What does Quebec's Law 25 require of a clinic's AI receptionist?
Quebec has the one Canadian privacy law with real rules on automated decisions. A clinic can run an AI receptionist under it, provided the build treats disclosure and explanation as features, not paperwork.
Answered in short
5 things that decide this
- 01Quebec's Law 25 lets a clinic run an AI receptionist. The duties come from the Act respecting the protection of personal information in the private sector, which Law 25 amended. They attach to every scrap of personal data the system touches.
- 02Section 12.1, in force since 22 September 2023, covers decisions based exclusively on automated processing. The clinic must tell the patient no later than when it shares the decision itself.
- 03On request, the patient can learn what details were used and the reasons and main factors behind the decision. They can also have those details corrected. The receptionist has to be built so staff can actually produce that answer.
- 04Health details count as sensitive under Quebec law, so consent and collection rules bite harder on a clinic call than on most business calls.
- 05Penal fines under Law 25 reach 25 million Canadian dollars or 4 percent of worldwide turnover, whichever is greater. That ceiling is why a Quebec build gets designed, not switched on.
Where section 12.1 reaches a receptionist
Section 12.1 applies when a decision about a person rests entirely on automated processing of their personal information. Booking an appointment, taking a message or answering an insurance question doesn't decide anything about the patient. So most of what your receptionist does sits outside the section. Automated triage that turns a caller away, or picks who gets the urgent slot, sits squarely inside it.
Genuine human review takes a decision outside the section, and the word genuine is doing the work. A staff member who rubber-stamps the machine's output hasn't reviewed anything, and a regulator will ask what the reviewer could see and change. A clean clinic design lets the AI carry the volume and routes every outcome that touches care to a person.
The duties a clinic actually has
Four things cover most of a clinic's risk. A privacy policy and call notice that name the automated processing. A disclosure to the patient whenever a fully automated decision is made about them, given no later than the decision itself. A way for staff to pull the details and main factors behind any decision when a patient asks. And a correction path when the information behind it is wrong.
The explanation duty is the one that shapes the build. If your system can't say which details drove an outcome, your clinic can't answer a patient's lawful request. We build that as a factors log written at decision time, the same pattern we use in our US healthcare builds. Quebec's French-language rules sit outside Law 25 but shape the same build. A receptionist for a Quebec clinic answers in French as well as English.
- Call answeredNames the clinic and the AI, French or English.
- Notice givenRecording and data use disclosed.
- Routine handledBooking and messages. No decision made.
- Triage outcomeA person reviews before anyone is refused.
- Factors loggedReady answers for a section 12.1 request.
The log written at decision time is what turns a patient's rights request from a crisis into a lookup.
Related questions
01Does booking an appointment trigger section 12.1?+
Generally no. A booking records a choice the patient made; it doesn't decide anything about them on its own. The section reaches outcomes like automated refusals, or a machine picking who goes first. Where your flow blurs the two, have counsel classify it.
02Do we need a privacy impact assessment first?+
Law 25 requires a privacy impact assessment for projects that acquire, develop or overhaul systems handling personal information. An AI receptionist is exactly that kind of project. Run the assessment before the build, not after, and keep it with your project records.
03How is this different from HIPAA?+
Different country, different logic. HIPAA is a US rule about protecting health data held by covered entities. Law 25 runs on consent and transparency, with patient rights around automated decisions that HIPAA doesn't have. A vendor's HIPAA compliance claim answers none of your Quebec questions.
Related
- Software for medical clinics →Our clinic hub: what practices actually build.
- HIPAA-compliant AI receptionist →The US version of the same question.
- Medical answering service vs AI receptionist →How clinics staff the phones, compared.
- Voice AI agent development →Our service page: receptionists built with the notice, the routing and the factors log.
