AI-PIA · Clinical care providers
AI Privacy Impact Assessment for Medical Imaging Clinics
An AI-PIA gives your clinic a documented, defensible answer for what happens the moment a DICOM study leaves your PACS for an AI worklist-prioritization or CAD tool's inference engine. Radiology AI is already inside the reading workflow at many Ontario clinics, with the radiologist still signing every report, but that human step doesn't erase the questions about where studies travel, what a vendor retains, and whether the tool performs consistently across the patients your clinic actually serves. We assess each tool before it touches a live study.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What the assessment traces before AI touches a study
The risk isn't the algorithm's accuracy alone; it's the path a DICOM study takes once it leaves systems your clinic directly controls.
Where the study is sent for inference
Whether the AI vendor processes studies on infrastructure inside Canada or elsewhere, and whether that destination changes your obligations under PHIPA or, for a Quebec office, Law 25's transfer-assessment duty.
What the vendor retains after inference
Whether the study is deleted immediately after the AI tool returns its output, or retained to improve the vendor's model, an answer that differs sharply between vendors offering similar-sounding products.
How the tool reaches into the PACS
Whether the AI integration pulls studies automatically for every patient or only on referral, and whether that reach matches what patients and referring physicians were actually told about the workflow.
Who can see flagged or prioritized results
Worklist-prioritization output changes which studies a radiologist sees first, and access to that output needs the same scrutiny as access to the underlying images.
Regulatory map
The obligations an AI-PIA documents compliance with
For an imaging clinic, AI governance sits directly on top of PHIPA's existing custodian duties rather than replacing them.
PHIPA's purpose-limitation and safeguard duties
Sending a study to an AI vendor for inference is a disclosure like any other under PHIPA, and the assessment checks that the use stays inside the purposes patients understood when the study was taken.
Decision 249's vendor and access lessons
The IPC's prevention expectations following the province's flagship ransomware case apply to any system with standing access to studies, including an AI tool integrated into the reading workflow.
Cross-border transfer duties for a Quebec office
A clinic with a Quebec location must assess a transfer before personal information leaves the province, which captures most AI inference services processing studies outside Canada.
Accreditation Canada's oversight of new clinical technology
O. Reg. 215/23's inspection cycle expects a clinic to demonstrate control over new technology introduced into patient care, which an AI-PIA's documented review satisfies directly.
What goes wrong
AI failures a clinic cannot afford to discover live
These are the scenarios the assessment is designed to rule out before adoption, while the fix is still a contract clause rather than an incident.
Studies used to train a vendor's model without disclosure
An AI vendor's terms may permit retaining and using studies to improve its product, a use most patients and referring physicians never explicitly agreed to when the exam was booked.
A tool that performs unevenly across patient populations
AI models trained on unrepresentative imaging data can perform less reliably for some patient groups, an outcome that needs checking before the tool influences which studies a radiologist prioritizes.
An integration nobody assessed for access reach
An AI tool connected broadly across the PACS can end up pulling studies well beyond its intended scope, mirroring the kind of overbroad access Decision 249 flagged in a different context.
Vendor infrastructure outside Canada with no documented basis
Studies processed on servers outside the country without a documented transfer assessment leave the clinic unable to answer a straightforward regulator question about where patient data actually went.
Our ai-pia for medical imaging clinics
What the AI-PIA delivers to your clinic
Built for three audiences at once: the ownership group deciding, staff using the tool day to day, and a regulator or hospital partner asking questions later.
Tool-by-tool data-handling review
For each AI product, an analysis of what studies it receives, where they're processed, retention, training use and vendor access, resolved into approve, approve-with-conditions or reject.
Bias and performance considerations
A practical look at whether the tool's performance has been validated across the patient populations your clinic serves, with monitoring recommendations where validation data is thin.
Regulatory alignment overview
How the proposed use lines up with PHIPA, the ICHSC licence's facility expectations, and Quebec's Law 25 where applicable, stated plainly without claiming to certify compliance.
Responsible-use guardrails
Concrete conditions for approved tools: what gets disclosed to patients, how flagged results are reviewed, and what triggers a re-assessment if the vendor changes its data practices.
A record built to be shown
The completed assessment is formatted so it can be produced for an Accreditation Canada inspection, a hospital teleradiology review, or a patient's question about how their study was handled.
How the engagement runs
How the assessment runs for an imaging clinic
Step 1
Inventory AI tools in use or under consideration
We identify every worklist-prioritization, CAD or diagnostic-support tool touching the reading workflow, ranked by how much study data each one actually reaches.
Step 2
Assess the priority tools
Vendor terms, data destinations and integration reach are examined for each tool, with direct vendor questions asked where documentation is vague or incomplete.
Step 3
Decide with the ownership group
Findings arrive as recommendations the medical director or partners can act on in one meeting, each with its conditions and the reasoning documented.
Step 4
Set an intake process for the next tool
A lightweight review step catches the next AI feature before it connects to the PACS, so the assessment stays current as vendors add AI to more of the workflow.
What it costs
Pricing an AI-PIA for an imaging clinic
The main cost drivers are how many AI tools are in scope, how deeply each one integrates with the PACS and reading workflow, whether a Quebec office adds the cross-border assessment layer, and whether follow-on policy and training work is bundled in.
Assessing a single worklist-prioritization tool is a compact exercise; reviewing several AI products across a multi-site group with teleradiology connections is a larger one. Tell us which tools are on the table and we will price the assessment against that list.
Medical Imaging Clinics: AI-PIA questions, answered
Yes, in practice if not by a named statutory requirement: PHIPA's purpose-limitation and safeguard duties apply the moment studies start flowing to a new system, so the assessment needs to happen before go-live rather than after. Turning on the tool first and documenting the analysis later leaves the clinic unable to show it verified the vendor's practices before patient studies were exposed to them.
It varies by vendor, and that's precisely what the assessment establishes rather than assumes. Some radiology AI vendors process studies on Canadian infrastructure; others route through US or international data centres, which raises cross-border questions under PHIPA and, for a Quebec office, a mandatory transfer assessment under Law 25. The answer needs to come from the vendor's actual architecture, not its marketing description.
Start by asking the vendor what populations its training data represents and what performance differences it has documented across demographic groups, then treat any gaps honestly rather than assuming even performance. Where validation data is thin for your specific patient population, the assessment can recommend interim monitoring, comparing AI-flagged priorities against radiologist outcomes, rather than either full rejection or unconditional adoption.
No. The radiologist's final sign-off addresses clinical accountability for the diagnosis, but it doesn't answer where the study travelled, what the vendor retained, or whether the tool's prioritization logic performs evenly across patients, questions the assessment is specifically built to document regardless of who ultimately reads the study.
Yes, and that's usually the efficient approach for a clinic running more than one AI product. The assessment can cover a worklist-prioritization tool and a separate CAD tool in one engagement, comparing their data flows and vendor terms side by side, though each tool still gets its own tool-by-tool review and approval decision within that single document.
The assessment still runs the same way, just retrospectively: identify what the tool actually does with studies now, compare that against what patients and staff were told, and close any gaps found. Clinics in this position often discover the assessment surfaces a vendor question, retention or training-data use, nobody had asked before, which is exactly the value of doing it even after adoption.
More for medical imaging clinics
Other services for this niche
About this service
Answers & guides
- When do you need an AI Privacy Impact Assessment (AI-PIA)?
- How do you assess the privacy and security risk of an AI vendor?
- PIA vs TRA: which assessment do you need (or do you need both)?
- Conducting an AI PIA in Healthcare: A Practical Walkthrough
- Can Your Team Put Customer or Patient Data Into Generative AI? Drawing the Line
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.