A new patient arrives with a thick file. There’s an MRI report from last spring, a CT summary from an emergency visit, discharge notes from the hospital, a family physician’s referral, an assessment from a previous clinic, and six months of progress reports from another provider.
Before you can decide where treatment should go, you need to understand what all of that actually says. And if the patient’s insurer asks why you’re proposing a particular plan, you’ll need to explain it clearly, with the evidence to back it up.
This is the part of clinical work that rarely gets discussed when people talk about AI in the health care system. It isn’t charting, and it isn’t documenting the visit. It’s reviewing the accumulated evidence, making sense of it, and turning it into a defensible treatment direction.
It’s also exactly the kind of work where artificial intelligence can help, and where you have to be most careful about where patient information goes.
Scribes Solved One Problem. This Is a Different One.
Most of the Canadian AI products marketed to healthcare providers today are AI scribes. They listen to an encounter and produce a clinical note. Many are built primarily around physicians and family medicine workflows: EMR integration, billing codes, referral letters, and prescribing.
That’s useful, but it isn’t what this article is about.
When a paramedical provider reviews a case file, the job looks more like this:
- Gather the documents the patient provides or that you’ve requested, such as imaging reports (X-ray, MRI, CT, ultrasound), specialist consultations, hospital and emergency records, prior assessments, progress and discharge reports, and questionnaires or outcome measures.
- Review and summarize them into a clear chronology: what happened, when, what was found, and what’s already been tried.
- Analyze them: which findings agree, which conflict, what’s missing, and what red flags need to be referred out.
- Decide on a treatment direction, within your scope of practice.
- Justify that direction, often in a report or treatment plan submitted to an auto insurer, workers’ compensation board, extended health carrier, or referring provider.
Some scribe products have started adding features in this direction, such as summarizing previous notes or drafting letters. But scribes are designed around the encounter: their main input is the conversation in the room, not a stack of outside records from other providers. For evidence review, what you need is a capable, conversational AI that can read those documents, answer follow-up questions, and help you draft a clear summary or rationale, without putting your patients’ personal health information somewhere it shouldn’t be.
What the AI Should Be Able to Do
Before looking at options, it helps to be specific. For evidence review work, a useful generative AI tool should be able to:
- read long, messy documents, including scanned PDFs, and keep track of dates and sources;
- build a timeline of injuries, investigations, treatments, and outcomes;
- identify recurring, conflicting, or missing findings across documents;
- distinguish between sources with different evidentiary weight (a radiologist’s report versus a patient-reported history, for example);
- answer follow-up questions and handle challenges to its own summary;
- help find and cite relevant research you can verify;
- draft a structured summary, treatment rationale, or insurer report based on your instructions;
- acknowledge uncertainty rather than inventing confident conclusions.
A note on imaging: most general AI tools can “look at” an image you upload, but they are not diagnostic imaging tools. For evidence review, work from the radiologist’s written report, and treat any AI commentary on the images themselves as unreliable. Interpreting diagnostic images may also fall outside your scope of practice.
Five Questions to Ask Before Uploading a Patient’s File
You don’t need a 30-point vendor checklist. Start with these five.
1. Where does the information actually go?
Ask where it’s stored, processed, backed up, and sent for AI inference, and which subprocessors touch it. A service can store your files in Canada while still sending the content to a model hosted in another country. Data residency is about the whole path, not just the server where files are stored.
2. Is it used to train or improve AI models?
Patient information shared for a clinical purpose shouldn’t end up training a commercial model. Once data influences a model, it’s very hard to take back. Look for an explicit statement that customer content is not used for training or fine-tuning.
3. How long is it kept?
Chat history, uploaded documents, generated reports, logs, backups. Can you delete them? Can your clinic set the retention period? Indefinite retention introduces significant patient privacy risks compared to controlled retention.
