Most clinic owners have read the word "PIPEDA" in an association newsletter, nodded, and moved on. That's a problem, because PIPEDA — and in BC, technically PIPA, the provincial law it mirrors, which applies to most private-sector clinics operating entirely within the province — doesn't actually tell you what to buy or configure. It tells you to use "reasonable safeguards." Everything below is what that phrase turns into once you sit down with your network.
One note before the list: if your clinic is BC-only, PIPA (BC) is the law that technically governs you, not PIPEDA. In practice the two are close to identical and most IT and legal guidance uses "PIPEDA" as shorthand for both. We'll do the same here — the controls are the same either way.
Individual logins, not shared ones
"Reasonable safeguards" starts with knowing who touched what. A front-desk login shared across three staff members fails this immediately — not because it's insecure in the abstract, but because if a record is accessed inappropriately, you have no way to show who did it. Every person who touches patient data needs their own account. When someone leaves, that account gets disabled the same day, not "whenever we get to it." If you can't currently produce a list of who has access to your EMR and when that list was last reviewed, that's the actual gap, not a hypothetical one.
Access that matches the job, not convenience
Your optician doesn't need administrator rights on the practice management system. Your bookkeeper doesn't need access to clinical notes. Role-based access — where permissions are set by job function and reviewed periodically, not granted once and forgotten — is the second concrete control. This is usually a half-day project: map roles, map current permissions, close the gap.
Network segmentation
A flat network, where the guest Wi-Fi, the reception PC, and the server holding patient records all sit on the same subnet, is one of the most common findings we see. It's also one of the cheapest to fix. Segmentation means your clinical systems sit behind their own VLAN, guest and IoT devices (smart TVs, printers) sit on another, and a compromise on one doesn't hand an attacker a path to the other. Most business-grade firewalls already support this — it's a configuration change, not a purchase.
Encryption, where it actually matters
Encryption at rest on any device that leaves the building — laptops, backup drives, anything a staff member could plausibly lose in a car — is close to non-negotiable. Encryption in transit (your EMR connection, remote access, email containing patient information) is the same. Whether encryption is "required" technically depends on your risk assessment, but in practice, for a clinic handling health records, the answer is close enough to "always" that it's not worth treating as optional.
Retention that matches your college's rules, not your server's default
PIPEDA doesn't set retention periods for clinical records — your regulatory college does (commonly 7–16 years depending on province and patient age at time of record). What PIPEDA does require is that you actually have a retention and secure-disposal policy, and that your systems enforce it rather than quietly keeping everything forever because deleting things feels risky. An old server full of a decade of un-triaged backups is itself a liability — it's more data to lose in a breach, for no operational benefit.
Breach response, before you need it
This is the piece most clinics skip entirely. If a breach creates a "real risk of significant harm" — based on the sensitivity of the data and the likelihood of misuse — you're required to notify affected individuals and the Privacy Commissioner as soon as feasible. But the less obvious requirement: you must keep a written record of every breach, even the ones that don't meet that threshold, for a minimum of two years. A lost laptop that turned out to be encrypted still gets logged. Most clinics have no template for this until the moment they need one, which is the worst possible time to build it.
Where to actually start
If you do nothing else this quarter: eliminate shared logins, turn on MFA for anything touching patient data, confirm your backups are encrypted, and start a breach log — even an empty one, ready to use. That covers a large share of what an auditor or the OPC would actually ask to see, and none of it requires new hardware.
Want a straight answer on where your clinic actually stands? That's a working session against your real systems, not a generic checklist — get in touch and we'll tell you what's solid and what isn't.