Protect for Practices: for BC professional practices
Data privacy, delivered through IT management.
Governance, risk and compliance services for clinics, law offices, accounting firms, immigration practices and other professional practices in British Columbia’s Lower Mainland.
- Govern
- Manage risk
- Prove compliance
Privacy is enforced by the way your systems are run.
Most practices buy privacy and compliance guidance, managed IT and secure storage separately. We bring them together, so the controls that protect your clients’ information sit in your systems and not only in a policy binder.
Our approach is governance, risk and compliance: govern with clear ownership and written rules, manage risk by finding and reducing exposure, and prove compliance with evidence you can show when asked.
Led by Govind Preet Singh
A governance, risk and compliance professional with 20+ years across technology and law.
Support is delivered by staff based in Canada.
Infrastructure: METPL.Cloud
METPL.Cloud is IP Mahir’s infrastructure branch. It deals with data centres and edge infrastructure: the secure storage and computing that sit behind the service.
A section and a page for each kind of practice.
Each profession has its own section below and its own page, with the known issues and the IT gaps behind them, the obligations we could verify, and a brochure written for that profession.
Google Drive, AWS and other public clouds secure their platform. They do not set up, watch or take responsibility for your practice’s access, settings and legal exposure. Why
Accounting firms
Protect client financial records and the access you hold to their accounts.
Accounting and tax practices hold SINs, bank details, payroll and tax files, and often act for clients inside CRA and bank portals. Most are small offices with no in-house IT.
Brochure: About 13 pages, 135 KB.
A known issue
Stolen passwords opened tax accounts
The CRA said credential-stuffing attacks, using passwords stolen from other sites, compromised about 5,500 taxpayer accounts and 9,000 GC Key accounts. It paused My Account, My Business Account and Represent a Client.
The IT gap: Reused passwords and no second step on tax and bank logins.
What you protect
- Tax, payroll and bookkeeping records
- SINs, bank and account details
- Access to client accounts, such as CRA portals
Law offices
Protect client confidences and the integrity of every file.
Law offices hold the most confidential information their clients have, in documents, email and matter files. Many are small firms that rely on a handful of systems.
Brochure: About 13 pages, 135 KB.
A known issue
Fake payment directions cost two BC firms about $2 million
Two BC law firms lost about $2 million after emails that looked like they came from clients told them where to send funds.
The IT gap: Email accounts without a second login step, and no rule to confirm a payment change by phone.
What you protect
- Client confidences and matter files
- Contracts, evidence and correspondence
- Identity and financial documents
Doctors' clinics
Keep patient records protected and your custody arrangements documented.
Medical clinics hold patient records in an EMR and on the workstations, printers and networks around it. Downtime stops patient care, and a breach harms patients.
Brochure: About 13 pages, 135 KB.
A known issue
LifeLabs breach
A joint report by the BC and Ontario privacy commissioners found LifeLabs failed to take reasonable steps to safeguard personal health information. The breach affected about 8.6 million people, per the report.
The IT gap: Information held without the safeguards a regulator considers reasonable.
What you protect
- Patient records and clinical notes
- Referrals, lab results and billing
- Records held with EMR and service providers
Google Drive, AWS and other public clouds secure their platform. They do not set up, watch or take responsibility for your practice’s access, settings and legal exposure. Why
Dental and allied health
The same patient-data protections, for dental, physiotherapy and other health practices.
Dental, physiotherapy, chiropractic and other allied health practices hold patient records and billing information in small offices, often with several chairs or treatment rooms and a shared network.
Brochure: About 13 pages, 135 KB.
A known issue
A dental benefits administrator was hit by ransomware
A ransomware attack on Alberta Dental Service Corporation compromised the information of about 1.47 million Albertans. The corporation restored its systems from backups, and a payment was made as part of negotiations between its cyber insurer and forensic investigator.
The IT gap: Backups that are not tested and kept separate cannot save an office. Recovery depended on them.
What you protect
- Patient charts and treatment records
- Imaging, referrals and billing
- Insurance and payment details
Veterinary clinics
Keep the clinic running, and the client and patient records safe.
Veterinary clinics rely on practice-management software, diagnostics and imaging, and hold owner contact, payment and animal health records. Downtime hits appointments and lab work at once.
