Assessments
Health AI Readiness Checker
Fourteen regulators published six principles for health AI and a set of specific demands for vendors, providers, and researchers. This checker turns those demands into sixteen questions. Answer them and it scores each principle, names your exact gaps, and hands you a prioritized action list.
Three contract lines to check
The resolution's sharpest items are contractual, and they belong in your health AI vendor files today:
- A ban on commercialization. Your contracts should prohibit contractors and subcontractors from unauthorized commercialization or disclosure of patient information. Fourteen privacy chiefs want it in writing.
- A named human for AI objections. Designate a contact for concerns and objections about AI use of personal information, and offer a practical way to challenge consequential decisions.
- A shadow-AI clause. Train staff on approved AI use and block unapproved tools. The resolution names the exact scenario: an employee using a personally procured AI tool outside policy.
What practitioners say
The field is further behind than its confidence suggests. A survey of 250 US healthcare leaders found 72 percent saying AI tools or agents are deployed without formal IT approval at least occasionally, while 86 percent claimed confidence they can fully control agent actions. Practitioners say a complete inventory of AI agents, their owners, and their data access matters more than policies on paper. And the quiet risk keeps showing up: staff pasting "de-identified" summaries into public chatbots, where a combination of age, diagnosis, procedure date, and hospital is often re-identifiable.
Answer sixteen questions. You get a score out of 32, a verdict from Not ready to Strong footing, per-principle percentage bars, and a prioritized action list with no-answers first. Copy the list and take it to the people who own the contracts.
Privacy protective
Do your health AI vendor contracts explicitly prohibit contractors and subcontractors from unauthorized commercialization or disclosure of patient information?
Fourteen regulators want this ban in writing.
How the score is set
Each answer is worth 2 points for yes, 1 for partially, and 0 for no, for a maximum of 32. Per-principle percentages show where the gaps sit. The verdict follows the overall percentage: 80 percent and up is Strong footing, 41 to 79 percent is Getting there, 40 percent and below is Not ready. Every no or partially becomes an action, with no-answers first, in principle order.
What this is not
Not legal advice, not a compliance assessment, and not a vendor certification. For the privacy review of the use case itself, run the PIA Questionnaire Builder. For the program around it, start with the AI Governance Starter Checklist and the Privacy and AI Governance Maturity Assessment. For the full analysis behind these questions, read Fourteen Regulators, One Resolution.
Questions
What does the checker cover?
Sixteen questions drawn from the specific demands of the October 29, 2026 joint resolution of Canada's federal, provincial, and territorial privacy commissioners and ombuds on responsible AI use in health care and health research. The questions sit under the resolution's six principles: privacy protective, valid and reliable, safe, human rights affirming, transparent, and accountable.
Where do my answers go?
Nowhere. The assessment runs entirely in your browser. Nothing is stored, sent, or logged by this page.
What does the score mean?
Each answer scores 2 for yes, 1 for partially, and 0 for no, out of 32. Eighty percent and up is Strong footing, 41 to 79 percent is Getting there, and 40 percent and below is Not ready. The score is a starting point for the prioritized action list, not a compliance finding.
Is this legal advice?
No. This is a self-assessment worksheet. It does not determine whether your AI use complies with any privacy law, and it does not replace review by your privacy officer or legal counsel.