{"meta":{"exportedAt":"2026-10-21T06:57:32.656Z","formatVersion":2,"selection":{"q":"privacy-breach","system":"","harm":"","context":"","country":"","role":"","relation":"","evidence":"","year":"","response":"regulatory","severity":"","verification":"","view":"incidents","sort":"added"},"totalIncidents":1,"coverage":{"cases":1,"countries":1,"languages":1,"unknownLocation":0,"locationPending":0,"unknownLanguage":0,"unknownDate":0,"lawsuits":0,"regulatory":1,"minors":0,"coreRelations":0,"contextualRelations":1,"mixedRelations":0,"unknownRelations":0,"relationPending":0,"relationUnknown":0},"countingNote":"Distinct public cases in this selection. People counts apply within individual cases only; cross-case person overlap has not been resolved. No population incidence estimate.","affectedCountNote":"Interpret person counts with affectedCountStatus and the reported effects. Unquantified zeros are placeholders, not a measured zero.","source":"AI incidents","publisher":"NOPE","url":"https://nope.net/incidents","license":"CC BY 4.0"},"incidents":[{"id":"2024-ontario-hospital-otter-ai-bot-recorded-physicians-rounds-meeting-and-emailed-patient-health-information","caseFacts":{"claims":[{"id":"c1","status":"documented","evidence":[{"locator":"Letter: 'October 27, 2025'; 'Reported Breach HR24-00691'; 'On December 17, 2024, you reported a privacy breach under the Personal Health Information Protection Act'.","relation":"supports","source_id":"s1"}],"assertion":"The Information and Privacy Commissioner of Ontario wrote to the hospital on 27 October 2025 about a privacy breach the hospital had reported on 17 December 2024 under the Personal Health Information Protection Act (file HR24-00691).","causal_attribution":"The letter itself establishes its date, file and the reported breach it addresses."},{"id":"c2","status":"reported","evidence":[{"locator":"Letter: 'a virtual hepatology rounds meeting attended by hospital physicians was inadvertently recorded by an artificial intelligence-powered transcription tool'; 'The physician left his employment with the hospital in June 2023. He installed Otter.ai on his personal device in September 2024.'; 'the Tool was able to join the September 23, 2024 hepatology rounds meeting via accessing the link to it in the physician'; 'and record the meeting without' (page break) 'notice. This was discovered'.","relation":"supports","source_id":"s1"},{"locator":"'an Otter.ai bot attended the meeting in his place'","relation":"supports","source_id":"s2"}],"assertion":"According to the hospital's report as recorded by the IPC, on 23 September 2024 the Otter.ai AI transcription tool joined a virtual hepatology rounds meeting of hospital physicians through the meeting link in a former physician's personal calendar and recorded the meeting without notice; the physician had left the hospital in June 2023 and installed Otter.ai on his personal device in September 2024.","causal_attribution":"The hospital's own breach report, relayed by the regulator; the Globe relays the same letter."},{"id":"c3","status":"reported","evidence":[{"locator":"Letter: 'the personal health information of seven patients was discussed amongst the meeting participants and captured in the transcript'; 'diagnoses, medical notes, and treatment information'.","relation":"supports","source_id":"s1"}],"assertion":"The personal health information of seven patients admitted to the hospital, including names, sex, diagnoses, medical notes and treatment information, was discussed in the meeting and captured in the transcript.","causal_attribution":"Hospital's report as recorded by the IPC."},{"id":"c4","status":"reported","evidence":[{"locator":"Letter: 'This was discovered when a meeting summary and access to a transcript of the recording was automatically emailed to participants after the meeting'; 'of the 65 users on the recipient list, 53 responded confirming they either deleted the email or never received it'; 'the remaining 12 individuals appear to have departed from the hospital'.","relation":"supports","source_id":"s1"},{"locator":"'sent a summary and a link to a transcript of the meeting to 65 people on the invite list, 12 of whom were no longer employed by the hospital'","relation":"supports","source_id":"s2"}],"assertion":"The breach was discovered when the tool automatically emailed a meeting summary and access to the transcript to participants; 65 users were on the recipient list, 53 confirmed deleting the email or never receiving it, and the remaining 12 appeared to have left the hospital.","causal_attribution":"Hospital's report as recorded by the IPC; the Globe relays the same figures."},{"id":"c5","status":"reported","evidence":[{"locator":"Letter: 'the physician did not respond to this request'; 'Submit a formal request to Otter.ai to delete any personal health information'.","relation":"supports","source_id":"s1"}],"assertion":"The hospital asked the former physician to have Otter.ai delete the recording, but he did not respond; the IPC recommended that the hospital itself formally ask Otter.ai to delete any patient information retained from the meeting.","causal_attribution":"Mixed origin: the recommendation is the IPC's own and documented by the letter; the physician's non-response is the hospital's report recorded in the letter, so the whole claim is reported."},{"id":"c6","status":"reported","evidence":[{"locator":"Letter: 'five of seven affected individuals were notified of the breach by letter on December 17, 2024'; 'the other two affected individuals are deceased'; 'For one of these individuals, the hospital provided a copy of the notice letter to their estate trustee'; 'uploaded a copy of the notice letter to the patient’s electronic health record'.","relation":"supports","source_id":"s1"}],"assertion":"Five of the seven patients were notified by letter on 17 December 2024; the other two had died, and the hospital sent a notice to one estate trustee and placed a copy in the other patient's health record.","causal_attribution":"Hospital's report as recorded by the IPC; the deaths are not connected to the breach in any source."