Ontario's Personal Health Information Protection Act (PHIPA) makes your clinic, as the health information custodian, responsible for protecting patient information. Section 12 of the Act requires custodians to take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure, and to protect records against unauthorized copying, modification or disposal.
"Reasonable steps" isn't a list in the Act, but most of them are technical. Below is the checklist we work through with clinics. It isn't legal advice: your privacy officer owns your PHIPA program, and the Information and Privacy Commissioner of Ontario (IPC) publishes guidance for custodians.
Know where patient information lives
1. Make an inventory. Your EMR is the obvious place, but patient information also sits in scanned documents, email, the fax inbox, the front-desk desktop, USB drives and staff phones. You can't protect what you haven't listed.
Control who can get in
2. One person, one account. Shared logins at the front desk are fast, but they make it impossible to tell who opened a chart. Use individual accounts with fast user switching instead.
3. Multi-factor sign-in. Require a second factor for email and for any remote access to the EMR. Most account takeovers start with a stolen password, and a second factor blocks the large majority of those attempts.
4. Least access, and same-day offboarding. Give each role only what it needs, and remove access the day someone leaves, including locums and students.
Protect the devices
5. Encrypt laptops and phones. A stolen encrypted laptop is a lost device. An unencrypted one is a privacy breach. Manage phones that open clinic email so they can be wiped remotely.
6. Keep everything patched and supported. Windows 10 reached end of support on October 14, 2025. Computers still running it no longer get security fixes unless they're enrolled in extended updates. Replace or upgrade them.
7. Endpoint protection and email filtering. Modern endpoint detection and response watches for ransomware behaviour, not just known viruses. Email filtering stops most phishing before staff see it.
Keep records available
8. Backups you've tested. Keep encrypted, versioned backups, with at least one copy away from the clinic, and test a restore regularly. Know where your backup provider stores the data. Your regulatory college sets how long records must be kept (for physicians, see the CPSO's medical records policy).
9. Separate networks. Keep the waiting-room Wi-Fi and payment terminals off the network your EMR and workstations use.
Send and log information safely
10. Secure ways to send records. Use encrypted email or a secure portal for sending information to patients, specialists and labs. If you still fax, make sure faxes land somewhere that's access-controlled.
11. Review EMR audit logs. Your EMR records who opened which chart. Someone should look at those logs regularly, especially for staff viewing records of family, neighbours or public figures, a common cause of breaches reported to the IPC.
Plan for the bad day
12. Written agreements with your vendors. Your IT provider and EMR vendor can reach patient information, so they act on your behalf. Put confidentiality and security expectations in writing.
13. An incident plan and a breach log. PHIPA requires custodians to notify affected individuals at the first reasonable opportunity when information is stolen, lost, or used or disclosed without authority, and to notify the IPC in prescribed circumstances. Custodians also file an annual report with the IPC of the previous year's breach statistics. Keep a log of every incident as it happens, so the report is easy to complete.
14. Train your staff, and test them. Short regular training and simulated phishing emails teach staff to report a suspicious "lab results" email instead of clicking it.
Where to start
If this list feels long, start with multi-factor sign-in, encrypted laptops and a tested backup. Those three close the gaps behind most clinic incidents. Then work down the list over the following months. We go through this checklist with clinics on a free 15-minute call. You can read more about how we support clinics on our medical clinic IT page, or our dental office page.