PHIPA compliance and healthcare IT
PHIPA governs health information in Ontario, and an equivalent provincial act governs it everywhere else in the country. Not HIPAA. If a vendor is selling you HIPAA compliance for an Ontario clinic, that tells you how carefully they've read the file, and it's worth knowing before you sign.
By the numbers
Years of experience
Enterprise deployments
Senior engineers
Support
Which rules apply to you?
A photo means it applies to you now. A white tile depends on you. The black tile never applied.
- Applies now
PHIPA
Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
- Doesn't apply
HIPAA
US law. It governs nothing in a Canadian clinic, and a vendor quoting it is quoting the wrong country.
- Applies now
Breach notification
To the Information and Privacy Commissioner, on thresholds that are set separately from the federal ones and don't move together with them.
- Applies conditionally
Provincial equivalents
Every province has its own health privacy statute. The obligations rhyme. The thresholds and the timing don't.
If you hold records on patients outside Ontario.
- Applies conditionally
PIPEDA
The federal baseline, for the parts of what you do that provincial health law doesn't reach.
If some of your work falls outside provincial health law.
Which services answer them?
- PIPEDA Compliance The federal baseline, and where provincial health law takes over.
- Privacy Impact Assessment (PIA) Expected before a new system touches health information.
- Backup and Disaster Recovery A clinician who can't reach a record is a patient safety issue.
- Security Awareness Training Health records are the highest-value target in the country.
- Identity and Access Management Who opened which chart, provable, because someone will ask.
- Endpoint Management Shared workstations and devices that never leave the ward.
- Managed Security Services (MSSP) Monitoring that understands what a health record is worth.
- Virtualization Services Clinician access from anywhere without records leaving.
Whose kit does this run on?
The platforms we design, build and support. Named because a buyer with an estate already standardised on one of them needs to know before the first call, not after it.
Cisco, Fortinet, VMware, Azure, Microsoft, F5
What do you need from us?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Sector
- Healthcare and Life Sciences
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584