Fill the chairs. Then keep what filling them created.
Dental, medical, physiotherapy, optometry, mental health. Single site or several. Every patient you add is a record you become accountable for — and under PHIPA that accountability does not transfer to your software vendor or your IT provider.
We work on both halves under one relationship, sized for a clinic rather than a hospital, with a specialist security bench behind it.
Grow
- Local search and maps where patients actually look first
- Reviews and recall, systematized rather than left to chance
- Booking that completes on a phone
- Measurement so you know what each patient cost
Protect
- Managed IT and endpoints using ESET or Sophos
- Detection and response, up to fully managed
- Testing and incident readiness with Zeplynx
- Evidence for insurers, funders and auditors
Where accountability actually sits
A common misunderstanding, and an expensive one.
Accountability flows one way. A contract moves the work down the chain. It does not move the responsibility, and a regulator will come to level one.
Where practices actually get hurt
Not the scenarios that make headlines. These are the five we encounter repeatedly in clinics across Ontario, ordered by how often they produce a genuinely bad week.
A supplier invoice with altered banking details
Dental and medical practices run on a long tail of suppliers: labs, equipment, software, consumables, maintenance. Volume rises with growth, and nobody adds a second pair of eyes to payments.
The invoice is usually genuine. Someone has compromised the supplier’s mailbox, intercepted a real invoice, changed one field and resent it. Everything matches except the account number.
Ransomware reaching the practice management database
Clinics cannot operate without their schedule and their charts. Unlike most businesses, a practice losing access to records loses the ability to deliver care safely, not merely the ability to invoice.
Current ransomware copies data out before encrypting it, so a clinic faces both an operational outage and a probable privacy breach with notification duties attached.
Equipment no longer receiving security updates
Imaging workstations, the machine attached to a sensor, the reception computer running software the vendor retired. All functioning perfectly, none receiving patches.
Clinical equipment is the hardest category, because replacing a workstation often means revalidating the device attached to it. Isolation is frequently the right answer rather than replacement, and almost nobody is told so.
Vendor and remote-support access nobody reviews
Your software vendor has remote access. So, frequently, does the previous IT provider, the imaging supplier and a consultant engaged in 2021. Each is an agent under PHIPA, and each represents a route into records.
Most practices have never produced a list of who holds standing access. Building one takes an afternoon and routinely surprises the owner.
AI features switched on inside tools you already use
Note-takers joining meetings, assistants summarizing mailboxes, transcription arriving in an update nobody read. Each is a disclosure of personal health information if clinical content passes through it.
“We do not use AI” is often untrue by the time it is said, because the features arrived switched on inside existing subscriptions.
The half of this nobody connects to the other
Everything above describes risk. Risk is not the reason a practice calls us — growth usually is, and the two arrive together whether or not anyone plans for it.
A clinic filling its chairs is simultaneously increasing the number of records it holds, the staff with access to them, the suppliers it pays, and the systems nobody has reviewed since the practice was half the size.
Read it this way: a practice doubling its patient list has doubled the records it is accountable for, roughly doubled its supplier payments, and added staff who each need an account. Growth did not create the exposure. Growth multiplied it — and nobody pauses a practice while it is working.
Grow
How patients actually find a clinic now
- Maps and local search before anything else. A complete, accurate Google Business Profile outperforms most website work for a single-site practice, and it is routinely half-finished.
- Reviews decide the shortlist. Patients compare three clinics and choose on recency and volume of reviews. A systematic post-appointment request changes this faster than any advertising.
- AI assistants are becoming the first question. When someone asks for a recommendation, the answer is assembled from sources a model can find. A thinly documented practice is not losing the comparison; it was never a candidate.
- Recall is the cheapest growth available. Existing patients who have lapsed cost far less to return than new patients cost to acquire, and most practices have no system for it.
- Referral dependency is concentration risk. A practice growing entirely on word of mouth owns no channel it can switch on when the referrals thin.
Protect
What each of those adds to your exposure
- More patients, more records. Every acquisition channel increases the volume of personal health information you are accountable for as custodian.
