We've run security assessments on enough Fraser Valley clinics now to stop being surprised. The same five gaps show up whether it's a two-chair dental office or a nine-provider multidisciplinary clinic. None of them are exotic. None of them require a six-figure security program to fix. They persist because nobody built the network with security in mind in the first place — it grew, one workstation and one "just get it working" decision at a time.
Here's what we find, in the order we usually find it.
1. One flat network for everything
The front-desk PC, the workstation running your EMR, and the guest on your Wi-Fi checking email are often all on the same network, able to see each other. If any one device gets compromised — and the easiest way in is still a phishing email opened at the front desk — the attacker isn't contained to that machine. They can see everything else on the wire.
The fix is VLAN segmentation: clinical systems on one segment, admin workstations on another, guest Wi-Fi walled off entirely, and firewall rules that only allow the traffic that actually needs to cross between them. For a typical clinic network, this is a half-day to full-day project on hardware you likely already own — most business-grade firewalls and switches support VLANs, they're just never turned on. Budget $800–$2,000 if you need a consultant to design and implement it properly.
2. Shared logins
"Front Desk" is not a user account, it's a liability. When three people share one login, you lose the ability to know who did what — which matters when "what" is a patient record that got accessed or a file that got deleted. It also means when someone leaves the practice, you either reset a password everyone else uses too, or you don't bother, and a former employee's access just stays valid.
Individual accounts for every staff member, tied to your EMR's actual audit log, is not optional under PIPEDA's accountability principle — you need to be able to say who accessed what. Setup cost is close to zero; it's a policy and configuration change, not a hardware purchase. The friction is usually "but it's slower to log in separately," which is real but small next to the alternative.
3. No multi-factor authentication
Verizon's healthcare breach data consistently shows the large majority of web-application breaches in the sector trace back to stolen or guessed credentials. MFA is the single highest-leverage control against that — it stops a stolen password from being enough on its own. We still walk into clinics where email, EMR access, and remote desktop are all protected by password alone.
Most EMR platforms and Microsoft 365/Google Workspace already include MFA in the license you're paying for. Turning it on is typically a same-day project. The cost is almost entirely the disruption of asking staff to set up an authenticator app — plan for a short training session, not a budget line.
4. Backups that have never been tested
Nearly every clinic we assess has "backups" in the sense that something is scheduled to run overnight. Far fewer have ever actually restored from one. A backup job that reports "success" can still be backing up a corrupted database, missing the folder that matters, or producing a file nobody can actually restore under pressure. Ransomware operators know this too — a meaningful share of attacks now specifically target backup systems before triggering encryption, because a working backup is the one thing that lets you refuse to pay.
Fixing this means a documented, tested restore at least twice a year, off-site or immutable backup storage that ransomware on your main network can't reach or delete, and a written recovery time objective — how many hours of downtime can the clinic actually tolerate. Expect $150–$400/month for backup infrastructure sized for a small clinic, plus the time to run and document a real test restore.
5. The firewall on factory defaults
The firewall is often the single most important piece of security hardware on the network, and the one least likely to have ever been configured. Default admin credentials never changed, default rules left wide open, firmware that hasn't been updated since installation — we see this constantly on hardware that's otherwise perfectly capable of doing its job properly.
This is usually a 1–2 hour remediation once someone actually logs in and looks: change defaults, apply current firmware, tighten rules to what the clinic actually needs, enable logging. There's rarely a hardware cost attached — the box you have is fine. What's missing is someone treating it as more than a box you plug the internet into.
What this actually costs
Fixed together, as one project rather than five separate fire drills, these five gaps typically run $2,500–$5,000 in one-time work for a clinic of 5–15 workstations, plus modest ongoing costs for MFA licensing (often already included) and tested backup storage. Compare that to the cost of explaining a breach to your patients, or to BC's Office of the Information and Privacy Commissioner.