Ontario's Personal Health Information Protection Act (PHIPA) requires health-information custodians — including dental practices — to take reasonable steps to protect patient records against theft, loss and unauthorised access. The law does not prescribe a product list; it expects safeguards appropriate to the risk. In our experience supporting dental and healthcare practices across Mississauga and the GTA, five controls do most of the work.
1. Encrypted, managed devices
Every workstation and laptop that touches patient data should be encrypted and centrally managed, so a stolen laptop is an inconvenience rather than a breach notification.
2. Multi-factor authentication
On email, on remote access and on the practice-management system where it supports it. Most breaches begin with a stolen password; MFA makes the stolen password useless.
3. Segmented networks
Clinical systems, front-desk PCs, imaging equipment and the guest Wi-Fi should not share one flat network. Segmentation keeps a compromised visitor device or an un-patchable imaging unit away from records.
4. Backups you have actually restored
Practice-management data, imaging and Microsoft 365 backed up to an isolated location, with a documented recovery plan that says how quickly scheduling, records and imaging come back. Restore tests turn the plan from a hope into a procedure.
5. Access records and vendor control
Who can see what, and when did they see it? Practice-management vendors, imaging suppliers and IT providers all need access at times; that access should be individual, time-bound and logged. This is also what an auditor or the Information and Privacy Commissioner asks for first.
What this is not
It is not legal advice — your obligations under PHIPA depend on your circumstances and are worth confirming with counsel. It is the practical baseline we implement for practices so that the technical side of compliance is handled, evidenced and maintained, and the dentist can get back to patients.
See our dental and healthcare page for how this fits into a complete managed environment, or read how one practice moved from a fragile setup to a recoverable one in our customer story.
