Choose the vendor that shows you evidence, not the one with a "PHIPA compliant" badge. PHIPA has no certification, so no AI receptionist can be certified. Ask for a signed agreement that makes the vendor your agent, a written list of where patient information is stored and where it is processed live, a breach deadline in hours, proof of insurance, an access log you can export, and a test period with made-up patients before any real caller reaches it.
Why "PHIPA compliant" on a website tells you very little
Search for an AI receptionist in Ontario and you'll find many vendors that describe themselves as "fully PHIPA compliant." The phrase isn't checked by anyone. PHIPA puts the duty on your clinic, the health information custodian, and lets you use an agent only if that agent handles patient information on your behalf and within the limits you set. Whether a vendor meets that bar is something you decide by reading what it commits to in writing.
The regulator's expectations are also rising. In January 2026, Ontario's Information and Privacy Commissioner published AI Scribes: Key Considerations for the Health Sector. It is written about AI scribes, not reception, but its direction applies to any AI that touches patient information: complete a privacy impact assessment before you introduce the system, keep collection to what is necessary, and hold vendors to clear obligations.
A useful test: if a vendor can't hand you a document that names every provider that touches a call, where each one is, and how long each keeps data, you can't complete your own privacy impact assessment. That alone should end the conversation.
The 12 questions
| Ask | A good answer | A red flag |
|---|---|---|
| 1. Will you sign as our agent under PHIPA? | Yes, in a services agreement with a PHIPA schedule describing the service and its controls | "Our terms of service cover it" or a US HIPAA BAA only |
| 2. Where is patient information stored? | A named Canadian region, plus a written list of any exceptions | "Canadian servers" with no exceptions listed at all |
| 3. Where is it processed live? | A plain answer about speech recognition and AI models, including any processing outside Canada | "Your data never leaves Canada" for a voice product |
| 4. How long is each record kept? | A table: call audio, transcripts, messages, identity details, logs, each with a number of days | "As long as needed" |
| 5. Does anyone train AI on our patients' data? | No, in the contract and in each provider's agreement, with any exception disclosed | A website promise with nothing behind it |
| 6. Which providers handle patient information? | A register by role, location and retention, with each agreement attached, and notice before changes | "We use trusted partners" |
| 7. How fast will you tell us about a breach? | A deadline in hours, to a named contact, by phone and email | "Promptly" or "as required by law" |
| 8. Do you carry privacy and cyber insurance? | Yes, with stated limits, and a certificate you can see before go-live | No insurance, or "we're covered" without a certificate |
| 9. Who at your company can see our patients' information? | Nobody by default; any emergency access is time-limited, reasoned and shows in your access log | "Our support team can look anything up" |
| 10. Can we see who opened what? | An access log of every view and change, kept for a stated period, exportable | No audit log for the clinic |
| 11. Can we test before real patients? | A separate test environment with made-up patients, and go-live only after your written approval | "Just forward your line and see" |
| 12. What happens when we leave? | Export on request, deletion within a stated number of days, written confirmation | Nothing in writing |
The two questions clinics forget
Insurance. A small vendor with no insurance can promise anything, but if a breach happens it may not be able to pay for its share of the response. Ask for technology errors and omissions cover that includes privacy and network security liability, plus cyber cover, and ask to see the certificate. We cover this in detail in should an AI receptionist company carry privacy and cyber insurance?
Transparency about live processing. Storage is the easy part. A voice agent also has to hear the caller, turn speech into text, decide what to say and speak it back, and those steps often run with providers outside Canada. That isn't automatically a problem, but it has to be disclosed so your privacy statement and assessment are accurate. See "stored in Canada" vs "processed in Canada".
How ZeroMiss answers these questions
We built our answers into the paperwork rather than the marketing. Every Ontario clinic gets a PHIPA Compliance Package that is signed as a schedule to our services agreement. In it:
- ZeroMiss acts as the clinic's agent and uses patient information only to provide the service: no marketing, no sale, no AI training.
- Stored information is kept in Canada (Montréal), with the two exceptions spelled out. Live processing outside Canada is described, provider by provider.
- No call audio is stored. Transcripts, messages and requests are deleted after 30 days; secure-form details within 24 hours.
- Every provider is listed by role, location and retention, with its data processing agreement attached. We give 30 days' notice before adding or replacing one, and the clinic can object.
- We notify the clinic's named privacy contact at the first reasonable opportunity and no later than 72 hours after becoming aware of a breach.
- ZeroMiss is insured for the work it does for clinics, including privacy and cyber risks, and gives each clinic its certificate of insurance before go-live.
- Real patients reach the service only after the clinic has tested it with made-up patients and signed its approval.
Frequently Asked Questions
Is any AI receptionist PHIPA certified?
No. PHIPA has no certification scheme, so no vendor can be PHIPA certified. A vendor that says it is certified is either mistaken or marketing. What you can get is evidence: a signed agreement that makes the vendor your agent, a written description of every control, and a list of every provider that touches patient information.
Who is responsible for PHIPA compliance when a clinic uses an AI receptionist?
The clinic stays the health information custodian and stays accountable. The vendor acts as the clinic's agent and must handle patient information only on the clinic's behalf. That's why the clinic should review the vendor's controls itself, ideally with its own lawyer or privacy advisor, before real patients use the service.
Does a clinic need a privacy impact assessment for an AI receptionist?
It's strongly advisable. The IPC's January 2026 guidance on AI scribes tells custodians to complete a privacy impact assessment before introducing any AI system that handles personal information. A good vendor supplies the data flows, controls and provider list you need to complete one.
Is a US HIPAA BAA enough for an Ontario clinic?
No. A Business Associate Agreement is a US HIPAA document. An Ontario clinic needs an agreement written for PHIPA, where the vendor acts as its agent, limits use to providing the service, and commits to safeguards, breach notice and destruction at the end.
Bottom Line
PHIPA compliance isn't a feature you buy; it's a responsibility your clinic keeps. Pick the AI receptionist that makes that responsibility easy to carry: one that signs as your agent, writes down where every piece of information goes and for how long, is insured, tells you about a breach within hours, and lets you test before a single real patient calls.