Brochure: About 13 pages, 135 KB.
A known issue
Ransomware disrupted hundreds of veterinary clinics
A Ryuk ransomware attack on National Veterinary Associates disrupted hundreds of clinics for several days and cut them off from patient information, payment processing and practice-management software.
The IT gap: Everything depends on one practice-management system and one network.
What you protect
- Owner contact and payment details
- Animal health records
- Diagnostic and imaging data
Immigration practices
Protect passports, IDs and application files, and the people who rely on them.
Immigration practices hold identity documents, family details and application files, and work through government portals. A single misdirected email or impersonation can harm a client.
Brochure: About 13 pages, 135 KB.
A known issue
Client details sent to the wrong people
The federal immigration department sent emails containing names, application numbers and client identifiers to the wrong recipients.
The IT gap: Recipients typed or auto-completed wrongly, with no check on who receives identity data.
What you protect
- Passports and identity documents
- Application files and family details
- Portal credentials and payment details
Google Drive, AWS and other public clouds secure their platform. They do not set up, watch or take responsibility for your practice’s access, settings and legal exposure. Why
Mortgage and real estate
Protect clients' identity and financial documents across brokerages and teams.
Mortgage brokerages and real estate brokerages collect identity, income and financial documents, and work across many agents and devices. They answer to BCFSA.
Brochure: About 13 pages, 135 KB.
A known issue
Trust accounts are targeted
The Real Estate Council of BC relayed a Law Society of BC warning: if a client’s payment instructions change just before trust funds are paid out, stop and verify thoroughly.
The IT gap: Payment changes accepted by email without a call-back to a number you already hold.
BCFSA alert: real estate trust accounts targeted (opens in a new tab)
What you protect
- Identity and income documents
- Credit and financial information
- Transaction files and contracts
Notaries public
Protect identity and property documents in a small office.
Notaries public in BC handle identity documents, property transfers and wills in small offices where one or two systems hold everything.
Brochure: About 13 pages, 135 KB.
A known issue
Title fraud attempts
The Land Title and Survey Authority of BC warned of title-fraud attempts, one of which succeeded, including a fraudster impersonating an owner.
The IT gap: Identity checks that rely on documents that can be forged or emailed.
What you protect
- Identity documents
- Property and transaction files
- Wills and signed originals
Why a shared drive or cloud host is not a data-security plan.
Google Drive and similar shared drives, and cloud hosting such as AWS, are useful tools. They are not, on their own, a data-security plan: the provider secures its platform, and your practice stays responsible for who can reach the files, how they are set up and where the law can reach them.
Hosting is not the same as securing your data
AWS’s own shared responsibility model says customers manage their data, including encryption options, classify their assets and use access tools to set permissions, and configure the firewall and security groups. AWS secures the platform; you secure what you put on it.
The privacy problem: A practice that “moves to AWS” without someone running these settings has bought hosting, not security.
One wrong storage setting can expose a whole record set
Security researchers have repeatedly found healthcare, billing and personal records sitting in publicly reachable Amazon S3 storage, including a medical billing vendor’s treatment notes and a senior-care ratings site’s files covering the US and Canada, left open with no password until researchers reported them.
The privacy problem: Data-privacy harm caused by a configuration gap, not by a hacker breaking in.
UpGuard on a misconfigured medical-billing bucket (opens in a new tab)
“Anyone with the link” stays open
Google Drive links set to “Anyone with the link” can be opened without signing in. Malwarebytes reported a Drive left open this way for about six years, exposing personal data of 935,779 people, and found that Google Search can index such documents once the link is discoverable. A 2023 scan by Metomic of about 6.5 million Drive files found 40.2% contained sensitive data.
The privacy problem: Convenience sharing that nobody reviews turns into permanent exposure.
Where the provider is based can matter more than where the data sits
Legal commentary on the US CLOUD Act notes that a US provider can be compelled to produce data it controls regardless of where in the world the data is stored, and that storing data in Canada does not by itself remove that exposure.
The privacy problem: Client confidences held by a US-based provider may be reachable by foreign legal process, which a practice rarely considers when it picks a tool.