4. What does the vendor say about Canadian privacy law?
Our focus here is Canadian health privacy law under PIPEDA alongside the privacy claims each vendor makes publicly. Depending on your province and practice type, provincial health information privacy regulations may also apply, such as Ontario’s PHIPA, Alberta’s HIA, or Quebec’s Law 25, which requires a privacy impact assessment before personal information is transferred outside Quebec. Your regulatory college may also have its own guidance on AI and record-keeping.
We don’t certify any product’s compliance. We report what vendors publish and encourage you to confirm it in writing.
5. Is it actually good at this kind of work?
Strong data security and privacy don’t guarantee useful output. Test the tool with a realistic, de-identified case file before relying on it. Can it keep track of a dozen documents? Does it cite sources you can check? Does it flag what it doesn’t know?
Option 1: Mainstream AI (ChatGPT, Claude, Gemini, Copilot)
It’s easy to see why providers start here; these popular AI chatbots — ChatGPT, Claude, Gemini, and Microsoft Copilot — are familiar, conversational, and very good at exactly the tasks described above: reading long documents, building timelines, comparing findings, and drafting clear reports. There’s almost no learning curve.
The problem isn’t capability. It’s what goes into the prompt.
Compare these two requests:
The first request raises no privacy concerns. The second contains personal health information (PHI), and with consumer versions of these tools, you generally have limited control over where that data is processed, how long it’s kept, and, depending on your settings, whether it’s used to improve the service.
Business and enterprise tiers typically offer stronger protections, such as no training on your data by default, admin controls, and contractual commitments. If you’re considering one, check specifically whether Canadian data residency is available, where inference happens, and what the data processing agreement actually says.
Where mainstream AI fits well:
- summarizing published research and clinical guidelines;
- explaining conditions or findings in general terms;
- drafting report templates, patient education, and clinic policies;
- working through a properly de-identified case.
Removing the name isn’t enough
A common workaround is to strip the patient’s name and paste the rest. But a case file is full of identifiers: date of birth, accident date, employer, hospital, specialist names, claim numbers, an unusual diagnosis, a small town. Together, these can easily identify someone.
Proper de-identification means removing or generalizing all of these, which is tedious to do reliably for a 40-page file. That’s often the point where a privacy-first tool becomes the more practical choice.
Option 2: A Canadian AI Platform, Augure
For many paramedical providers, the ideal tool is simple to describe: “something like ChatGPT, but built around Canadian privacy and data sovereignty.”
That’s where Augure stands out.
Augure offers a familiar chat interface with document analysis, search, and general AI capabilities. Unlike most Canadian healthcare AI products, it isn’t built around encounters, charting, or scribing, and for evidence review work, that’s an advantage. You can upload a set of reports, ask questions, push back on its answers, build a chronology, and draft a summary or insurer rationale in the same open-ended way you would with ChatGPT or Claude.
According to Augure’s public materials (reviewed September 2026):
- conversations, uploaded documents, and account data are stored in Canada;
- customer content is not used to train AI models unless you explicitly opt in;
- AI processing uses zero-data-retention agreements and no US providers. Most processing happens in Canada, but Augure’s privacy policy notes that some models, and backup capacity during outages, are handled by partners in the European Union;
- the platform is marketed to Canadian healthcare organizations as aligned with PIPEDA and Quebec’s Law 25.
Why it fits clinical evidence review: it isn’t tied to a physician’s EMR, a specific specialty, or a scribe workflow, so it works equally well for a physiotherapist preparing an auto-insurance treatment plan, a chiropractor reviewing hospital records, or an occupational therapist organizing specialist reports and functional assessments.
What to keep in mind: Augure is a general AI platform used in a healthcare setting, not a clinical decision-support system. It won’t apply built-in clinical rules or specialty-specific safety checks. You still bring the clinical reasoning, and Augure’s own terms prohibit using it for medical diagnosis without human oversight.
One detail matters for patient files: when Augure describes requests sent to outside partners as “anonymized,” it means your account details are removed, not the patient details inside your documents. If your practice requires Canada-only processing, TO BE REVIEWED ask Augure to confirm in writing whether that’s available for your plan. Then run a de-identified trial case before using it with real patient files.
