Scribes, drafted patient replies, prior authorization screening, imaging and early-warning models all move patient data between the EHR, vendors' clouds and models. What each use case touches, what HIPAA and Canadian health privacy law require, and how to place each one by residency and sovereignty.
Hospitals, clinics and insurers now run AI on patient data every working day. Software drafts visit notes from a recording of the conversation. Models read mammograms, flag inpatients who may deteriorate, draft replies to messages patients send through their portal and screen requests for prior authorization before a payer approves a treatment. Each of these turns patient information into model inputs and outputs. That data moves between the electronic health record (EHR), vendors' clouds and the models themselves.
Regulators, courts and payers are now asking the same thing: where does that data go, and who can see it? In Canada, the question arrived as provincial guidance on AI scribes, including guidance from Ontario's privacy commissioner in January 2026. In the US, it arrived in court, through proposed class actions reported in California between December 2025 and April 2026 over visits recorded without proper consent, and in Medicare, through a model scheduled to use AI to screen prior authorization requests in six states from January 1, 2026.
Each AI use has to be settled the same way: whether it is worth adopting, where its data may be stored (data residency) and whose laws and which operators can reach it (data sovereignty). A wrong call can mean a consent lawsuit, a breach (healthcare breaches averaged $7.42 million in IBM's 2025 report) or a model you cannot move when a regulator asks. The final section turns all of this into a rule that sorts your own use cases into three placement tiers.
Generative AI use cases in healthcare already in production
In healthcare, generative AI shows up first where clinicians and staff spend time writing.
Ambient clinical documentation
- What it does: an ambient AI scribe records the visit on a phone or computer, transcribes it and drafts a note the clinician edits and signs.
- In production: Kaiser Permanente physicians in Northern California used scribes in more than 2.5 million encounters over 63 weeks, saving the equivalent of 1,794 working days in one year. A UCLA Health randomized trial of 238 physicians, published in November 2025, measured a more modest effect: one tool cut time per note by about 41 seconds against 18 seconds in the control group, and the other tool's change was not significant. Ontario runs a provincial program that gives primary care clinicians approved scribe products at discount pricing.
- Data it touches: audio of the whole conversation, a transcript, a draft note.
- Where the data goes: for a cloud scribe, to the vendor's servers for processing. Kaiser said in June 2026 that recordings are kept no longer than 14 days. A lawsuit against another California health system alleges audio went to the vendor's servers, where its employees could review it. According to the suit, the health system told the patient the file could stay there about a month.
AI agents in healthcare: a tool that joined on its own
Recording tools can also act beyond what anyone intended. In September 2024, a general-purpose transcription bot joined an Ontario hospital's hepatology rounds through the calendar of a physician who had left in 2023. It emailed a summary with a link to the full transcript to 65 people, exposing health information about seven patients. The province's privacy commissioner recommended immediate access revocation for departing staff and meeting lobbies that keep unauthorized AI agents out.
Drafted replies to patient messages
- What it does: a language model drafts a reply to a patient's portal message; the physician edits and signs it.
- In production: UC San Diego Health began piloting drafts inside its EHR in April 2023. Its study, published in April 2024, found that AI drafts did not reduce physician response time and produced longer replies, and each reply told the patient it had been generated by AI.
- Data it touches: the patient's message and whatever chart information the EHR passes to the model.
- Where the data goes: to whichever model service the EHR calls, under the EHR vendor's and the model provider's terms.
Imaging, early warning and prior authorization
Not every healthcare AI is generative. These three predict, detect or screen, and they touch different data.
Medical imaging and diagnostics
- What it does: flags findings on images for a radiologist or acts as one of the readers.
- In use: the FDA authorized 1,430 AI and machine-learning devices between September 1995 and December 2025, and devices reviewed by its radiology panel made up 1,094 of them, or 76.5%.
- In trial: in February 2025, the UK announced EDITH, a trial with nearly 700,000 women at 30 screening sites and £11 million in government funding, testing whether AI lets one specialist do the work that two do on each mammogram today.
- Data it touches: medical images and the reports attached to them.
