Define the task and who approves it
Split the work into three kinds: pulling facts out of a record, drafting a suggestion, and taking an action. Each has its own risk. Name who is hurt by an error, who may approve the workflow, and how a person can fix a wrong result.
In credential work, for example, reading an expiry date from a document is one task. Deciding whether a person may work a shift is another, with a person accountable for it. An unclear reading should be resolved, never treated as permission to act.
What does a controlled AI workflow look like?
This is a design recommendation, not a claim about a deployed system or a rule every regulator requires.
Extract
Process only the information the approved task needs.
Check
Check required fields against the original record and agreed rules. Handle unreadable or inconsistent inputs.
Review
Send uncertain or important decisions to an authorized person.
Act
Allow only the approved action, with limited system permissions.
Record and undo
Log the decision and which rules were in force, limit who can read the log, and keep a way to correct or undo.
Test the whole workflow, including odd cases and failed links to other systems. Set the points where a person must review from your test results. The tool's own certainty score does not prove accuracy.
Does the data have to stay in Canada?
There is no single answer for every organization. PIPEDA is Canada's federal privacy law for businesses. The federal privacy commissioner says it allows data to be processed across borders. The organization that sends it stays accountable for it. Ontario's privacy commissioner says PHIPA does not require health information to stay in Ontario or Canada. The organization that holds the records is still responsible for keeping them safe, and sharing records has its own rules.
Write down where the data is processed, stored and backed up, and where support staff can reach it. A Canadian address or storage region does not, by itself, show where all of that happens.
What evidence should you prepare for the review?
- A data inventory: the purpose, the kinds of data, who receives it and the authority to use it.
- Provider terms: the services, other companies your provider uses, locations, how long data is kept, deletion and training use.
- Access: who can see records, change rules, approve actions and run the system.
- Testing: test cases, what counts as an error, when a person must review, and how failures are handled.
- Records: what is logged, how the log is protected, and how long it is kept. Keep unneeded sensitive data out of logs.
- Operations: incident response, who owns reviews, who approves changes, and recovery.
This is a planning checklist, not a legal assessment.
Why do we write about this?
Kin-etiq.ai's founder, Peter Faist, runs Staffy, a healthcare staffing marketplace. Its Salus product manages workers' credentials. Staffy is a related company, described in the Staffy case study. Staffy's experience does not certify this pattern or prove that any workflow complies.
Sources
- Office of the Privacy Commissioner of Canada: processing personal data across borders, reviewed 13 October 2026.
- Information and Privacy Commissioner of Ontario: PHIPA frequently asked questions, reviewed 13 October 2026.
To scope one workflow, describe the task and its review requirements in an email to hello@kin-etiq.ai. Keep patient records and other sensitive documents out of the first message.