Option 3: Keep the AI Inside Your Practice (Self-Hosted)
The third approach is to run the AI yourself, so patient information never leaves infrastructure your clinic controls.
Tools like Ollama let you run an open-source large language model on a local computer or server. Paired with a self-hosted interface like Open WebUI, you get something that looks and works much like a private ChatGPT, including document uploads, and it can run without any internet connection at all.
What you gain: control over data storage, access, retention, backups, logging, and which model you use. If the entire setup runs locally, patient information doesn’t need to leave your network. Be aware that add-ons such as web search, cloud-based text recognition (OCR) for scanned documents, external models, plugins, or usage reporting (telemetry) can quietly send data to outside services, so check each component.
What you take on:
- Security is now your job. Authentication, end-to-end data encryption, strict access controls, updates, backups, audit logs, remote access, ransomware protection, and disaster recovery all become the clinic’s responsibility. A poorly secured “private” AI server can be riskier than a reputable managed service.
- Hardware matters. Models that handle long, complex documents well need a capable machine, usually one with a strong GPU and plenty of memory.
- Quality varies. Local models have improved dramatically, but smaller ones can struggle with very long files, lose track of details, or reason less reliably than leading cloud models. Test with realistic workloads.
- No built-in evidence search. Unless you add it, a local model won’t look up current research. Its knowledge stops at its training date.
Who it suits: multi-location clinics or practices with in-house or contracted IT support and a strong reason to keep everything on-site. For a solo or small practice without technical help, a reputable managed service with Canadian data residency is usually the safer choice.
Use AI to Build the Case, Not to Make the Call
The most valuable use of AI in this workflow is also the easiest to misuse.
Consider a physiotherapist preparing a treatment plan for an insurer after a motor vehicle collision. AI can help review the accumulated medical evidence and turn it into a structured evidence synthesis that the provider can use when developing the treatment rationale.
- organize a large volume of records;
- build a clear chronology of the injury, investigations, and care to date;
- highlight consistent, conflicting, or missing findings;
- find relevant research on the condition and proposed interventions;
- structure the report and draft sections based on your instructions.
What the AI shouldn’t do is replace your own clinical decision-making or form the clinical opinion. The treatment direction, the rationale, and the signature at the bottom of the report are yours.
Watch for automation bias, the tendency to trust a polished, confident answer more than it deserves. AI can misread a date, merge two findings, overlook a conflicting report, or cite a study that doesn’t say what it claims (or doesn’t exist). Always verify key facts against the source documents, check every citation, stay within your scope of practice, and make sure the final report reflects your own professional judgment.
Used this way, AI can significantly reduce the time spent organizing complex cases, leaving more time for patient care.
So Which Should You Choose?
Match the tool to the information you’re sharing.
| Your situation | Recommended approach |
|---|---|
| General research, templates, or education materials with no patient information | Mainstream AI (ChatGPT, Claude, Gemini, Copilot) |
| Reviewing real patient files or preparing insurer reports in a ChatGPT-style tool | Augure, after confirming where processing happens for your plan |
| Maximum control over data, with IT support to secure it | Self-hosted AI (Ollama + Open WebUI) |
| Documenting the visit itself | An AI scribe |
The Bottom Line
AI scribes answered the first question: Can AI help document the visit?
The next question is especially relevant to healthcare providers: Can AI help me make sense of everything that came before the visit, and explain my treatment plan clearly, without compromising the information my patients have trusted me with?
The answer is yes, as long as you choose the environment deliberately. Keep mainstream AI for work that doesn’t involve patient information. Use a Canadian AI platform with Canadian data residency, such as Augure, or a properly secured self-hosted setup when it does. And whichever tool you choose, ask the five questions first.
Before you drag a patient’s MRI report into whatever AI tab happens to be open, take a moment to check where that file is going.
