Doctors' clinics
Keep patient records protected and your custody arrangements documented.
Free PDF, About 13 pages, 135 KB. No sign-up.
IP Mahir · Protect for Practices
Data privacy, delivered through IT management.
A governance, risk and compliance service for doctors' clinics in British Columbia.
Your brochure for doctors' clinics
Everything on this page in one PDF to read, share or print: known issues and the IT gaps behind them, the rules we could verify, how we help, how we start, and direct links to the pages relevant to your practice. About 13 pages, 135 KB.
Google Drive, AWS and other public clouds secure their platform. They do not set up, watch or take responsibility for your practice’s access, settings and legal exposure. Why
What you hold, and why it matters.
Medical clinics hold patient records in an EMR and on the workstations, printers and networks around it. Downtime stops patient care, and a breach harms patients.
What you protect
- Patient records and clinical notes
- Referrals, lab results and billing
- Records held with EMR and service providers
What has gone wrong, and the technology gap behind it.
Real incidents and warnings from regulators and the public record, each with the IT or data-privacy gap it exposes. We do not claim we would have prevented any of them.
Across Canadian businesses
2023
One in six Canadian businesses was hit
Statistics Canada found that 16% of Canadian businesses were affected by cyber security incidents in 2023. Of those, 50% reported scams and fraud, 31% identity theft and 13% ransomware.
The IT gap: Offices that depend on one or two unmanaged systems have few ways to notice or contain an incident.
Statistics Canada, Impact of cybercrime on Canadian businesses, 2023 (opens in a new tab)
October 2024
Ransomware is the top cybercrime threat
The Canadian Centre for Cyber Security ranks ransomware as the top cybercrime threat to Canadian organizations in its National Cyber Threat Assessment 2025-2026.
The IT gap: Untested backups and unpatched systems turn one bad click into days of downtime.
In your profession
June 2020
LifeLabs breach
A joint report by the BC and Ontario privacy commissioners found LifeLabs failed to take reasonable steps to safeguard personal health information. The breach affected about 8.6 million people, per the report.
The IT gap: Information held without the safeguards a regulator considers reasonable.
2016
Patient files stolen from a Vancouver office
About 4,000 patients’ medical files were stolen from an office on West Broadway.
The IT gap: Records kept in the office without protection against theft.
2019
Clinics are already in the regulator’s sights
The BC privacy commissioner chose medical clinics for a compliance review because they hold a large amount of sensitive personal information.
The IT gap: Large amounts of sensitive data in small offices, with few formal controls.
Why a shared drive or cloud host is not a data-security plan.
Google Drive and similar shared drives, and cloud hosting such as AWS, are useful tools. They are not, on their own, a data-security plan: the provider secures its platform, and your practice stays responsible for who can reach the files, how they are set up and where the law can reach them.
Hosting is not the same as securing your data
AWS’s own shared responsibility model says customers manage their data, including encryption options, classify their assets and use access tools to set permissions, and configure the firewall and security groups. AWS secures the platform; you secure what you put on it.
The privacy problem: A practice that “moves to AWS” without someone running these settings has bought hosting, not security.
One wrong storage setting can expose a whole record set
Security researchers have repeatedly found healthcare, billing and personal records sitting in publicly reachable Amazon S3 storage, including a medical billing vendor’s treatment notes and a senior-care ratings site’s files covering the US and Canada, left open with no password until researchers reported them.
The privacy problem: Data-privacy harm caused by a configuration gap, not by a hacker breaking in.
UpGuard on a misconfigured medical-billing bucket (opens in a new tab)
“Anyone with the link” stays open
Google Drive links set to “Anyone with the link” can be opened without signing in. Malwarebytes reported a Drive left open this way for about six years, exposing personal data of 935,779 people, and found that Google Search can index such documents once the link is discoverable. A 2023 scan by Metomic of about 6.5 million Drive files found 40.2% contained sensitive data.
The privacy problem: Convenience sharing that nobody reviews turns into permanent exposure.
Where the provider is based can matter more than where the data sits
Legal commentary on the US CLOUD Act notes that a US provider can be compelled to produce data it controls regardless of where in the world the data is stored, and that storing data in Canada does not by itself remove that exposure.
The privacy problem: Client confidences held by a US-based provider may be reachable by foreign legal process, which a practice rarely considers when it picks a tool.
