Assess
We inventory what is running, what it costs and where it is exposed. You keep the report.
Services
Healthcare IT for clinics
IT for Ontario clinics, built around the obligations a health information custodian actually carries.
What this covers
A clinic is not a small office with medical software on it. Under PHIPA you have to prove who opened which chart, that a backup restores, and that a leaver lost access the day they left.
- PHIPA readiness assessment against your current systems, with a ranked gap list
- EMR support and coordination with your vendor, including OntarioMD certified products
- Access control per the CPSO requirement: a unique login for every user, no shared credentials
- Audit trail verification, so changes to a record keep the original content and can be printed separately
- Automatic backup with an offsite copy, tested by restore rather than by the presence of a file
- Retention and secure disposal aligned to the 10 year record rule
What you end up with
- You can answer who accessed a chart, and when, from a log rather than from memory
- A restore has actually been performed and timed, so recovery is a number
- Departing staff lose access the same day, with a record that they did
Process
How the work runs
Plan and quote
Findings become a ranked plan with a price against each item. You approve before anything changes.
Deliver and maintain
Work runs in named windows with a rollback, documented as it goes.
Questions
Common questions
If yours is not here, ask it on a discovery call. There is no charge for the conversation.
Is PHIPA the same as PIPEDA?
No, and using the wrong one is a common mistake. In Ontario a health information custodian is governed by the Personal Health Information Protection Act, which is stricter and has its own mandatory reporting rules.
When does a privacy incident have to be reported to the IPC?
Reporting is mandatory in seven circumstances, including theft of information that was neither de-identified nor encrypted, use or disclosure by someone who knew or should have known it was not permitted, a breach that continues after the first incident, a pattern of similar breaches, disciplinary action connected to a breach, and any breach that is significant by volume or sensitivity. The patient must be notified at the first reasonable opportunity in every case.
What is the March 1 deadline?
Every health information custodian that had breaches in a calendar year must file breach statistics with the IPC by March 1 of the following year, including incidents that never met the threshold for immediate notification. That means you need a log of every incident, not only the reportable ones.