Last week we looked at what Ontario’s Auditor General found when the province tested the 20 AI scribe systems it had approved for doctors. In two simulated appointments, 12 of the 20 recorded a different drug from the one prescribed, nine invented content such as treatment steps nobody mentioned, and doctors were not required to confirm in the software that they had checked each note (Office of the Auditor General of Ontario [OAGO], 2026, pp. 20–24). Read that investigation here.
Those were tests, not proof of harm. But they raise a fair question for anyone in an exam room: when a machine helps write my medical record, what can I ask, and what are my rights? This guide answers in plain language, place by place. It is general information, not legal or medical advice.
What is happening in the exam room
An AI scribe, also called an ambient or digital scribe, listens to your appointment and drafts a clinical note, summary or letter that can be added to your record (Therapeutic Goods Administration [TGA], 2026). The risk is that a draft can be wrong in ways that read perfectly well, and whatever lands in your record is what the next clinician sees.
Regulators keep returning to one point: the clinician, not the software, is responsible for the note. Ontario’s privacy commissioner says every record an AI scribe creates or changes must be reviewed for accuracy before it is used or shared (Information and Privacy Commissioner of Ontario [IPC], 2026, p. 24). Australia’s regulator tells health professionals they must get informed consent and verify what goes into your record (TGA, 2026).
Your rights, depending on where you live
Rights differ by place. Everything below comes from official sources we opened.
- Ontario, Canada. The IPC says that under PHIPA, Ontario’s health privacy law, consent would generally be required. You must get a chance to say no before a scribe is used, and if you refuse or later withdraw, you should receive the same or similar level of care (IPC, 2026, pp. 24–25). You can ask to see and correct your record; the provider has 30 to 60 days to respond (IPC, n.d.-a). If a recording or transcript is kept, those rights cover it too (IPC, 2026, p. 27).
- Australia. The TGA says your health professional must tell you before using a digital scribe, and that you can withdraw consent at any time and ask for another way of recording your visit (TGA, 2026). Under the Privacy Act (Australian Privacy Principles 12 and 13) you can request access and corrections. If a correction is refused, the provider must explain why in writing, and you can ask for a statement of your disagreement to be attached (Office of the Australian Information Commissioner [OAIC], n.d.-a, n.d.-b, n.d.-c). Public hospitals fall under state or territory law.
- United States. HIPAA gives you the right to see and get copies of your health information, normally within 30 days (U.S. Department of Health and Human Services [HHS], n.d.-a; Access of individuals, 2026). You can ask for a correction; the provider must act within 60 days, and if it refuses, you can submit a written statement of disagreement (Amendment of protected health information, 2026). We found no single national rule on asking before an AI scribe records you, so ask your clinic.
- United Kingdom. You can make a subject access request for copies of your information, usually answered within one month, and ask for inaccurate data to be corrected (Information Commissioner’s Office [ICO], n.d.-a, n.d.-b). The ICO notes that a record may properly keep a diagnosis later found wrong, alongside the correction (ICO, n.d.-b). The UK medicines regulator said in July 2026 that whether a scribe is a regulated medical device depends on its intended purpose (Medicines and Healthcare products Regulatory Agency [MHRA], 2026).
- European Union. The GDPR gives you a right of access (Article 15) and a right to have inaccurate data corrected and incomplete data completed (Article 16), normally answered within one month (Regulation (EU) 2016/679, 2016, Article 12).
Key idea: Knowledgeable consent
Saying yes only means something if you know what you are agreeing to. Ontario’s privacy commissioner calls this knowledgeable consent: it should be reasonable to believe you know a scribe is being used, why, and that you can refuse. You should also hear about risks, including reliability and bias, not only benefits (IPC, 2026, pp. 24–25). “Is it OK if the app listens?” is a good start, not the whole conversation.
Five questions you can ask
- “Is an AI scribe being used today, and which one?”
- “Can I say no, and how will you document my visit if I do?” A good answer describes a real alternative.
- “Do you read and correct the note before it is saved?” It is fair to ask whether the system records that someone checked it.
- “Is the recording or transcript kept, by whom, for how long, and where?” Ontario’s IPC expects providers to be able to say whether recordings are kept and whether information is processed outside Canada (IPC, 2026, pp. 27–28).
- “Which parts of my record did the scribe write, and how do I fix a mistake?” The IPC calls labelling AI-generated records a best practice (IPC, 2026, p. 27). Check medications, doses and diagnoses first.
If something goes wrong
Start with the clinic: ask for a copy, point out the error and request a correction in writing. Then:
- Ontario: the IPC takes access and correction complaints after a formal written request is refused (IPC, n.d.-a), and privacy complaints within 12 months of becoming aware of the problem (IPC, n.d.-b). Concerns about a doctor’s care go to the College of Physicians and Surgeons of Ontario.