Balsillie Papers, Whose Law Governs Canadian Data? (opens in a new tab)
Outsourcing storage brings obligations in BC
An IAPP summary notes that PIPA imposes notice and policy requirements when data storage is outsourced outside Canada. Regulators also expect you to ask: the Law Society of BC points lawyers to a Cloud Computing Checklist, and CPABC advises accountants to confirm that software and service providers meet the Code and privacy law.
The privacy problem: A practice that cannot show it asked these questions has no evidence of reasonable safeguards.
Our answer
Our answer is not “never use the cloud”. It is to keep your client data stored and managed in BC, give each person access by role, test your backups, approve every change before it reaches you, and use a cloud tool only where it fits, set up and watched by someone accountable.
The cloud tools doctors' clinics already use, and what happens when one fails.
Software-as-a-service tools only work when your internet link, router, power, devices, the vendor and the cloud region behind it all work at once. If one fails, the practice either keeps working or stops, and that depends on what is set up in your office.
Software-as-a-service in your profession
10,700+physicians use WELL Health’s OSCAR Pro, one of the three large EMR families used in BC (a national figure). The others are TELUS Health’s Med Access and QHR’s Accuro.Canadian Healthcare Network (opens in a new tab)
Examples of widely used products
- Med Access (TELUS Health)
- Accuro (QHR)
- OSCAR Pro (WELL Health)
Named as examples only, not an endorsement. Each runs only while your internet, your office network and the vendor are all up.
How far one failure can reach
Rogers outage, July 2022
More than 12 million customers lost wireless and wireline service for about a day. Small businesses were among the hardest hit and could not process debit card payments. A report for the CRTC attributed the outage to a router configuration error during a network upgrade.
Global News, on the CRTC-commissioned report (opens in a new tab)
AWS outage, October 2025
A DNS failure for a core database service in AWS’s US-East-1 region spread to many dependent services and took down popular apps worldwide, including Slack and Atlassian, for hours.
When the network or a vendor fails, your local setup decides what happens next.
The internet link drops
A second connection or a local fall-back lets staff keep working on the office network, print and reach local files while the line is fixed.
A vendor or cloud region goes down
A downtime plan and a local copy of today’s schedule and key records mean the practice does not depend on a single vendor being up.
The local network fails
A documented spare and a tested swap turn a dead switch into a short job, not a lost day.
The power goes
Battery backup and a clean shutdown protect the systems that hold your records.
Access breaks quietly
Monitoring catches an expired certificate, a bad DNS setting or a firewall change before staff and clients do.
Google Drive, AWS and other public clouds secure their platform. They do not set up, watch or take responsibility for your practice’s access, settings and legal exposure. Why
What the law and your regulator require, and how our service supports it.
Each requirement below is summarized in plain language with a link to the rule itself, next to the part of our service that supports it.
BC privacy law, for every private practice
BC PIPA, s. 4
Responsibility and reasonableness
What it requires: An organization is responsible for the personal information under its control, must designate someone responsible for compliance and make that person’s position title and contact details public, and must act as a reasonable person would consider appropriate in the circumstances.
How our service supports it: The privacy pack names the responsible person and the public contact line, and records your decisions. The quarterly evidence report shows what reasonable looked like each quarter.
Personal Information Protection Act (BC Laws) (opens in a new tab)
BC PIPA, s. 5
Policies and practices
What it requires: An organization must develop and follow policies and practices that meet its obligations, set up a way to handle complaints, and make that information available.
How our service supports it: The privacy pack gives you policy templates, a complaint process and a breach-response plan, reviewed each year.
Personal Information Protection Act (BC Laws) (opens in a new tab)
BC PIPA, s. 23
Requests for your own information
What it requires: A person may ask for their personal information and how it has been used or disclosed, and the organization must respond within the time limits.
How our service supports it: Records are organized by person or matter, with access logs, so you can find what you hold and show who saw it.
Personal Information Protection Act (BC Laws) (opens in a new tab)
BC PIPA, s. 34
Protecting personal information
What it requires: An organization must protect personal information in its custody or control with reasonable security arrangements against unauthorized access, collection, use, disclosure, copying, modification or disposal.
How our service supports it: Access by role, approved changes, monitoring, tested backups and recovery, and data stored and managed in BC are the core of the service.