- Where the data goes: depends on the product: some analyse images inside the hospital, others send them to the vendor's cloud. Ask before the contract, since images are large and hard to move later.
Clinical decision support and early warning
- What it does: scores each inpatient's risk from EHR data and alerts the care team.
- In production: CHARTwatch, developed at Unity Health Toronto, uses more than 100 items from the hospital's electronic medical record. Its evaluation in the CMAJ, published in September 2024, associated it with a 26% reduction in unanticipated deaths on the general internal medicine ward at St. Michael's Hospital. A high-risk alert sends senior staff to assess the patient right away.
- Data it touches: the patient's history and current status as recorded in the EHR.
- Where the data goes: wherever the model is trained and scored. A model built from whole-record extracts creates a training copy of the EHR, which needs the same placement decision as the EHR itself.
AI in prior authorization and claims review
- What it does: software screens requests before a human decides whether a service will be paid for.
- In production: CMS announced the WISeR model on June 27, 2025. From January 1, 2026 to December 31, 2031, it uses AI tools to screen selected Medicare Part B services in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. CMS says no request will be denied without review by a qualified human clinician. The participating technology companies are paid a percentage of the savings their reviews generate, and CMS audits them to guard against excessive denials.
- Data it touches: claims and the clinical records submitted to support them.
- Where the data goes: to the payer and the technology vendors it contracts.
Is AI HIPAA compliant? What US rules say about the data
HIPAA protects identifiable health information "in any form or media, whether electronic, paper, or oral," so a recording, a transcript, a drafted reply and a training extract all count. Compliance comes from the contract, configuration and policies around a product. The rules that shape placement:
- Business associate agreements (BAAs). A vendor that stores or processes patient data for you is a business associate, even if it holds only encrypted data without the key, and the BAA must require it to return or destroy the data at the end of the contract where feasible (HHS cloud guidance).
- No residency rule. HHS allows storage outside the US under a BAA and says the risk varies with location, so location goes into your risk analysis.
- Minimum necessary. Apart from exceptions such as disclosures to providers for treatment, use and disclosure are limited to what the purpose needs, with named roles allowed to see each category of data. Business associates are bound too, which reaches vendor staff who listen to audio or review drafts.
- No retention period. The Privacy Rule sets no medical record retention period; state laws generally do. Safeguards apply as long as you keep the data, through disposal.
- Audit controls. The Security Rule requires mechanisms that record and examine activity in systems holding electronic patient data.
HHS has proposed tightening the Security Rule. Its December 2024 proposal would require encryption at rest and in transit and multi-factor authentication, each with limited exceptions. It would also require an asset inventory and network map, restoration of certain systems within 72 hours, and a written analysis and certification from business associates, at least every 12 months, that their technical safeguards are in place. The final rule is projected for July 2027. State law adds its own layer: the California scribe suits rely on the state's all-party consent rule for recordings and its medical confidentiality law.
Data residency vs data sovereignty in healthcare
Residency is where data is stored, including backups, replicas and logs. Sovereignty is whose laws apply to it and who is able to reach it. In healthcare, the rules split along the same line.
Rules that set residency
- US: HIPAA has no residency requirement (above).
- British Columbia: for public bodies, amendments to the province's public-sector privacy law that received royal assent on November 25, 2021 removed the requirement to keep personal information in Canada. A privacy impact assessment is still required before using a system that stores data outside Canada, with a risk-benefit analysis for sensitive information.
- Quebec: since July 1, 2024, a health body must complete a privacy impact assessment before any mandate or contract that involves communicating health information outside Quebec, and the contract must be in writing with prescribed terms, including audit rights and no retention after the mandate ends.
- Ontario: according to a law firm's summary, the privacy commissioner's AI scribe guidance of January 28, 2026 treats keeping recordings outside the medical record as exceptional and expects vendor contracts with audit rights.
- EU: the European Health Data Space regulation entered into force on March 26, 2025. When its secondary-use rules apply, mostly from 2029, reuse of health data for research and innovation will generally need a permit from a health data access body, with the data processed in secure processing environments.
