A services agreement with a PHIPA schedule, signed together. The schedule describes what the AI receptionist does with patient information and the controls behind it. The agreement makes those commitments enforceable: the vendor acts as your agent, uses information only for the service, lists every provider, tells you about a breach within a set number of hours, carries insurance, accepts a higher liability cap for privacy breaches, and deletes everything when you leave.
Why click-through terms aren't enough
Most AI receptionist products start with online terms of service written for every kind of business: restaurants, trades, real estate. They rarely mention PHIPA, cap liability at a month or two of fees, and let the vendor change providers or terms whenever it likes. For a clinic that is the custodian of patients' health information, that leaves most of the risk with you.
The clauses to look for
| Clause | What good looks like |
|---|---|
| Roles | The clinic is the custodian; the vendor is its agent under PHIPA s.17 and follows the electronic service provider rules in O. Reg. 329/04 s.6 where they apply |
| Permitted use | Only to provide the service, on the clinic's instructions. No marketing, sale, analytics for others or AI training |
| Authorization | The clinic authorizes the vendor and its listed providers to handle information only as described in the schedule |
| Providers | Each listed with role, location, retention and its agreement attached; 30 days' notice of a change; a right to object and leave without penalty |
| Breach | A deadline in hours to a named privacy contact, by phone and email, counted from when the vendor learns of it, including from a provider |
| Retention and holds | A period for each kind of record, plus the ability to pause deletion when a patient makes an access request or there's a complaint |
| Liability | A higher cap for privacy and confidentiality breaches than for ordinary claims; mutual, narrow indemnities |
| Insurance | Technology E&O including privacy and network security liability, plus cyber, with a certificate for the clinic |
| Go-live | Testing with made-up patients first; real patients only after the clinic's written approval |
| Changes | No change that materially reduces privacy protection; 30 days' notice of material changes |
| Ending | Export on request in a common format, deletion within a set period, the clinic's key destroyed, written confirmation |
| Your own review | The clinic decides for itself whether the service meets its obligations, and is free to get its own legal or privacy advice |
That last clause may look like it protects the vendor, and in part it does. It also states the truth: no vendor can make a clinic PHIPA compliant. A vendor that promises it can is promising something the law doesn't allow it to deliver.
What ZeroMiss signs with each clinic
Our agreements and package went through two rounds of review by legal counsel. Each clinic signs two documents together:
- The Services Agreement, governed by Ontario law: agent role, permitted use, a privacy-breach liability cap of the greater of two times 12 months' fees and $1,000,000, mutual indemnities, insurance, month-to-month terms with no minimum and no termination fee.
- Schedule A, the PHIPA Compliance Package, prepared for that clinic: how information flows for its own phone and booking setup, what is kept and for how long, every control with how the clinic can verify it, every provider with its agreement attached, incident and breach commitments, suggested patient notices, the clinic's responsibilities and what happens at the end.
Real patients reach the service only after the clinic has run its own test (a call, a text and a booking on its own phone) and signed the approval.
Frequently Asked Questions
Do I need a BAA with an AI receptionist in Canada?
No. A Business Associate Agreement is a US HIPAA instrument. In Ontario the equivalent is an agreement under which the vendor acts as your agent under PHIPA and commits to the safeguards PHIPA expects. ZeroMiss signs a services agreement with a PHIPA Compliance Package as its schedule.
How fast should a vendor report a privacy breach?
The contract should give a deadline in hours, not "promptly." ZeroMiss notifies your named privacy contact by phone and email at the first reasonable opportunity and no later than 72 hours after becoming aware, including when it learns of an incident from a provider, and delivers a written report within 10 business days.
Should a clinic sign a long-term contract?
It doesn't have to. Look for a test period with made-up patients, then month-to-month terms either side can end on short written notice without a fee. ZeroMiss agreements run month to month with no minimum term.
Can I have my own lawyer review it?
Yes, and you should. Our package asks each clinic to have it reviewed by its own lawyer or privacy advisor before signing, and we've made changes at clinics' request.
Bottom Line
The contract is where a vendor's privacy promises become real. If an AI receptionist company can't give you an agent agreement with a breach deadline, a provider list, insurance and a fair liability cap, its website claims are only marketing.