AI scribes for optometrists: what they do and what consent you need

An AI scribe listens to the exam, or to your dictation afterwards, and drafts the chart note for you. You review it, fix it and sign it. Done well, it gives back some of the time spent typing between patients. Done carelessly, it puts findings you never made into a legal record.

This guide is a researched overview for optometrists in Ontario and the US. It isn't legal advice, and it summarises what the official sources say rather than adding requirements of its own. Follow the links and confirm what applies to your practice.

What an AI scribe actually does

Most products work in three steps:

1. Capture. A phone, tablet or computer microphone records the conversation in the exam room, or you dictate a summary after the patient leaves.
2. Transcribe and draft. Speech recognition turns the audio into a transcript, and a language model turns the transcript into a structured note: history, findings, assessment and plan. Some also draft referral letters or patient instructions.
3. Review and sign. The draft goes to you, and you correct it before it becomes part of the record.

Ontario's Information and Privacy Commissioner (IPC) describes them the same way in its January 2026 guidance, AI Scribes: Key Considerations for the Health Sector: transcription tools that can produce summaries of care visits for entry into an EMR.

Where it helps, and where it doesn't

An eye exam is a mix of conversation and measurement. A scribe can capture the history, symptoms, the discussion of options and the plan you explained to the patient. It can't see the slit lamp, the OCT or the phoropter. Unless you say the findings aloud, or they flow into the EMR from the instruments, they won't be in the draft.

The risks are well documented:

• Mishearing. Drug names, eye (right versus left), and numbers such as IOP or axis are easy to get wrong.
• Invented content. Language models can fill gaps with plausible text, such as a normal fundus finding for an exam where the fundus wasn't examined. A note must never record a test you didn't do.
• Omissions. A patient's offhand comment about flashes or a family history of glaucoma may be dropped from the summary.
• Other voices. A parent, interpreter or the conversation in the next room can end up in the note.

The IPC guidance says custodians must have policies so that every record created or altered by an AI scribe is reviewed for accuracy before it is used or disclosed, and as a best practice before it goes into the EMR. It also recommends identifying records generated or altered by an AI scribe as such. Treat the draft as a first draft from a new assistant: read every line before signing.

Ontario: what the official sources say

The IPC guidance. It's the most detailed official source for Ontario. Among its points:

• Consent. The IPC says there is currently no provision in PHIPA that explicitly permits collecting, using or disclosing personal health information through an AI scribe without consent, so consent "would generally be required". It calls obtaining express consent before using the scribe, and recording it in the patient's chart, a best practice. Consent must be knowledgeable: the patient should know you're using an AI scribe, why, and that they may say no.
• Saying no. Patients who withhold or withdraw consent must get the same or similar level of care, so you need a way to document without the scribe.
• Recordings and transcripts. Decide whether to keep them. The IPC notes that keeping them may help with access requests and disputes, but that data minimization may favour keeping only the reviewed note. If you keep them, patients have a right of access and correction to them, and you need a set retention period. If you don't, they must be securely destroyed.
• Vendor agreements. Have a written agreement that limits the vendor to what you authorize, requires safeguards and secure disposal, covers subcontractors, and requires the vendor to help with breach investigations. Don't let the vendor use recordings or transcripts to train its model unless you have authority under PHIPA, such as patient consent or properly de-identified data.
• Transparency. You should be able to tell patients whether any information is processed or stored outside Canada, whether recordings are kept, and the scribe's limitations.
• Free trials. PHIPA applies during a free trial just as it does to a paid licence.

The IPC also publishes a shorter checklist version, and its privacy management handbook for small health care organizations covers the basics a solo clinic needs anyway.

The provincial AI scribe program. The Ontario Ministry of Health and Ontario Health, with Supply Ontario and OntarioMD, run the Ontario AI Scribe Program, a vendor-of-record list of AI scribes vetted against provincial clinical, privacy and security requirements. The vendor of record arrangement requires patient information to be stored and processed in Canada unless users are notified and the alternative meets equal or higher security standards. The program is described as serving primary care clinicians, so if you are an optometrist in private practice, ask OntarioMD whether you can buy through it. Even when you buy from a vetted list, the IPC says each custodian must still do its own due diligence.

The College of Optometrists of Ontario. When this guide was written, the College's published standards didn't address AI scribes or AI documentation specifically. Check the College's site, or ask its practice advisors, for anything issued since. The general record standards still apply to any note a scribe drafts. The Optometric Practice Reference (section C.1) requires the patient health record to be legible and complete, and section C.1.4 requires encryption where identifiable information is stored on mobile devices or offsite, which can include a phone used to record the exam.

United States: HIPAA and BAAs

A vendor that receives recordings, transcripts or notes about your patients is a business associate, so HIPAA requires a written business associate agreement before it handles that information. HHS publishes sample BAA provisions, and the required terms are in 45 CFR 164.504(e). HHS's cloud computing guidance confirms that a cloud provider storing health information is a business associate even if it says it can't view the data.

If you keep recordings or transcripts, think about whether they become part of what a patient can request under HHS's right of access guidance. Some states also require every party's consent to record a conversation, so check your state's recording law before turning on ambient listening.

Questions to ask an AI scribe vendor

Get the answers in writing, and ideally in the contract:

• Where is audio processed and stored? Which country, which cloud provider, and which subcontractors, including the speech and language model providers?
• Is audio kept? For how long, can I set it to delete once the note is signed, and how is deletion confirmed?
• Are transcripts kept, and can I retrieve one if a patient asks for it?
• Do you use my patients' data to train or improve your models? Can I opt out, and is that in the contract?
• Will you sign a BAA (US) or an agreement that meets PHIPA and the IPC's guidance (Ontario)?
• How does the draft mark what the AI wrote, and can it reach the chart before I approve it?
• How does it handle eye care terms: OD and OS, drug names, IOP, cup-to-disc ratio, lens powers?
• What accuracy testing have you done, in what languages, and will you tell me if accuracy drops?
• What happens to my data if I cancel, including during a free trial?
• Who at your company can access recordings, and is that access logged?
• How will you notify me of a breach, and how quickly?
• Does it work in my EMR, or will I copy and paste?

Before the first patient

Write a short consent script, post a notice in the waiting room describing the scribe, record each patient's answer in the chart, and keep a documentation routine for patients who say no. Then sign nothing you haven't read.