Industries · Clinics
IT for medical, dental and allied-health clinics
A booking system that will not open at eight in the morning costs you the day's schedule, and the schedule does not come back. We keep clinics across Greater Vancouver and the Fraser Valley running through clinic hours, with patient information protected to the standard BC's privacy law actually sets.
IT priorities
- A unique account for every person, with multi-factor authentication on email and remote access
- Role-based access to records on a need-to-know basis, with audit trails turned on
- Backups of records and images that have been restored in a test, not just reported as successful
- A written downtime procedure so reception can keep seeing patients when a system is out
- Offboarding that removes access the day someone leaves, locums and students included
- A network and workstations quick enough that imaging and charting never hold up the operatory
Overview
Technology for medical and dental clinics
A clinic runs on a short list of systems that all have to be up while patients are in the building: practice management and electronic medical or dental records, imaging and charting workstations in the operatories and exam rooms, an appointment and reminder system, a payment terminal at reception, and connections out to labs, imaging providers and referring practices. Medical practices add MSP claim submission through Teleplan, which has its own semi-monthly close-off dates to work around.
The rules that apply are not the ones most people assume. A private clinic in BC is governed by the Personal Information Protection Act, the private-sector law — not the public-sector legislation that binds health authorities. PIPA requires reasonable security arrangements to protect the personal information in your custody or control. The BC Physician Privacy Toolkit, published jointly by Doctors of BC, the College of Physicians and Surgeons of BC and the Information and Privacy Commissioner, translates that into clinic practice: a named privacy officer, unique accounts, role-based access, audit trails, current encryption, and backups that are periodically reviewed and tested.
It is worth knowing how the Commissioner sees the sector. Its compliance review of BC medical clinics found gaps in clinics' privacy management programs, and noted that health care delivered by physicians, clinics and labs accounts for more of its complaint and breach files than any other group of private organizations. We support clinics remotely first — which is how a chairside workstation gets fixed between patients — and on site across the region when there is hardware to touch.
Scope
What we look after
What we keep running
- Practice management and electronic medical or dental records
- Imaging and charting workstations, and the sensors and cameras attached to them
- Appointment booking, reminders and recall
- Payment terminals and the network segment they sit on
- Lab, imaging and referral connections, and MSP claim submission
The clinic network and devices
- Wired and wireless coverage that actually reaches every operatory and exam room
- A guest network for patients that cannot see clinical systems
- Reception screens positioned and filtered so they cannot be read from the waiting room
- Automatic sign-out on inactivity at shared reception and chairside stations
- Encrypted laptops and tablets for after-hours charting and virtual visits
Privacy and continuity
- A unique account for every person, with access granted on a need-to-know basis
- Audit trails recording who opened a chart, and when
- Access revoked the day someone leaves, including locums, temps and students
- Backups of records and images, with restores tested rather than assumed
- A written procedure for the morning the booking system is unreachable
Pressures
What makes IT different for medical and dental clinics
Downtime is measured in appointments
A records or booking system that is unavailable at the start of the day does not merely delay work — the appointments are gone and the room sits empty. Clinic hours are the constraint everything else gets planned around.
Patient privacy under PIPA
PIPA requires reasonable security arrangements to protect personal information in your custody or control. The Physician Privacy Toolkit is explicit that reasonable is not a standard of perfection, but that the sensitivity of personal health information demands a very high level of rigour.
Devices in the wrong places
Screens at reception face the waiting room. Operatory workstations get touched with gloves on and left signed in between patients. Screens turned away from public view, automatic sign-out, unique logins and no shared passwords are the published advice — and all of it is configuration work, not a poster in the staff room.
Turnover, and the shared login that follows it
Reception, hygiene, assisting and locum roles change often, and a shared account always looks like the quick fix. It defeats the audit trail and makes it impossible to answer the one question that matters after an incident: who opened this chart?
Records outlive the visit
Charts, images and correspondence have to stay readable and retrievable long after the appointment, and your regulatory college sets the requirements for how long. That makes it a backup, migration and file-format question as much as a storage one — particularly when a practice changes software or an owner retires.
