Privacy and Confidentiality at Health Services
Carleton University Health and Counselling Services collects, uses and discloses personal health information to serve our clients and to provide health care. All Carleton University Health and Counselling employees, contract staff, consultants, student peer mentors and volunteers are required to abide by the privacy laws, including the Freedom of Information and Protection of Privacy Act (FIPPA) and the Personal Health Information Protection Act (PHIPA).
Health Services currently uses an electronic record-keeping system called Telus Collaborative Health Record (CHR). Access to medical records in Telus CHR is restricted to Health and Counselling Services employees, and information is protected through the use of technical and administrative safeguards such as restricted access permissions, multi-factor authentication and use of other industry-standard security controls.
Limits of Confidentiality
Under exceptional circumstances, Carleton University Health and Counselling Services, through personnel authorized to make such decisions, may disclose personal health information of a client if necessary to comply with legal and/or professional obligations with or without their consent if:
- There are reasonable grounds to believe that a client is at significant risk of serious harm to themselves or another person.
- There are reasonable grounds to believe that a child is at risk of being abused or neglected.
- The client’s personal health information has been subpoenaed by a court of law.
- The client disclosed that they have been sexually abused by a regulated health professional.
- As per the College of Physicians and Surgeons of Ontario’s policy on mandatory and permissive reporting.
AI Medical Scribe
What is an AI Medical Scribe?
AI medical scribes are digital tools that help healthcare providers document your appointment in real time. Instead of typing during your visit, the AI listens, transcribes, summarizes and generates a clinical note. Carleton Health Services has approved Tali AI, Scribeberry, and Heidi AI for documentation support only. These tools do not make clinical decisions or diagnoses. While concerns about misinterpretation, “hallucinations,” and racial bias in AI models exist, your provider will always review, edit and approve the note before it becomes part of your medical chart.
Privacy and Data Security
All platforms used at Health Services comply with Canadian and Ontario privacy laws, including the Personal Health Information Protection Act (PHIPA) and the Personal Information Protection and Electronic Documents Act (PIPEDA). Each tool has been reviewed and approved by Carleton University’s privacy and legal teams.
Health Services recognizes PIPEDA does not yet have specific guidance on AI scribes or de-identified health data. We will monitor legal developments and adjust our use of AI scribes accordingly. Note: Health Services will not notify patients of data breaches at AI scribe companies. You may ask your provider which AI scribe is used and contact the company directly if concerned.
Data Storage and Handling
- Platforms minimize long-term storage of identifiable data.
- Audio recordings of patient voices are retained temporarily for transcription and quality assurance. Audio recordings of a provider’s voice alone may be stored. Transcripts are typically made of the audio recordings. Most platforms do not retain transcripts long-term.
- De-identified audio or transcripts may be used to train the AI scribe to improve quality.
- We are monitoring ongoing research and legal developments on the potential re-identification of de-identified health data.
- All three platforms use end-to-end encryption, access controls and secure cloud infrastructure (e.g., Microsoft Azure or equivalent) to safeguard your information.
- Any retained data is stored in Canada or in compliance with Canadian laws.
- Ask your provider which AI scribe is being used for more information.
Your Rights and Choices
- You may decline or withdraw consent at any time, without compromising access to care.
- Consent may vary by visit or encounter; just inform your provider.
- If you do not consent to the use of an AI scribe, traditional documentation will be used.
- You may request further information at any time regarding how your data is handled.
Disclaimer: This form is based on Carleton Health & Counselling Services’ understanding of available documentation and privacy policies provided by Tali AI, Scribeberry and Heidi AI as of 2025. The privacy practices, data handling procedures and platform functionalities of these services may change over time.
Privacy and Confidentiality at Counselling Services
Privacy and Confidentiality
Counselling records are confidential and are not included in academic records.
Counselling Services collects information for the purpose of providing counselling services to our students. Counselling Services follows legislated privacy obligations in accordance with the Personal Health Information Protection Act (PHIPA) and when applicable, the Freedom of Information and Protection of Privacy Act (FIPPA), such as when assisting in an accommodation process.
Our professional staff (regulated health professionals, office assistants and management) are committed to collecting, using and disclosing personal health information responsibly and only to the extent necessary for the services we provide.
Counselling Services currently uses an electronic record-keeping system called Collaborative Health Record (CHR). Access to counselling records in CHR is restricted to Counselling Services employees and information is protected through the use of technical and administrative safeguards such as restricted access permissions, multi-factor authentication and use of other industry standard security controls.
Limits of Confidentiality
Counselling Services does not release any information without your written permission. However, there are some exceptional situations where Counselling Services is required to disclose your information without your consent. These exceptions include:
- If you intend to harm yourself.
- If you intend to harm another person.
- If you or your counsellor has a strong reason to think that a Carleton University community member may be at risk of harm based on information that you provided in your session.
- If there is a reasonable suspicion that a child (any individual up to their 18th birthday) is at risk of emotional and/or physical neglect or emotional, physical and/or sexual abuse. We are required by law to report this immediately.
- If an elderly person in a long-term care home or retirement home is at risk of emotional or any form of maltreatment.
- If your counselling record is subpoenaed by law.
- If you have a complaint about a regulated health professional (e.g. doctor, nurse, psychologist, chiropractor, massage therapist, etc.) with respect to their inappropriate sexual behaviour towards you, and you provide us with that individual’s name, we are required to report this complaint to their regulatory body.