- More staff, more accounts. Hiring at pace means accounts created quickly and removed slowly, and offboarding is where access quietly accumulates.
- More suppliers, more payments. Growth multiplies invoices, and invoice fraud scales with the number of payment relationships rather than with revenue.
- A larger public footprint. Being easier for patients to find also means being easier for an attacker to research: staff names, roles, email format and suppliers.
- Systems sized for the old practice. The equipment, backups and recovery plan were chosen when the clinic was smaller, and almost nobody revisits them while it is busy.
What we actually do for a clinic
Both halves, under one relationship. Most practices begin on whichever side is hurting, then close the other once they can see the gap between them.
Local visibility
Where a single-site practice gets the most return, and the most commonly left half-finished.
- Google Business Profile built out properly
- Local search and map presence
- Service pages written for how patients actually search
- Structured data so assistants can quote you accurately
Website & booking
A site measured on booked appointments rather than on appearance.
- Fast, accessible, works properly on a phone
- Online booking or request flow that completes
- Conversion tracking installed and verified
- Built so your team can maintain it
Reviews & recall
The two levers with the shortest path to revenue, and the two most often left to chance.
- Post-appointment review requests, systematized
- Reactivation of lapsed patients
- Reputation monitoring and response
- Patient communication that is not an afterthought
Measurement
So you can answer how patients found you, and what each one cost to acquire.
- Conversion tracking that actually fires
- Call and enquiry attribution
- Reporting a practice owner can read
- Honest reporting on what is not working
Managed IT & protection
The day-to-day layer. Endpoint protection deployed and monitored using ESET or Sophos, with patching, device management and recurring review.
- Security posture review
- Microsoft 365 or Google Workspace configuration review
- Endpoint protection and patch oversight
- Recurring reporting and guidance
Detection & response
EDR, XDR and fully managed detection. The distinction worth understanding is who answers the alert — detection without response is an alarm in an empty building.
- Behavioural monitoring on workstations and servers
- Correlation across endpoint, email and identity
- Managed option with analyst triage and escalation
- Response authority agreed in writing beforehand
Security testing
Delivered with our specialist bench. A scan lists what might be wrong; a test proves what is.
- Vulnerability assessment
- Network and web application penetration testing
- Physical testing, including front-desk procedure
- Red and purple team for higher-risk environments
Advisory & readiness
The documentation a custodian is expected to hold, and the plan nobody writes until the week after they needed it.
- Incident response planning and tabletop exercises
- Safeguards documentation and privacy impact support
- Evidence packs for insurers and auditors
- Staff awareness sessions
Why both sit with one provider. A practice growing its patient list and a practice managing its exposure are the same practice, and the decisions interact. More patients means more records. A new location means new accounts. A booking system means a new integration holding personal health information.
Handled separately, each side optimizes for itself and the gap widens between them. That gap is the thing we are actually hired to close.
On the specialist work. Penetration testing, red team engagements and incident response are delivered alongside our security partner Zeplynx. You keep one relationship and one point of contact, with a specialist bench behind it. Nothing is tested, changed or monitored without your written approval of the scope.
How an engagement begins
Five steps, and nothing is monitored, tested or altered before step four is signed.
Discovery
What is actually concerning you, and what outcome you want.
Environment review
Users, devices, servers, locations, cloud services and existing tools.
Direction
The tier or project matching your real environment, not a template.
Scope confirmed
Coverage, authority, escalation contacts and deliverables, in writing.
Deliver & report
Findings walked through with you, for the owner and the technician.
Start with a conversation, not a quote
Thirty minutes to understand your practice: how many sites, which systems hold records, who has access, and what already keeps you awake. You leave with a view of what matters first, whether or not you engage us.
On PHIPA references. This page describes obligations in general terms for education and is not legal advice. PHIPA contains no outright prohibition on storing personal health information outside Ontario, but section 50 restricts disclosure outside the province, which produces a practical residency requirement in most cloud arrangements. Whether your particular circumstances comply is a determination for qualified legal counsel and for you as the accountable custodian. Our data governance guide explains the residency and sovereignty distinction in full, and our methodology and limitations statement sets out how we reach the positions we take.