Balsillie Papers, Whose Law Governs Canadian Data? (opens in a new tab)
Outsourcing storage brings obligations in BC
An IAPP summary notes that PIPA imposes notice and policy requirements when data storage is outsourced outside Canada. Regulators also expect you to ask: the Law Society of BC points lawyers to a Cloud Computing Checklist, and CPABC advises accountants to confirm that software and service providers meet the Code and privacy law.
The privacy problem: A practice that cannot show it asked these questions has no evidence of reasonable safeguards.
Our answer
Our answer is not “never use the cloud”. It is to keep your client data stored and managed in BC, give each person access by role, test your backups, approve every change before it reaches you, and use a cloud tool only where it fits, set up and watched by someone accountable.
The laws and ISO standards our service is built to support.
Statutes and regulator rules are the obligations your practice already has. ISO standards are the frameworks our controls are mapped to. Our service supports your compliance; it does not guarantee it, and IP Mahir does not claim ISO certification.
Statutes
Personal Information Protection Act (BC), ss. 4, 5, 23, 34 and 35 (opens in a new tab)
Responsibility, written policies, access requests, reasonable security and retention.
Applies to: every practice
Identity and transaction records that must be kept and kept safe.
Applies to: Mortgage and real estate, Notaries
Regulations
Code of Professional Conduct for CICC Licensees (SOR/2022-128), s. 28 (opens in a new tab)
Confidentiality and client records.
Applies to: Immigration
Real Estate Services Rules, Part 7 (ss. 90 to 92) (opens in a new tab)
Brokerage records and trust accounts.
Applies to: Mortgage and real estate
Regulator rules
Records, their security, technology competence and confidentiality.
Applies to: Law offices
CPABC Code of Professional Conduct, Rule 208, and CRA Represent a Client (opens in a new tab)
Client confidentiality and access to client tax accounts.
Applies to: Accounting
CPSBC Medical Records Management standard (opens in a new tab)
Security, custody and erasure of patient records.
Applies to: Doctors' clinics
College record-keeping standards (allied health) (opens in a new tab)
Keeping patient records.
Applies to: Dental and allied
CVBC Bylaws Part 4, Division 4.5, and the Medical Records Standard (opens in a new tab)
Veterinary medical records.
Applies to: Veterinary
ISO standards
ISO/IEC 27001, information security management systems (opens in a new tab)
The management-system frame for our governance, risk and evidence reporting.
Applies to: every practice
ISO/IEC 27002, information security controls
The control set behind access, patching, monitoring and backup.
Applies to: every practice
ISO/IEC 27701, privacy information management
The privacy extension behind our privacy pack and retention practice.
Applies to: every practice
ISO/IEC 27017 and 27018, cloud security and personal data in public cloud
Guidance we use when reviewing Google Drive, AWS and other hosts.
Applies to: every practice
ISO/IEC 27035, security incident management
The model for our breach-response plan.
Applies to: every practice
ISO 22301, business continuity management
The model for tested recovery and outage planning.
Applies to: every practice
Plain-language summaries, not legal advice. Each profession page shows the exact sections and how we support them.
One service, tailored to each practice.
Every practice receives the same core services. The review, the controls and the evidence are set up around your regulator, your software and your workflow.
Managed systems and updates
Every change is tested and approved before it reaches your practice.
Access and identity
The right people see the right records, and access ends when staff leave.
Monitoring and response
Problems are caught early, and incidents are contained and reported.
Backup and recovery
Recovery is planned and tested, not assumed.
Privacy pack
Policies, a breach-response plan and an annual review for your practice.
Evidence reporting
A short quarterly report of what changed, what was found and what was fixed.
Secure storage in BC
Client data stored and managed in British Columbia.
Canada-based support
Support delivered by staff based in Canada.
A low-risk first step.
We do not ask you to change everything at once. We learn your practice, show you what we find, and prove the approach on a small scale before you commit.
Review
A short privacy and risk readiness review of your practice.
Plan
A clear plan and scope, in plain language.
Pilot
A trial on a few workstations, with your own software.
Run
Managed service begins, with quarterly evidence reports.
Take it away.
One brochure for each profession. Pick yours.
Each issue on these pages links to its source, such as Statistics Canada (opens in a new tab) and the Canadian Centre for Cyber Security (opens in a new tab). Each issue is quoted from the source shown, with its date. This page is a summary, not advice; the terms of any service are set out in a service agreement.