Personal Information Protection Act (BC Laws) (opens in a new tab)
BC PIPA, s. 35
Keeping and destroying information
What it requires: Information used to make a decision about a person must be kept for at least a year afterwards. Once information is no longer needed for a legal or business purpose it must be destroyed or made anonymous.
How our service supports it: A retention schedule and secure disposal routine, including erasing retired devices, are part of the privacy pack.
Personal Information Protection Act (BC Laws) (opens in a new tab)
For doctors' clinics
CPSBC Medical Records Management practice standard
Security, custody and erasure
What it requires: The physician always remains responsible for security. Custody and long-term access arrangements with EMR providers belong in a formal contract, and electronic data must be erased so that it cannot be reconstructed.
How our service supports it: Documented custody and access arrangements, tested recovery, and secure erasure when devices or records are retired.
CPSBC Medical Records Management standard (opens in a new tab)
Doctors of BC Physician Privacy Toolkit
Putting PIPA into practice
What it requires: Doctors of BC publishes a toolkit for private practices, developed with the privacy commissioner’s office and the College, and a clinic IT security guide.
How our service supports it: We set up and run the controls the toolkit and guide describe, and keep the evidence.
Plain-language summaries of the rules, not legal advice and not the full wording. Read the section itself through the link, and ask your own advisor how it applies to you. Our service supports your obligations; it does not guarantee compliance.
Every statute, rule and ISO standard behind this service for doctors' clinics
Statutes and regulator rules are obligations your practice already has. ISO standards are frameworks our controls are mapped to; IP Mahir does not claim ISO certification.
Statutes
Personal Information Protection Act (BC), ss. 4, 5, 23, 34 and 35 (opens in a new tab)
Responsibility, written policies, access requests, reasonable security and retention.
Regulator rules
CPSBC Medical Records Management standard (opens in a new tab)
Security, custody and erasure of patient records.
ISO standards
ISO/IEC 27001, information security management systems (opens in a new tab)
The management-system frame for our governance, risk and evidence reporting.
ISO/IEC 27002, information security controls
The control set behind access, patching, monitoring and backup.
ISO/IEC 27701, privacy information management
The privacy extension behind our privacy pack and retention practice.
ISO/IEC 27017 and 27018, cloud security and personal data in public cloud
Guidance we use when reviewing Google Drive, AWS and other hosts.
ISO/IEC 27035, security incident management
The model for our breach-response plan.
ISO 22301, business continuity management
The model for tested recovery and outage planning.
Google Drive, AWS and other public clouds secure their platform. They do not set up, watch or take responsibility for your practice’s access, settings and legal exposure. Why
Set up around doctors' clinics.
We start from your regulator's expectations and your daily workflow.
For your practice
- Documented custody and access arrangements
- Controlled changes and tested recovery
- Secure erasure and retention practice
- A breach-response plan and quarterly evidence
Every practice receives
- Managed systems and updates. Every change is tested and approved before it reaches your practice.
- Access and identity. The right people see the right records, and access ends when staff leave.
- Monitoring and response. Problems are caught early, and incidents are contained and reported.
- Backup and recovery. Recovery is planned and tested, not assumed.
- Privacy pack. Policies, a breach-response plan and an annual review for your practice.
- Evidence reporting. A short quarterly report of what changed, what was found and what was fixed.
- Secure storage in BC. Client data stored and managed in British Columbia.
- Canada-based support. Support delivered by staff based in Canada.
- Step 1
Review
A short privacy and risk readiness review of your practice.
- Step 2
Plan
A clear plan and scope, in plain language.
- Step 3
Pilot
A trial on a few workstations, with your own software.
- Step 4
Run
Managed service begins, with quarterly evidence reports.
Take it away.
Each issue is quoted from the source shown, with its date. This page is a summary, not advice; the terms of any service are set out in a service agreement.
Other professions we serve.
- Accounting firmsProtect client financial records and the access you hold to their accounts.Known issues, rules and services
- Law officesProtect client confidences and the integrity of every file.Known issues, rules and services
- Dental and allied healthThe same patient-data protections, for dental, physiotherapy and other health practices.Known issues, rules and services
- Veterinary clinicsKeep the clinic running, and the client and patient records safe.Known issues, rules and services