Is AI SOAP Note Software PHIPA Compliant?

The Ontario Personal Health Information Protection Act (PHIPA) governs how health information custodians — including physiotherapists and clinics — collect, use, and disclose personal health information (PHI). Similar provincial legislation applies across Canada, so the core obligations are broadly consistent whether you practise in Ontario, British Columbia, or Alberta.

Four PHIPA principles matter most when evaluating any AI documentation tool. First, data residency: patient data must remain within Canada. Transferring PHI to servers outside the country — even to the United States — without explicit patient consent and appropriate safeguards is a breach. Second, consent and purpose limitation: data collected to generate a clinical note cannot be repurposed, for example to train a commercial AI model, without patient consent. Third, access controls: custodians must ensure that only authorised individuals can view PHI, with mechanisms to enforce and audit that access. Fourth, retention and deletion: PHI should not be kept longer than clinically or legally required, and custodians must be able to demonstrate a clear deletion policy.

AI note-writing tools sit squarely within these obligations because they process session transcripts or audio — both of which constitute PHI. Choosing a tool that was built for Canadian healthcare from the ground up is the most straightforward way to satisfy your custodian duties.

Praxis was designed specifically for Canadian physiotherapists, so PHIPA compliance is built into the architecture rather than bolted on. These are the specific measures in place:

• Patient data stored on Canadian servers only — no cross-border transfer.
• Session audio is processed to generate the note and is not retained afterwards.
• Notes are never used to train AI models — your patient data stays yours.
• Role-based access controls limit who can view or edit records.
• Audit logs capture every data access event for accountability.
• No PHI appears in system logs — identifiers are stripped before logging.
• Encryption at rest and in transit using TLS 1.2 or higher.

Together, these controls satisfy the data residency, purpose limitation, access control, and retention obligations that PHIPA and the analogous federal PIPEDA framework require. When you use Praxis, you can document with confidence that your compliance posture is intact.

Not every AI documentation product on the market was built with Canadian privacy law in mind. Before adopting any tool, evaluate it against these five criteria:

1. 1Canada data residency — Data must not leave Canadian servers. Ask the vendor explicitly where compute and storage happen — "global infrastructure" almost always means US or EU data centres.
2. 2No training on patient data — Your session audio and transcripts should never be used to improve the vendor's model. Look for a clear contractual commitment, not just a privacy-policy footnote.
3. 3Encryption at rest and in transit — All PHI should be encrypted in the database and over the wire. TLS 1.2 minimum; TLS 1.3 preferred.
4. 4Audit trail and access logs — You need to be able to answer "who accessed this record and when?" if a complaint or breach occurs. Audit logs are non-negotiable under PHIPA.
5. 5Clear data retention and deletion policy — The vendor should document exactly how long data is retained and provide a mechanism for you to request deletion when a patient exercises their rights.