Canada's healthcare AI strategy runs into its own Achilles' heel: who controls patient data

By CBC · November 6, 2026.

Researchers warn that Canada's new AI strategy for healthcare, called "AI for All," "has a privacy problem." According to CBC's report, the proposed legislation could allow private companies to use patients' medical records without their knowledge or consent.

The available material is sparse: it is a video segment of just over two minutes, with no details on the bill's provisions, which companies would benefit or what safeguards the text includes. That is why it is worth clearly separating what we know (the researchers' warning, attributed to CBC) from what we do not (the actual scope and exact wording of the proposal). What follows is our take, not an analysis of the bill's provisions.

Our take: the conflict is predictable and structural. Medical AI needs massive, high-quality data, and clinical records are the most valuable and most sensitive fuel there is. When a national strategy wants to accelerate adoption, the temptation is to make access to that data cheaper by reducing friction such as consent. It is a shortcut that usually proves costly.

The risk is not only ethical; it is practical. If patients perceive that their data is being exploited behind their backs, the usual reaction is to withdraw trust, withhold information from their doctor or demand tougher restrictions. That degrades the data and holds back precisely the AI the strategy was meant to promote. In general, the health systems that have made the most progress on shared data have done so with explicit governance, traceability and clear choices for citizens.

In the short term, the transition will be uncomfortable: there will be tension between deployment speed and patient rights, and whoever wins the legislative debate will determine who captures the value of that data — the public system, companies or patients themselves. In the long term, the promise is enormous: diagnoses in seconds, more personalized medicine and a realistic path toward eradicating diseases. But that healthcare abundance is only sustainable if it rests on legitimately obtained data.

The thesis, in short: privacy is not the brake on healthcare AI; it is its trust infrastructure. A strategy that treats it as a regulatory obstacle will end up paying for it in adoption. It will be worth reading the full legislative text before reaching a firm verdict, and watching whether informed consent, anonymization and access auditing are firmly enshrined in the final law.