Dental clinic in Quebec: a practical compliance checklist

The Act respecting health and social services information (LRSSS) lists, among health-sector bodies, anyone who operates a private professional's office (Schedule II), which covers a clinic where dentists practice on their own account. The private-sector privacy act, Law 25, does not apply to that health information (s. 3, para. 3). A patient's name or contact details are part of it when attached to health information or collected for their care (LRSSS, s. 2).

Have your advisor confirm your situation: it is the first check on the list.

In Orvel's configuration, Luna records only administrative data (appointments, reminders, consents) and points to the dental software's record for everything else.

• Situation confirmed by your advisor.
• Only administrative data is in the file.
• Source: https://www.legisquebec.gouv.qc.ca/fr/document/lc/P-39.1

A clinic may entrust information to a provider if it is necessary for the contract, but the contract must be in writing and contain, on pain of nullity, the clauses of section 77 of the LRSSS: confidentiality measures, a commitment signed by each person with access, notice of any breach, destruction at the end of the contract, and subcontractors bound by the same obligations. The information is still considered held by the clinic even if it is stored with a third party (s. 5).

Before signing, ask us in writing how we meet each of these clauses.

• Signed written contract.
• The clauses of section 77 appear in it.
• Written answer from the provider for each.

A body may collect only the information necessary for its activities (s. 13) and must inform the person, in plain terms, of who is collecting and for what purposes (s. 14). Luna asks the questions on your intake form, no more, and her welcome message is written with you.

On the privacy side, the private-sector act also asks you to designate a person in charge of protecting personal information, publish their contact details and inform people of the purposes of collection. The file's table states the purpose of each field.

Source: https://www.quebec.ca/nouvelles/actualites/details/loi-25-nouvelles-dispositions-protegeant-la-vie-privee-des-quebecois-certaines-dispositions-entrent-en-vigueur-aujourdhui-43220

The LRSSS requires that any technological product or service used be entered in a register, and that this register be published on the clinic's website (s. 107). Luna appears in it like any other intake or appointment-booking tool.

Any confidentiality incident must be recorded in a register. If there is a risk of serious injury, the Commission d'accès à l'information (Quebec's access to information and privacy commission) and the people affected must be notified. Keep an incident register, without putting clinical details in it.

Source: https://www.fasken.com/fr/knowledge/2023/01/a-vos-marques-signalez-le-reglement-sur-les-incidents-de-confidentialite-est-en-vigueur

The dentist must respect the secrecy of all confidential information (s. 3.06.01) and take reasonable measures regarding the people who work with them to preserve it (s. 3.06.03, para. 3). They answer for their tools. The Professional Code sets the same rule for every professional (s. 60.4).

In practice: no clinical detail in texts, access to conversations limited to the people you designate, and all conversations reviewable. The clinical record stays in the clinic's software, according to the regulation of the Ordre des dentistes du Québec (the dentists' professional order).

• No clinical detail in texts.
• Access limited to designated people.
• Conversations reviewable.
• Source: https://www.legisquebec.gouv.qc.ca/fr/tdm/rc/D-3,%20r.%2016/20120901

The explanations needed to understand fees fall to the dentist (s. 3.08.03): Luna answers only from the information you give her and hands over for a treatment plan. The dentist may not use testimonials of support in advertising (s. 3.09.10): the posts Luna prepares contain none, and nothing is published without your approval.

In case of a disagreement over an account, the patient must first request conciliation from the syndic of the Ordre des dentistes du Québec. To avoid disputes, state the cancellation policy and missed-appointment fees clearly in the confirmation.

Sources: https://www.publicationsduquebec.gouv.qc.ca/fileadmin/gazette/pdf_encrypte/lois_reglements/2019F/70452.pdf and https://www.odq.qc.ca

A commercial electronic message (email or text) requires the recipient's consent, identification of the sender and an unsubscribe mechanism (CASL). A patient who bought a service from the clinic in the last two years has an existing business relationship with it (s. 10(10)(a)): this is implied consent to remind them of a cleaning that is due. Every commercial message identifies the clinic and offers a way to unsubscribe (s. 6(2)).

Luna blocks the sending of texts without recorded consent and adds the unsubscribe (STOP) to every message. Source: https://crtc.gc.ca/fra/internet/anti/reg.htm

A confirmed law, a written contract, an up-to-date register, no clinical details in messages and recorded consents: that is the essentials. Go through this list every year with your advisor.

General information, not legal advice. Check with your professional order or the official source.

Try Orvel free for 7 days The Luna agent

• https://www.legisquebec.gouv.qc.ca/fr/document/lc/P-39.1
• https://www.quebec.ca/nouvelles/actualites/details/loi-25-nouvelles-dispositions-protegeant-la-vie-privee-des-quebecois-certaines-dispositions-entrent-en-vigueur-aujourdhui-43220
• https://www.fasken.com/fr/knowledge/2023/01/a-vos-marques-signalez-le-reglement-sur-les-incidents-de-confidentialite-est-en-vigueur
• https://www.legisquebec.gouv.qc.ca/fr/tdm/rc/D-3,%20r.%2016/20120901
• https://www.publicationsduquebec.gouv.qc.ca/fileadmin/gazette/pdf_encrypte/lois_reglements/2019F/70452.pdf
• https://crtc.gc.ca/fra/internet/anti/reg.htm
• https://www.odq.qc.ca

• How an AI agent handles a clinic's appointments
• A dental clinic's year: what to do, month by month