIPA requires consent for both, and the consent must be informed, specific and often written.
Some vendors store recordings or transcripts for quality assurance or model training. That is a secondary use. PHIPA does not permit it without separate consent, and most patients do not know it is happening.
Others integrate directly with your practice management system or EMR. That gives the AI access to appointment history, billing codes and sometimes clinical notes. Even if the vendor claims the AI does not "read" that data, the access itself is a disclosure under PHIPA. You need a compliant agreement. Most vendors do not provide one that accounts for Ontario law.
How to design the handoff
The safest design is a hard stop between administrative and clinical information.
The AI collects the patient's name, contact details and preferred appointment time. It confirms availability. It books the slot. Then it hands off to a human staff member before any clinical question is asked.
That handoff can happen immediately, with the AI transferring the call or chat to your receptionist. Or it can happen asynchronously, with the AI logging the appointment and a staff member calling back to complete the intake.
The second model is often more practical. Patients calling outside business hours do not expect a live transfer. They expect to leave their details and receive a call back. The AI handles that interaction entirely within the bounds of administrative scheduling.
When your staff member calls back, they ask the clinical questions. Those answers go into your EMR, handled by trained staff under your direct control. The AI never sees them.
This approach requires you to configure the AI with strict guardrails. It must refuse to answer questions like "Should I come in for this rash?" or "Can you refill my prescription?" It must be programmed to say, clearly and immediately, "I can't help with medical questions. Let me connect you with our team," and then hand off.
Most platforms allow this. Few vendors configure it by default.
When you should not buy this
If your clinic receives fewer than ten calls per day, you do not need an AI receptionist. You need a part-time human receptionist or a better voicemail system.
AI receptionists cost between $3,500 and $8,000 to build and configure properly, plus integration time with your phone system and practice management software. Monthly fees vary depending on call volume and platform, but expect $150 to $600 per month for the AI platform itself, separate from our support rates.
That makes sense when you are handling high call volume, when you are missing bookings because calls go unanswered, or when your front desk staff are overwhelmed during peak hours. It does not make sense when the problem is simply that your voicemail greeting is unclear or your online booking link is hard to find.
Spend money on the problem you actually have.
The agreement you need
If you proceed, you need a written agreement with any vendor whose platform processes patient names, phone numbers or appointment details.
That agreement must meet the requirements of PHIPA section 12. It must require the vendor to protect the information using administrative, technical and physical safeguards. It must limit the vendor's use of the information to the purpose you specified. It must prohibit the vendor from disclosing the information to anyone else without your permission. And it must allow you to audit the vendor's compliance.
Most software terms of service do not meet this standard. You need to negotiate an addendum, or choose a vendor who already provides a PHIPA-compliant data processing agreement.
We draft these agreements as part of every AI chatbot and virtual receptionist build for Ontario health care clients. If a vendor will not sign one, do not use them.
Funding
Ontario for-profit clinics with between one and 499 full-time employees may qualify for the Digital Modernization and Adoption Plan grant, which provides up to $15,000 on a 50 per cent matched basis. The programme explicitly funds hiring an external consultant to produce a digital adoption plan. The general roster of approved consultants is closed, but the Ontario Centre of Innovation permits case-by-case approval of a consultant you identify yourself.
You cannot combine DMAP with the Retail Modernization Project Grant. The Technology Demonstration Program requires a completed DMAP and $750,000 or more in revenue, but OCI's page shows a deadline of 10 August 2026 that has passed while the stream still appears open. Confirm directly with OCI before applying.
Details on all programmes are on our Ontario AI grants page.
Next step
If you run a clinic in Burlington, Oakville, Milton, Hamilton, St. Catharines or anywhere else across Halton, Niagara or the GTA and you want an AI receptionist built to stay on the right side of the line, I can help.
Contact me at info@easeaiworks.com or visit the contact page to discuss your setup.