Compliance Centre · Consent
Patient consent and your clinic's part
Sample wording to inform patients, and a checklist of the safeguards that are yours to put in place. Adapt both to your college's requirements and your provincial law.
Not legal advice
This is sample language and a general checklist, not legal advice and not a consent form approved for your jurisdiction. Your regulatory college and provincial privacy law set the actual requirements; confirm them and involve a privacy advisor.
What patients should understand
- Only the physician's voice is recorded to help write the note — the patient is not recorded, and there is no open microphone on the room.
- The dictation is transcribed and shaped into a note using third-party software vendors the physician has chosen.
- The note is stored briefly on the physician's Mac and then deleted on a set schedule; the medical record itself lives in the clinic's EMR.
- The patient can ask questions or raise concerns about the tool at any time.
Sample patient notice
Adapt this plain-language notice for a posted sign, an intake sheet, or a verbal script:
"To write your visit notes accurately, your physician may dictate a summary after speaking with you. Only the physician's voice is recorded — you are not recorded. The dictation is converted to text and organised using secure software services and is kept only briefly before being deleted; your medical record is stored in our clinic's electronic records system. Please let us know if you have any questions."
Whether express or implied consent applies, and how it must be documented, depends on your jurisdiction and college — confirm before relying on any wording.
Clinic-responsibility checklist
DirectScribe secures its own behaviour, but these safeguards are yours to configure and maintain:
- Turn on FileVault. Full-disk encryption is what protects any residual data after deletion and any data at rest if the Mac is lost or stolen. This is the single most important item.
- Protect your network. Use a trusted, password-protected network for clinical work; avoid public Wi-Fi for anything patient-related; keep the macOS firewall on and the OS up to date.
- Put signed vendor agreements in place. Where your assessment requires it, sign a BAA or data-processing agreement with each vendor before sending patient-derived data. See the per-vendor notes in the vendor guides.
- Secure the device. Strong login password, automatic screen lock, and physical security for the Mac. Do not share the login used for clinical work.
- Know your backups. Deletion frees files on your schedule, but any backup you run yourself may retain copies. Decide deliberately what is backed up and exclude what should not be.
- Set a short retention window. Keep only what you need. Use the session-end delete once a note is safely in the EMR — your system of record.
- If you run LM Studio locally, enable its bearer token and keep the server on loopback only.