PIPEDA & BC PIPA: IT Security Checklist for Dental and Medical Clinics
Short answer: private dental and medical clinics in British Columbia are covered by BC’s Personal Information Protection Act (PIPA), which requires “reasonable security arrangements” to protect patient information. For health records, the Office of the Information and Privacy Commissioner for BC (OIPC) expects a high standard: encryption, unique logins, access controls, tested backups, secure disposal and staff training.1 This checklist turns those expectations into practical IT steps for your clinic.
This article is general information, not legal advice. For your specific obligations, speak with a privacy lawyer or your professional college.
PIPA or PIPEDA: which privacy law applies to my BC clinic?
For most private clinics in BC, the answer is BC PIPA. PIPA governs private-sector organizations in British Columbia, and the federal PIPEDA does not apply to their activities inside the province.1 PIPEDA can still matter when personal information is disclosed across provincial or national borders for commercial purposes. Health authorities and other public bodies fall under a different law, BC’s Freedom of Information and Protection of Privacy Act (FIPPA).
The practical point is the same under both laws: you are responsible for protecting patient information with safeguards that match how sensitive it is. Health information is among the most sensitive data there is, so the bar is high.
What does “reasonable security” mean for a clinic?
The OIPC’s physician privacy toolkit notes that what is reasonable “may signify a very high level of rigour depending on the situation.”1 In practice, that means layered protection: technical controls (IT), administrative controls (policies and training) and physical controls (locks and access).
The clinic IT security checklist
| Area | What to have in place | Done? |
|---|---|---|
| Logins | A unique user ID for every staff member (no shared front-desk logins) and strong passwords | ☐ |
| Multi-factor authentication | MFA on email, Microsoft 365, remote access and your practice-management or EMR system | ☐ |
| Access control | Role-based access so staff only see the records they need for their job | ☐ |
| Encryption | Full-disk encryption on laptops, desktops and USB drives; encrypted Wi-Fi; encrypted email for sending records | ☐ |
| Screen locking | Automatic lock or log-out after inactivity on every workstation, especially in exam rooms and at reception | ☐ |
| Firewall and updates | A business firewall, kept up to date, plus automatic patching of Windows, macOS and clinic software | ☐ |
| Endpoint protection | Managed antivirus or EDR on every computer and server | ☐ |
| Audit trails | Logging of who accessed patient records and when (usually a feature of your EMR) | ☐ |
| Backups | Automatic, encrypted backups stored off-site, with restores tested regularly | ☐ |
| Disaster recovery | A written plan for how the clinic keeps running if a server fails or ransomware strikes | ☐ |
| Secure disposal | Wiping or destroying drives from old computers, copiers and phones, not just deleting files | ☐ |
| Vendors | Contracts with IT, software and cloud vendors that cover privacy, security and breach notification | ☐ |
| Data location | Knowing where patient data is stored, and assessing the risk before it is stored or processed outside Canada | ☐ |
| Staff training | Regular privacy and phishing-awareness training, with a record of who completed it | ☐ |
| Breach response | A documented plan for containing a privacy breach and deciding who must be notified | ☐ |
1. Lock down logins and access
Shared logins are a common problem in busy clinics. When everyone at reception uses the same account, you cannot tell who opened a record, and one leaked password exposes everything. Give every person their own account, turn on multi-factor authentication, and set up role-based access so a receptionist, a hygienist and a physician each see only what they need.
2. Encrypt every device that holds patient data
A lost or stolen laptop is only a minor incident if its drive is encrypted. The OIPC toolkit calls for strong, up-to-date, industry-standard encryption for electronic records and portable devices.1 Turn on BitLocker (Windows) or FileVault (macOS), avoid unencrypted USB drives, and use secure, encrypted email or a patient portal when sending records.
3. Keep systems patched and protected
Phishing emails and unpatched software are two of the most common ways ransomware gets into a business. A managed firewall, automatic updates and endpoint protection on every computer close the most common doors. Our endpoint protection and email security services are built for exactly this.
4. Back up, and test your restores
Backups only count if you can restore from them. Keep encrypted copies off-site or in the cloud, include Microsoft 365 data, and test a restore on a schedule. The OIPC toolkit specifically mentions verified backup methods and periodically tested disaster recovery procedures.1 See our cloud backup and disaster recovery pages for how this works.
5. Manage your vendors
You stay responsible for patient information even when a vendor handles it. The OIPC says organizations cannot hand off their obligations to contractors, and vendors should be contractually required to protect the data and report incidents.2 Review contracts with your EMR provider, IT company, cloud storage and any AI tools such as AI scribes. Before patient data is stored or processed outside Canada, assess the risks.2
6. Train your team
Technology cannot stop an employee from clicking a convincing phishing link. Short, regular training sessions, simulated phishing emails and a clear way to report suspicious messages make a measurable difference. Keep a record of training for your privacy file.
7. Plan for a breach before it happens
Write down what happens if a laptop is stolen, an email goes to the wrong patient or ransomware locks your files: who investigates, how the problem is contained, and how you decide whether patients or the OIPC need to be notified. Check the current notification requirements with the OIPC or your legal advisor.
Frequently asked questions
Does my clinic need to follow PIPEDA or PIPA?
Most private clinics in BC follow PIPA. PIPEDA can apply when personal information crosses provincial or national borders for commercial purposes. If you are unsure, ask your privacy officer or legal advisor.
Is Microsoft 365 safe for patient information?
It can be, when it is configured properly: MFA for every user, encryption, data-loss prevention policies, retention rules and restricted sharing. The default settings are not enough on their own.
How often should we test our backups?
At least quarterly, and after any major change to your systems. Test restoring a whole computer or server, not just a single file.
Do we need a privacy officer?
Yes. PIPA requires organizations to designate someone responsible for compliance. In small clinics this is often the practice owner or office manager.
Get a free clinic IT security review
Insmart Technology provides IT services for clinics and healthcare providers in Surrey and across the Lower Mainland. We will review your logins, devices, backups, Microsoft 365 and network against this checklist and give you a clear, prioritized action plan. Book your free IT assessment or call (604) 449-2327.
1 Office of the Information and Privacy Commissioner for BC, BC Physician Privacy Toolkit.
2 OIPC BC, PIPA and AI scribes: best practices for healthcare.
About the author: Naqash Bin Iqbal is an SEO Specialist at Insmart Technology, a Surrey-based managed IT and cybersecurity provider.
