Managed IT Services for Healthcare & Dental Clinics
IT for Ontario medical clinics: PHIPA duties, EMR access, and what to do when patient information is exposed. Dental practices have their own page; this one is about physician, specialist, physiotherapy and allied-health clinics.
Your duties as a health information custodian
Under Ontario's Personal Health Information Protection Act (PHIPA), the clinic or practitioner is usually the health information custodian. The custodian must take reasonable steps to protect personal health information against theft, loss and unauthorized use or disclosure, and remains responsible for IT providers and other agents acting on its behalf.
In practice that means knowing who can open which records, being able to show it, and having agreements in place with the vendors who host or support your systems. This page is practical guidance, not legal advice; confirm how the law applies to your organization with counsel.
When something goes wrong: notification and IPC reporting
If personal health information is stolen, lost, or used or disclosed without authority, PHIPA requires the custodian to notify the affected individuals at the first reasonable opportunity. In circumstances set out in the regulations, the custodian must also report to the Information and Privacy Commissioner of Ontario, and custodians file annual breach statistics with the IPC.
You can only notify accurately if you can tell what was accessed. That depends on audit logs in the EMR and in Microsoft 365 being switched on and kept. Check that before you need it (Microsoft 365 audit log).
EMR hosting: cloud or a server in the back room
Most clinics now use a cloud-hosted EMR, where the vendor runs the servers and the clinic's job is access: individual logins, multi-factor sign-in, devices that lock and encrypt, and removing accounts when staff leave. Some still run an EMR on a local server, where the clinic also owns patching, backups and physical security of that server.
Whichever you have, ask the vendor where data is stored, how it is backed up, how you get your data out if you leave, and what audit logs they keep. For a local server, restore-test the backup on a schedule and keep a copy off site.
The attacks clinics actually see
Phished Microsoft 365 passwords used to read referral email; fax-to-email inboxes that nobody monitors; shared front-desk logins; and fake invoices from "suppliers". Multi-factor sign-in on every account, named logins at the front desk, a short screen lock, and a callback rule for payment changes stop most of it.
Our identity and device case study started with reconstructing a mailbox compromise minute by minute, then moved to central identity and device management. The same order of work suits a clinic: find out what happened, then make it hard to repeat.
If patient information may have been exposed, see privacy breach assessment and notification.
What hospitals, partners and insurers ask
Hospital partners and cyber insurers ask about multi-factor sign-in, encryption, backups, audit logging and incident response. Answer from what is configured, in writing. Before you talk to any provider, test your domain with our email spoofing check and work through the printable IT risk self-check.
Where to start this month
If you only do four things this month, do these, in this order. Each is cheap and each closes a gap we see often in this sector.
1.
Replace shared front-desk logins with named accounts and multi-factor sign-in.
2.
Confirm audit logging is on in the EMR and Microsoft 365, and how long it is kept.
3.
Ask your EMR vendor the four hosting questions above and keep the answers on file.
4.
Write down who you would call and what you would do in the first hour of a breach.
Questions clinics ask
The custodian stays responsible. Your provider acts as your agent and should be bound by an agreement that covers confidentiality and access. Ask counsel to review it.
They should not. Shared logins make it impossible to show who opened a record, which is the first thing you need after a breach.
Not every one; the regulations set out when a report is required, and individuals must be notified. Annual statistics are filed regardless. Check the IPC's guidance and get advice.
Accounts, devices, network, email and how staff sign in. Most clinic breaches start there, not at the EMR vendor.
Yes; see our dental IT page.
Related work.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
- Case studyRecovering a Total ERP Database Outage in a Single MorningHow IT Rapid Support traced a total Spire database outage to a changed server network profile and had every affected workstation back the same morning.
Related pages.
- ArticlePHIPA for clinics and health information custodiansOntario's Personal Health Information Protection Act puts clear duties on clinics, practitioners and the vendors who support them: protect records, notify patients of…
- HubServicesManaged IT, security, incident response and forensics for businesses and private clients, from our offices in Vaughan, Toronto and Vancouver. Pick the practice below, or call the 24/7 incident line at (289) 582-9930 if something is happening now.
- ToolWhat is missing from your managed IT quote?Two managed IT proposals can carry the same monthly price and cover completely different things.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.