What sovereignty means for health data
Residency settles where the files sit. For health data, sovereignty comes down to who can reach recordings, messages, images and training extracts, and what happens to them later:
- Who can listen or read: vendor staff who review scribe audio or drafted replies fall under HIPAA's minimum necessary standard, and one California suit alleges vendor employees could review visit audio.
- What happens when the contract ends: a BAA must require return or destruction where feasible, and Quebec's prescribed terms bar retention after the mandate ends, with audit rights to check it.
- Reuse for research and model training: in Ontario, secondary use, vendor training included, would generally need patient consent or de-identification to a very low re-identification risk, and the guidance indicates audio almost never meets that standard. Alberta's commissioner says the province's health information law would likely not permit a vendor to use health information from a custodian to train its models. In the EU, reuse under a health data permit will take place inside secure processing environments.
- Custody: Alberta expects vendor contracts to preserve the custodian's control over health information.
Contracts can settle most of this. They cannot change which country's law the operator itself answers to, and that is why some workloads call for the sovereignty tier.
AI governance in healthcare: three placement tiers
Each use case lands in one of three tiers, based on the data it touches and the rules above.
- Contract tier: a vendor or hyperscaler cloud, governed by a BAA or provincial contract that states retention, bars training on your data, names who can access it and gives you audit rights. This tier is usually the fastest to adopt and carries the vendor's model updates and EHR integrations.
- Residency tier: vendor or hyperscaler services, with storage and processing contractually kept in your country or province, including backups and logs.
- Sovereignty tier: infrastructure in your country, run by you or by an operator under your country's law, with your own keys and administrator accounts. This tier usually costs the most to run: your team or a contracted operator takes on GPU capacity, upgrades, model evaluation and on-call.
The tiers trade speed for control, and most health systems will mix them.
HIPAA and AI in practice: a placement rule for each use case
This is our recommended rule, built on the requirements above; your own privacy and risk assessments make the final call.
- List every AI use and the data it touches: audio, messages, images, claims, whole-record extracts.
- Imaging AI that runs inside your hospital is already in your environment. Keep it there, under the same access controls and logs as your image archive.
- Drafted patient replies and cloud-based imaging: a US system uses the contract tier, with a BAA that states retention, bars training on your data and names who can see the data. A Canadian system uses the residency tier wherever a Quebec privacy impact assessment or a British Columbia risk-benefit analysis does not support storage outside the province or the country.
- Ambient scribes: a US system uses the contract tier, with a BAA that states how long audio is kept and which vendor staff can hear it, and with consent captured in your own system under your state's recording law. A Canadian system uses the residency tier and follows its province's guidance on consent. In both countries, delete audio once the clinician signs the note unless a law or legal hold requires keeping it, and bar vendor training on it. Recordings from sensitive services such as mental health go to the sovereignty tier.
- Prior authorization: payers can use the contract tier, with a qualified clinician reviewing every denial, as CMS requires in its model.
- Sovereignty tier for whole-record training extracts, the early-warning models built on them and any data you plan to reuse for research.
- Review the placement when the HIPAA Security Rule update is finalized (projected for July 2027), when EHDS secondary-use rules apply in 2029, or when a vendor adds diagnosis or ordering features.
Rules 4 and 6 are where the infrastructure becomes yours to choose. For a Canadian health system, sovereignty-tier workloads can run on GPU servers we host in Montreal, where we are based; we are Canadian-owned and have been in business since 2006. For a health system in either country that wants the hardware in its own building, we install the same GPU infrastructure in its data center, with Atmosphere running the OpenStack cloud on top.
Atmosphere includes encryption at rest and in transit, and it integrates Keycloak, which supports multi-factor authentication. Configured across the systems that hold patient data, those cover two of the safeguards HHS proposed in December 2024. For an early-warning model, the record extract, the training jobs and the scoring service can then sit in one facility, with sign-in to the cloud through Keycloak. We supply the infrastructure. The AI applications, their clinical validation and their EHR integrations stay with you and your vendors.
If your list puts any use case in the sovereignty tier, ask our engineers to size the GPUs and storage it needs, in Montreal or on your premises, from its data volumes and retention period.
