Managed IT Services for Healthcare & Dental Clinics

IT Rapid Support is a managed IT, cybersecurity and digital forensics firm founded in 2018, headquartered at 7810 Keele Street in Concord (Vaughan), Ontario, with a second office in Vancouver. For clinics it supports the workstations, accounts, network, email and backups around the EMR, and works with the EMR vendor on the application itself. It carries $2 million in cyber liability insurance and answers a 24/7 helpdesk and incident line at (289) 582-9930.

Under PHIPA the clinic or practitioner remains the health information custodian and stays responsible for its agents, including its IT provider. Our job is to make the reasonable safeguards real and to keep the logs that let you say, after an incident, exactly what was accessed.

Under Ontario's Personal Health Information Protection Act (PHIPA), the clinic or practitioner is usually the health information custodian. The custodian must take reasonable steps to protect personal health information against theft, loss and unauthorized use or disclosure, and remains responsible for IT providers and other agents acting on its behalf.

In practice that means knowing who can open which records, being able to show it, and having agreements in place with the vendors who host or support your systems. This page is practical guidance, not legal advice; confirm how the law applies to your organization with counsel.

If personal health information is stolen, lost, or used or disclosed without authority, PHIPA requires the custodian to notify the affected individuals at the first reasonable opportunity. In circumstances set out in the regulations, the custodian must also report to the Information and Privacy Commissioner of Ontario, and custodians file annual breach statistics with the IPC.

You can only notify accurately if you can tell what was accessed. That depends on audit logs in the EMR and in Microsoft 365 being switched on and kept. Check that before you need it (Microsoft 365 audit log).

Most clinics now use a cloud-hosted EMR, where the vendor runs the servers and the clinic's job is access: individual logins, multi-factor sign-in, devices that lock and encrypt, and removing accounts when staff leave. Some still run an EMR on a local server, where the clinic also owns patching, backups and physical security of that server.

Whichever you have, ask the vendor where data is stored, how it is backed up, how you get your data out if you leave, and what audit logs they keep. For a local server, restore-test the backup on a schedule and keep a copy off site.

Phished Microsoft 365 passwords used to read referral email; fax-to-email inboxes that nobody monitors; shared front-desk logins; and fake invoices from "suppliers". Multi-factor sign-in on every account, named logins at the front desk, a short screen lock, and a callback rule for payment changes stop most of it.

Our identity and device case study started with reconstructing a mailbox compromise minute by minute, then moved to central identity and device management. The same order of work suits a clinic: find out what happened, then make it hard to repeat.

If patient information may have been exposed, see privacy breach assessment and notification.

Hospital partners and cyber insurers ask about multi-factor sign-in, encryption, backups, audit logging and incident response. Answer from what is configured, in writing. Before you talk to any provider, test your domain with our email spoofing check and work through the printable IT risk self-check.

If you only do four things this month, do these, in this order. Each is cheap and each closes a gap we see often in this sector.

1. 01

   1.

   Replace shared front-desk logins with named accounts and multi-factor sign-in.

2. 02

   2.

   Confirm audit logging is on in the EMR and Microsoft 365, and how long it is kept.

3. 03

   3.

   Ask your EMR vendor the four hosting questions above and keep the answers on file.

4. 04

   4.

   Write down who you would call and what you would do in the first hour of a breach.

Section 12(2) of PHIPA requires a custodian whose personal health information is stolen, lost, or used or disclosed without authority to notify the individual at the first reasonable opportunity, and to tell them they may complain to the Information and Privacy Commissioner. Section 12(3) adds notice to the Commissioner when the circumstances meet requirements set in the regulation.

Section 6.3 of Ontario Regulation 329/04 lists those circumstances. They include reasonable grounds to believe information was stolen; that it was used or disclosed without authority by someone who knew or ought to have known they had no authority; that it was or will be further used or disclosed after an initial breach; that the breach is part of a pattern; that it must be reported to a College; and that the breach is significant, judged by factors such as the sensitivity and volume of the information and the number of people affected. Section 6.4 requires every custodian to send the Commissioner an annual report, on or before March 1, counting the previous calendar year's thefts, losses and unauthorized uses and disclosures.

Each of those questions turns on facts an IT provider can supply or lose: which mailbox was accessed, from where, for how long, and which records were opened. That is why we switch on and retain audit logging in Microsoft 365 and ask the EMR vendor what it keeps. Whether a given incident meets a threshold is the custodian's decision with its own advisors; confirm with counsel and the IPC's guidance.

In IT Rapid Support's October 31, 2026 re-scan of a fixed panel of Greater Toronto Area business domains, 11.1% of the 54 healthcare domains (medical, dental and veterinary) enforced DMARC, down from 13.0% in August 2026 and the lowest of the sectors we measured. Only 38.9% published a DMARC record at all.

For a clinic that means most patients and referral partners have no protection against email that forges the clinic's name, for example a message asking a patient to "update" their health card details or pay an invoice. The panel, method and limits are published under CC BY 4.0 in the Q4 2026 GTA email security study.