}],"effects":[{"label":"patients' health information was recorded by an unapproved AI transcription bot and emailed to a recipient list that included former staff","claim_id":"c3","direction":"negative"}],"sources":[{"id":"s1","url":"https://www.ipc.on.ca/en/media/5995/download","kind":"official_record","access":"read","language":"en","translation_note":"Letter of the Information and Privacy Commissioner of Ontario to the hospital, Reported Breach HR24-00691, dated 27 October 2025, released without the hospital's name; the ipc.on.ca download returned HTTP 403 to this fetcher and the full letter was read from an Internet Archive capture on 2026-10-21.","independence_group":"ipc-letter-hr24-00691"},{"id":"s2","url":"https://www.theglobeandmail.com/canada/article-ai-bot-doctors-meeting-patient-info-hospital-privacy-watchdog/","kind":"news","access":"read","language":"en","translation_note":"The Globe and Mail, 19 November 2025; read in full on 2026-10-21. Its account of the breach comes from the IPC letter, so it shares that letter's group.","independence_group":"ipc-letter-hr24-00691"},{"id":"s3","url":"https://www.hrreporter.com/focus-areas/automation-ai/ai-bot-sends-confidential-info-to-ontario-hospital-patients-after-recording-doctors-meeting-ipc/393766","kind":"news","access":"read","language":"en","translation_note":"Canadian HR Reporter, 21 November 2025; read in full on 2026-10-21. Its account comes from the IPC letter; its headline says information went to patients, which its own text and the letter do not support.","independence_group":"ipc-letter-hr24-00691"}],"version":1,"ai_roles":["others_use"],"contexts":["privacy","health","work"],"unknowns":["Whether Otter.ai deleted the recording and transcript; the hospital had no confirmation when the letter was written.","Whether the 12 departed recipients deleted the email.","Whether the former physician knew the tool had joined the meeting.","What the hospital reported to the IPC by the 27 January 2026 update deadline."],"geography":{"basis":"The letter is from Ontario's privacy commissioner to a hospital custodian under Ontario's health privacy law, and the patients had been admitted to that hospital; the Globe describes it as an Ontario hospital. No court is involved.","court_countries":[],"event_countries":["CA"],"affected_person_countries":["CA"]},"publication":{"basis":"Published under the 2026-10-06 privacy clarification: a regulator's letter records the hospital's report that an AI transcription tool joined a clinical meeting without notice, captured seven patients' health information and emailed it to a list including former staff. The relation is received_personal_information.","reviewed_on":"2026-10-21"},"ai_involvement":{"basis":"The hospital's report recorded in the regulator's letter says the Otter.ai tool itself joined the rounds meeting from a former physician's calendar, recorded it without notice, captured seven patients' health information in its transcript and automatically emailed a summary and transcript access to 65 recipients. That capture and distribution by the AI service is the privacy harm.","status":"supported"},"person_relations":["received_personal_information"]},"name":"Ontario hospital reports that an Otter.ai bot joined physicians' rounds through a former doctor's invite, recorded them and emailed patient information","summary":"An Ontario hospital reported to the provincial privacy commissioner that on 23 September 2024 the Otter.ai transcription tool, installed on a personal device by a physician who had left the hospital in June 2023 and was still on the meeting invite, joined a virtual hepatology rounds meeting, recorded it without notice and then emailed a summary and transcript access to the invite list. The personal health information of seven patients, including diagnoses and treatment, was captured; 12 of the 65 recipients appeared to have left the hospital. The commissioner's letter of 27 October 2025 recommended that the hospital itself ask Otter.ai to delete the retained patient data.","incidentDate":"2024-09-23","incidentKind":"single_event","incidentDatePrecision":"day","exposurePattern":"single_interaction","reportedDate":"2025-11-19","aiSystem":"Otter.ai, an AI transcription tool that a former hospital physician installed on a personal device and that joined meetings from his calendar (per the hospital's report to the IPC)","aiProduct":"Otter.ai (reported)","aiCompany":"Otter.ai","severity":"medium","verificationStatus":"credible","harmCategories":[],"harmOutcomes":["other_material_harm"],"harmOutcomeSummary":"Seven patients' health information was recorded by an unapproved AI transcription bot, which then emailed a summary and transcript access to 65 people, 12 of whom appeared to have left the hospital, according to the hospital's report to Ontario's privacy commissioner.","frameworkFacets":[],"causationStatus":"supported","participantUsersAffectedMin":0,"otherPeopleHarmedMin":7,"affectedCountStatus":"exact","affectedCountEvidence":"The IPC letter records that the personal health information of seven patients was discussed in the meeting and captured in the transcript. Meeting participants and email recipients are not counted as harmed.","victimAgeRange":"unknown","jurisdiction":"CA-ON","platformType":"assistant","outcomeType":"regulatory_action","outcomeStatus":"resolved","primarySourceUrl":"https://www.ipc.on.ca/en/media/5995/download","primarySourceLabel":"Information and Privacy Commissioner of Ontario, letter on Reported Breach HR24-00691, 27 October 2025","firstPublishedAt":"2026-10-21T03:12:57.400852+00:00","updatedAt":"2026-10-21T03:12:57.400852+00:00","scopeVersion":"facts-v3","tags":["otter-ai","ai-notetaker","meeting-transcription","health-information","privacy-breach","regulator","ontario"]}]}