- Australia: if the provider does not respond within 30 days or you are unhappy, complain in writing to the OAIC (OAIC, 2026). The TGA says concerns about how a scribe is used can also go to Ahpra, the health practitioner regulator (TGA, 2026).
- United States: anyone can file a HIPAA complaint with the HHS Office for Civil Rights, normally within 180 days; retaliation is prohibited (HHS, 2026, n.d.-b).
- United Kingdom: complain to the organisation, then to the ICO (ICO, n.d.-b).
- European Union: you can complain to a data protection authority, in particular where you live or work (Regulation (EU) 2016/679, 2016, Article 77).
For organizations: go further. Clinics and buyers should be able to answer the five questions above with a record, not a reassurance. Our free book Operational AI Readiness covers this in Chapter 5, Human Oversight That Actually Works, and Appendix D, a vendor due-diligence question bank on retention, data location and test results. Read it free, or check one workflow with the free readiness assessment.
What the record does not show
We have found no public evidence that a patient was harmed by the errors in Ontario’s simulated tests. Nor do we know how often scribe errors reach real records, partly because Ontario doctors are not required to record in the software that they checked each note (OAGO, 2026, p. 24). Much of what we cite is guidance on how existing law applies, and it can change. In Canada we verified Ontario only, and we could not verify rules on consent to recording in the US, UK or EU, or medical-regulator complaint routes outside Ontario and Australia, so we left them out rather than guess. If a deadline is at stake, check the official page where you live.
Follow what happens next. We will keep watching whether Ontario requires clinician sign-off. The free Mercury Brief brings findings like this to your inbox, with the record behind them. Get the free Mercury Brief.
FairByDesign is reader-funded. If this helped, get the free Mercury Brief or see ways to support. Support never buys editorial control.
References
Access of individuals to protected health information, 45 C.F.R. § 164.524 (2026). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524
Amendment of protected health information, 45 C.F.R. § 164.526 (2026). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.526
Bakos, V. (2026). Operational AI readiness: A practitioner guide to governing AI that is already live. FairByDesign. https://fairbydesign.org/operational-ai-readiness/
College of Physicians and Surgeons of Ontario. (n.d.). Complaints and concerns. https://www.cpso.on.ca/en/public/services/complaints
Information and Privacy Commissioner of Ontario. (2026, January). AI scribes: Key considerations for the health sector. https://www.ipc.on.ca/en/media/6177/download
Information and Privacy Commissioner of Ontario. (n.d.-a). Accessing or correcting your personal health information. https://www.ipc.on.ca/en/health-individuals/accessing-or-correcting-your-personal-health-information
Information and Privacy Commissioner of Ontario. (n.d.-b). File a health privacy complaint. https://www.ipc.on.ca/en/health-individuals/file-a-health-privacy-complaint
Information Commissioner’s Office. (n.d.-a). Getting copies of your information (SAR). https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/
Information Commissioner’s Office. (n.d.-b). Your right to get your data corrected. https://ico.org.uk/for-the-public/your-right-to-get-your-data-corrected/
Medicines and Healthcare products Regulatory Agency. (2026, July 29). Ambient voice technology-enabled products. GOV.UK. https://www.gov.uk/government/publications/ambient-voice-technology-enabled-products/ambient-voice-technology-enabled-products
Office of the Auditor General of Ontario. (2026). Use of artificial intelligence in the Ontario government [Special report]. https://www.auditor.on.ca/en/content/specialreports/specialreports/en26/2026_AI_EN.pdf
Office of the Australian Information Commissioner. (2026, March 2). Before you lodge a privacy complaint with us. https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us
Office of the Australian Information Commissioner. (n.d.-a). Access your health information. https://www.oaic.gov.au/privacy/your-privacy-rights/health-information/access-your-health-information
Office of the Australian Information Commissioner. (n.d.-b). Correct your health information. https://www.oaic.gov.au/privacy/your-privacy-rights/health-information/correct-your-health-information
Office of the Australian Information Commissioner. (n.d.-c). Read the Australian Privacy Principles. https://www.oaic.gov.au/privacy/australian-privacy-principles/read-the-australian-privacy-principles
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation). (2016). Official Journal of the European Union, L 119, 1–88. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679
Therapeutic Goods Administration. (2026, January 30). Digital scribes. Australian Government. https://www.tga.gov.au/products/medical-devices/software-and-artificial-intelligence-ai/overview/types-software-based-medical-devices/digital-scribes
U.S. Department of Health and Human Services. (n.d.-a). Get it. Check it. Use it. https://www.hhs.gov/hipaa/for-individuals/right-to-access/index.html
U.S. Department of Health and Human Services. (2026, February 13). Filing a health information privacy complaint. https://www.hhs.gov/hipaa/filing-a-complaint/index.html
U.S. Department of Health and Human Services. (n.d.-b). How to file a health information privacy or security complaint. https://www.hhs.gov/hipaa/filing-a-complaint/complaint-process/index.html
Leave a Reply
You must be logged in to post a comment.