Knowing where the data lives
Storing or accessing patient information outside Canada is permitted under PIPA, unlike the public-sector rules that bind health authorities. It is still a question you should be able to answer about every system you run, including booking, reminders and virtual care.
Priorities
Where we start
- A unique account for every person, with multi-factor authentication on email and remote access
- Role-based access to records on a need-to-know basis, with audit trails turned on
- Backups of records and images that have been restored in a test, not just reported as successful
- A written downtime procedure so reception can keep seeing patients when a system is out
- Offboarding that removes access the day someone leaves, locums and students included
- A network and workstations quick enough that imaging and charting never hold up the operatory
Other sectors
We also support
Every sector is supported across Greater Vancouver and the Fraser Valley.
FAQ
IT for medical and dental clinics: questions
Which privacy law applies to a private clinic in BC?
BC's Personal Information Protection Act. It governs private-sector organizations, including private medical, dental and allied-health practices, and requires you to protect the personal information in your custody or control with reasonable security arrangements. The public-sector law that binds health authorities does not apply to you. The BC Physician Privacy Toolkit, published with the Information and Privacy Commissioner, is the practical guide to meeting it.
Do patient records have to stay in Canada?
Not under PIPA. Storing or accessing personal information outside Canada is permitted for private clinics — the requirement to keep data in Canada applies to health authorities under the public-sector law, not to you. You should still know where each system puts your data, including booking, reminders and virtual care, and be able to tell a patient who asks.
What happens when the booking system goes down?
You need an answer that does not depend on the system being up. In practice that means an offline copy of the day's schedule, a phone that still works, a written procedure reception can follow without being coached through it, and a support path that gets someone on the problem immediately. Our backup and disaster recovery guide covers the planning side, and managed IT services covers the support side.
Can you support our EMR or dental software?
Yes, in the way that matters. We look after the workstations, servers, network, permissions, backups and updates the software depends on, and we coordinate with the vendor's support when the application itself is at fault. Version upgrades get scheduled outside clinic hours. The network and server work behind a busy operatory is usually where the real gains are.
What should we do if we suspect a privacy breach?
Contain it, work out what was exposed and how sensitive it was, decide who needs to be told, then fix the cause. PIPA does not currently require private organizations to report breaches to the Information and Privacy Commissioner, but the Commissioner publishes a breach checklist and a reporting form, and the Physician Privacy Toolkit suggests deciding whether to report within about two days.
Services
Services for medical and dental clinics
Managed IT Services
Help desk, device and Microsoft 365 management, security and backups — your outsourced IT department under one agreement.
Learn more->Cybersecurity
Security assessments, MFA, endpoint protection, email security, backups and staff training — the controls that stop common attacks.
Learn more->Networks & Servers
Wi-Fi, firewalls, switches, cabling, VPNs and servers — designed, installed, documented and supported.
Learn more->
Guides
Guides for business owners
[Security]
Cybersecurity Checklist for Small Businesses in BC
A cybersecurity checklist for BC small businesses built on the Canadian Centre for Cyber Security’s baseline controls, plus what to do after a breach.
[Security]
Backup and Disaster Recovery for Small Business
Backup, retention and disaster recovery for BC small businesses: the 3-2-1 rule, what cloud suites don’t cover, RPO, RTO and restore testing.
[Costs]
How Much Do Managed IT Services Cost in Vancouver?
What managed IT services cost in Canada: pricing models, what's included, published Canadian rates, a 15-person Vancouver office budget and how to compare quotes.
Get in touch
Talk to us about IT for your clinic
Tell us about your business and what you need from technology. We reply within one business day.
Tell us what's going on
Send the form or call. A rough idea of your team size and current setup helps us come prepared.
A 30-minute conversation
We ask about your people, systems and goals, and flag anything urgent we notice along the way.
A written proposal
Clear scope, a plain-English plan and pricing laid out line by line. Nothing starts until you approve it.