Handled with the discretion medicine deserves.
One platform, both regulatory regimes — Canada and the United States.
HIPAA, HITECH, and the state-level layer.
Safeguards for Protected Health Information. BAAs available.
Notification within 60 days. Encryption at rest and in transit.
Documented opt-in for SMS confirmations and callback flows.
State privacy standards layered on top of federal HIPAA.
PIPEDA nationally. Provincial statutes where they govern.
Private-sector handling of personal information, including cross-border transfers.
The governing statute for Ontario custodians of personal health information.
Applies to private clinics in BC and AB, with cross-border disclosure duties.
Health Information Act, with mandatory Privacy Impact Assessments.
Provincial health information acts, each with its own notification thresholds.
Strictest Canadian regime: Privacy Officer, algorithmic transparency, 72-hour reporting.
A patient record is held the same way at 3am as it is at 3pm.
Encrypted, access-logged by person, retained only as long as your policy says.
Controls we don't negotiate on.
Your patients' data stays where you tell it to.
Canadian clinics store in Canada, US clinics in the US. PHI never crosses a border without your written instruction.