Generative AI in Quebec Private Practice: An Ethical and Privacy Checklist

Generative AI can summarize text, rewrite an email or structure an administrative task in seconds. For a private practice, that promise is real—but it does not remove professional judgment, confidentiality duties or the need to protect client information.

Quebec professional guidance is becoming more concrete. The Ordre des psychologues du Québec (OPQ) has published a thematic file on psychology assisted by artificial intelligence. The Ordre des travailleurs sociaux et des thérapeutes conjugaux et familiaux du Québec (OTSTCFQ) published a professional notice on AI use in 2026. Quebec’s Commission d’accès à l’information (CAI) also states that information generated or inferred by AI systems may itself be personal information.

The practical approach is simple: identify low-risk uses, reject unsafe shortcuts and document your decisions.

Bottom line: an AI tool can assist a task. It does not become your clinical colleague, records custodian or privacy officer.

Which uses make sense in private practice?

Start by separating administrative work from clinical work. The closer a task is to assessment, diagnosis, treatment or a person’s identity, the more carefully it must be evaluated.

Generally lower-risk uses

drafting a generic private-practice opening checklist;
rewriting text that contains no client information;
creating an appointment-cancellation policy template;
outlining a website page, FAQ or editorial calendar;
summarizing a public policy, followed by source verification;
turning fictional data into a sample intake form.

Review every output. AI can invent a citation, state a rule that does not exist or reproduce bias—even when the task is administrative.

Uses that should be treated as personal-information processing

pasting session notes or a transcript into a chatbot;
asking AI to infer a diagnosis, risk level or client profile;
using a voice scribe that records a clinical conversation;
automating a decision that affects access to your services;
sending identifiable information to an external vendor for summarization.

The question is not only whether the tool is convenient. Ask what data is collected, where it goes, how long it is retained, who can access it and whether it is used to train a model.

Five risks to assess before enabling an AI feature

1. Inadvertent disclosure

A name is not required to identify someone. A combination of date, occupation, family situation, recent event and location may be enough. Clinical notes often contain highly distinctive details.

The CAI notes that personal information generated by AI systems or inferred from personal information remains subject to applicable laws. “Anonymized” does not automatically mean “risk-free”: test your anonymization method and remove unnecessary details.

2. Retention and reuse

Read the vendor’s policy before using a clinical feature. Look for prompt retention, logs, subprocessors, international transfers, model training, deletion and administrator access.

An option that says “we do not use your data to train the model” does not answer every question. You still need to understand whether information is retained for fraud detection, debugging, security or service improvement.

3. Plausible errors

A polished output can be wrong. It may omit nuance, reverse a timeline or present an assumption as fact. Never let AI independently produce a final clinical note, recommendation, diagnosis or crisis message.

4. Bias and loss of context

Models learn patterns, not therapeutic relationships. They may misread cultural expression, language, disability or family dynamics. Professional responsibility remains yours.

5. Transparency with clients

If AI is involved in a task connected to client information, explain it in plain language: what the tool does, what data is involved, who may access it, what the limits are and what alternative exists if the client declines.

Consent does not automatically make a disproportionate use appropriate. For highly sensitive health information, assess necessity, proportionality and whether a less intrusive option is available.

A pre-use checklist for client data

Use this checklist before each new vendor or AI feature:

Purpose: Can I explain in one sentence why AI is necessary?
Minimization: Have I removed everything that is not essential?
Authority and consent: Am I allowed to collect, use and disclose this information?
Vendor review: Have I checked the terms, retention, subprocessors and transfers?
Security: Are MFA, access controls, encryption and audit logs available?
Human control: Who reviews the output and corrects errors?
Transparency: Does the client understand the use and its limitations?
Alternative: Can I provide the service without AI if the client objects?
Incident response: What happens if data is exposed or the output causes serious harm?
Documentation: Have I recorded the decision in my privacy register or internal policy?

Canadian privacy authorities recommend limiting the disclosure of sensitive information, being transparent and embedding privacy protection by design. These principles are especially useful for a small practice without an in-house legal or IT team.

A simple AI policy for a solo practice

You do not need a 40-page document to begin. A one-page policy can define:

permitted uses (generic administration and content without client data);
prohibited uses (identifiable notes in a consumer tool and automated diagnosis);
approved tools and their privacy settings;
the requirement for human review;
the incident procedure;
a review schedule, such as quarterly.

Keep an inventory of tools as well: vendor, purpose, data categories, hosting location, retention period, access permissions and last review date.

Where FYL.care can help

A well-organized practice reduces the temptation to paste clinical information into improvised tools. FYL.care brings practice-management work—clients, appointments, notes and administration—into a more predictable workflow.

It does not replace your privacy assessment or professional obligations. It can, however, help you keep practice information in a workflow designed for this context instead of scattering fragments across email, spreadsheets and consumer applications.

👉 Explore FYL.care for free and build a clearer administrative workflow before adding AI to your practice.

FAQ

Can I use ChatGPT to rewrite a session note?

Avoid pasting an identifiable note into a consumer AI tool. Even without a name, the content may allow re-identification and the retention policy may not suit your practice. Use fictional examples or a vendor assessed with the checklist above instead.

Clear, documented consent may be required depending on the use, profession and applicable framework, but consent alone is not enough. Also assess necessity, security, retention, transfers and an alternative. Check your professional order’s guidance.

Can AI write my clinical note?

It may assist drafting if the use is authorized, secure and reviewed. The final note must reflect your professional observations, be accurate and relevant, and be owned by you. Never sign an unreviewed output.

Is AI-generated information personal information?

The CAI considers information generated by AI systems or inferred from information to be personal information when it identifies a person directly or indirectly. Treat outputs as potentially sensitive data.

What is the first step I should take today?

Inventory the AI tools already used in your practice, then disable unreviewed sharing of client data. Next, adopt a short internal policy and document your decision.

Primary sources

This article is informational and is not legal, ethical or clinical advice. Requirements may vary by profession, regulatory order and place of practice.