After-Hours Missed Calls at an Ontario Dental Practice: What Can an AI Receptionist Say and Record?
After-hours missed calls at my Ontario dental practice: what can an AI receptionist say and record on those calls?
Key takeaway. An AI receptionist can answer evening calls for an Ontario dental practice, confirm hours and location, and book or hold a slot. It should collect only what scheduling requires: name, callback number, preferred window, and new or existing patient. It should not invite symptoms, diagnoses or medication lists. Announce in the greeting that callers are speaking with an automated assistant, keep recordings on a short, written retention schedule, and route anything clinical or urgent to a human callback. Have your privacy lead and your college review the setup.
Why now
The Office of the Privacy Commissioner of Canada published its Principles for responsible, trustworthy and privacy-protective generative AI technologies on December 7, 2023, and the page was last modified on 2025-05-06. It is the clearest federal statement available on what an organization using a generative AI tool, including a public-facing voice agent, is expected to do. It landed while dental offices across Ontario were quietly adding voice AI to catch the 6 p.m. to 9 a.m. calls that used to hit voicemail.
The operational gap is simple. The office closes at 5 p.m. A parent whose child chipped a tooth calls at 7:40 p.m. If nobody answers and nobody texts back, that call goes to the next practice on the map. But a tool that answers is also a tool that collects. In a health setting, collection is never a neutral act, and the configuration decisions you make before go-live are the ones that matter.
What the rule actually says
Two texts frame the decision. The first is Ontario's health privacy statute, described by the Information and Privacy Commissioner of Ontario on its Your health privacy rights page:
"The Personal Health Information Protection Act (PHIPA) , governs the collection, use and disclosure of personal health information within the health sector. The objective is to keep personal health information confidential and secure, while allowing for the effective delivery of health care."
Read the objective twice. Confidential and secure, while allowing for the effective delivery of health care. Both halves count. Nothing there tells a practice to stop answering the phone. It tells you to handle what you collect with care.
The second text is the OPC document. Under Principle 2, Appropriate Purposes, the OPC lists potential emerging no-go zones, and one of them reads:
"the use of conversational bots to deliberately nudge individuals into divulging personal information (and, in particular, sensitive personal information) that they would not have otherwise;"
That line is the single most important design constraint for a dental voice agent. A bot that opens a question about what hurts is pulling health information out of a caller at 8 p.m., into a system that caller never evaluated, for a purpose that scheduling does not require. That is the behaviour the OPC flags.
Two more lines shape the build. Under Principle 4, Openness, for organizations using generative AI systems:
"Where a generative AI tool is public-facing, ensure that individuals interacting with the tool are aware that they are interacting with a generative AI tool and that they are informed about both privacy risks and any mitigations available to them (such as not entering personal information into a prompt, unless necessary)."
And under Principle 7, Limiting Collection, Use, and Disclosure:
"Where personal information (and, in particular, sensitive or confidential information) must be entered into a prompt, only do so where authorised. Unless otherwise required, prompts should not be retained, used for secondary purposes, or disclosed."
Principle 1 adds a step that dental owners often skip. The OPC asks parties, in contexts where information is sensitive and consent may be inappropriate or inadequate, such as in health care, to establish a separate review process that takes into account both the privacy and ethics of the proposed use and is subject to independent oversight. For a single-location practice, that usually means a named privacy lead reviews and signs off before the line goes live, not after the first complaint.
This is an explanation of what the texts say, not legal advice. Validate your specific configuration with your privacy lead, the RCDSO, or a qualified advisor.
The method
1. Write the scope line before you write the script
Decide in one sentence what the assistant is allowed to do. A workable scope line for a dental office: confirm hours and location, identify new versus existing patient, capture name and callback number, offer appointment windows, and escalate urgency to a human callback. Anything outside that sentence is out of scope and gets removed from the script.
Example: a general dentistry practice in Ottawa drafted its scope line, then noticed its first draft script asked callers to describe their dental concern. They cut the question entirely. The replacement was a yes or no: does this need attention tonight? A yes triggers the practice's standard emergency instruction and a callback path. No symptom detail is captured either way.
2. Put the disclosure in the first eight seconds
The OPC is explicit that people interacting with a public-facing tool should know it is a tool, and should be told about privacy risks and available mitigations. Put that in the greeting, not in a footer on your website. Say it plainly, once, then move on. Callers do not hang up on honesty. They hang up on voicemail.
Example: a family dental clinic in Mississauga opens with one sentence naming the practice and stating that an automated assistant is handling calls after hours. The sentence also tells callers not to share medical details on the line, which doubles as the mitigation the OPC describes.
3. Enforce the data minimum in the system, not just in the script
A script can be ignored by a caller who volunteers information anyway. Someone will mention a crown, a medication or a swelling whether you asked or not. So the control has to live in the stack: short retention on audio and transcripts, no use of call content for model training, restricted access, and a written deletion schedule. Principle 7 asks all parties to do this directly:
"Establish and abide by appropriate retention schedules for personal information, including (as applicable) that contained within training data, system prompts, and outputs."
Example: a practice in Kingston set transcripts to purge on a fixed schedule, kept only the booking record in its practice management system, and documented the schedule on one page the office manager can hand to any patient who asks.
4. Route clinical and urgent calls to a human
The assistant's job ends at scheduling. Bleeding, swelling, trauma and post-operative concerns should trigger the practice's existing after-hours emergency instruction plus a human callback. Do not let a voice agent improvise clinical guidance or rank severity. The OPC is blunt here, telling organizations using generative AI systems to know that accountability for decisions rests with the organization, and not with any kind of automated system used to support the decision-making process.
Example: a clinic in Toronto maps a short list of urgency cues to one escalation path. The assistant delivers the standard emergency instruction, captures a callback number, and flags the record for the first staff member in the morning.
5. Document the review and revisit it
Write down who approved the script, what the line collects, where it is stored, how long it is kept, and who answers privacy questions. The OPC asks all parties to establish a mechanism by which the organization can receive and respond to privacy-related questions or complaints. A named person and an email address is a start. Re-read the file twice a year, because the tool and the call volumes both change.
Templates
Template 1: after-hours greeting with disclosure (adapt, then have it reviewed)
Thank you for calling [Practice Name]. Our office is closed right now and you are speaking with our automated assistant. It can book, move or cancel an appointment and take a message for the team. Please do not share medical details on this call. If this is a dental emergency, [standard emergency instruction]. Otherwise, may I have your first and last name and the best number to reach you?
Template 2: redirect when a caller starts describing symptoms
Let me stop there so no medical details are recorded on this line. I can book the first available time and flag your file for the team to call you back. Does this need attention tonight, yes or no?
Template 3: internal one-pager for the after-hours AI line
Purpose: book, reschedule and cancel appointments outside office hours. Collected: first and last name, callback number, new or existing patient, preferred appointment window, yes or no urgency flag. Not collected: symptoms, diagnoses, medications, health card number, insurance details. Disclosure: automated assistant announced in the greeting on every call. Retention: audio and transcript deleted on a fixed schedule; only the booking record is kept in the practice management system. Secondary use: call content is not used to train or refine any model. Escalation: any urgency flag triggers the standard emergency instruction plus a human callback. Privacy contact: [name, email, phone]. Reviewed by: [privacy lead], [date]. Next review: [date].
What never to do
- Do not ask callers to describe symptoms. The OPC flags conversational bots that nudge people into divulging sensitive personal information they would not have otherwise.
- Do not let the assistant give clinical advice or rank severity. Accountability for the decision stays with the practice, not with the automated system.
- Do not hide that it is an AI tool. Openness is one of the nine principles, and a caller who finds out later loses trust in the practice, not in the vendor.
- Do not keep recordings indefinitely in case they are useful. Retention schedules are expected to limit retention for information no longer required.
- Do not let call content be reused for training or any secondary purpose unless you have authorized it and written down why.
- Do not collect health card or insurance numbers on an after-hours line. Neither is needed to hold a slot.
- Do not launch before someone with privacy responsibility has read the script and signed the one-pager.
When to hand it off
Most practices can write the script themselves. Fewer have time to wire the greeting disclosure, the escalation path, the retention schedule, the calendar sync and the missed-call text-back into one system that still behaves correctly at 9 p.m. on a Saturday. That is the build we do with NeverMiss AI at 497 $/month, implemented in GoHighLevel with the scope line, the disclosure and the deletion schedule documented before go-live. If you want to see where your current after-hours flow leaks calls, book a free 30-minute call or request the free site audit, and we will map what your line does today before anything changes. If you are also tightening your Google presence, our piece on Google review management for dental practices in Ontario covers the other half of the after-hours impression.
FAQ
Can an AI receptionist answer calls for a dental office in Ontario? Nothing in the sources prohibits it. PHIPA governs how personal health information is collected, used and disclosed in the health sector, so the real question is how the tool is configured. Have your privacy lead and the RCDSO review your specific setup.
Do I have to tell callers they are speaking with an AI? The OPC's openness principle tells organizations using a public-facing generative AI tool to ensure individuals are aware they are interacting with one and are informed about privacy risks and available mitigations. One sentence in the greeting covers it.
Should the after-hours line record calls? Only if you need the recording and you have set a schedule for deleting it. The OPC asks organizations to establish and abide by appropriate retention schedules, limiting retention for information no longer required while keeping it long enough for access rights to be exercised.
What happens if a patient describes a symptom anyway? Build a redirect into the script and a short retention window into the system. You cannot stop a caller from speaking, but you can stop that content from sitting in your stack for months.
Can the assistant handle a dental emergency at 2 a.m.? It should not triage. It should deliver your existing after-hours emergency instruction, capture a callback number, and flag the record for the morning. Clinical judgment stays with your team.
Who is accountable if the AI gets something wrong? The practice. The OPC states that accountability for decisions rests with the organization and not with any kind of automated system used to support the decision-making process. That is why the scope line, the script review and the sign-off matter more than any vendor demo.
Darly Robert Cham, founder of IntelliAIScale. Former Clinical Research Coordinator at Hôpital Maisonneuve-Rosemont in Montréal, CCRP, CCRC and CCRA certified (CRA School). IntelliAIScale helps clinics in Ontario and Quebec answer every call and every review.
Sources
- https://www.ipc.on.ca/en/health-individuals (read on 2026-10-27)
- https://www.priv.gc.ca/en/privacy-topics/technology/artificial-intelligence/gd_principles_ai/ (read on 2026-10-27)
Founder and CEO of IntelliAIScale. Former Clinical Research Coordinator at Hôpital Maisonneuve-Rosemont, CCRP, CCRC, CCRA.
