HSM IT ServicesMedical Clinics
Medical clinics, physiotherapy practices and other health providers in Alberta hold sensitive health information that must be protected under the Health Information Act. HSM IT Services helps clinics keep electronic medical records available, secure and supported so staff can focus on patient care.
Alberta clinics depend on electronic medical record systems, scheduling, billing, e-faxing, and connections to provincial services such as Alberta Netcare. When a computer, printer or internet connection fails, patients wait and staff fall behind. Most clinics do not have dedicated IT staff, so physicians and office managers often end up handling technology problems themselves. Reliable support, managed devices and a clear plan for outages help a clinic run smoothly through busy days.
Health information is highly sensitive and valuable to criminals. Ransomware groups target healthcare because downtime directly affects care, and stolen records can be used for fraud or extortion. Under the Health Information Act, custodians such as physicians and other regulated health professionals are responsible for protecting the health information in their custody or control, including through reasonable administrative, technical and physical safeguards. Clinics also need to manage who can access records and maintain appropriate logging.
Privacy obligations come with practical tasks. Clinics need policies, staff training, access controls and a way to respond if a breach occurs. Privacy impact assessments are required in certain situations under the Health Information Act, including for access to Alberta Netcare. A breach that poses a risk of harm must be reported to the Office of the Information and Privacy Commissioner, affected individuals and the Minister of Health. Good IT practices make these obligations easier to meet and easier to demonstrate.
Risks we see most
Ransomware
Encrypted EMR data or workstations can stop appointments, billing and prescribing until systems are restored.
Phishing and account takeover
Stolen staff credentials can expose patient records and allow attackers to send fraudulent messages from trusted accounts.
Inappropriate access to records
Shared logins and broad permissions make it difficult to limit access to those who need it and to show who viewed what.
Misdirected faxes and email
Sending health information to the wrong recipient is a common cause of privacy breaches in clinics.
Unsupported equipment
Older workstations and medical device computers that no longer receive updates can be exploited and are hard to secure.
How HSM IT Services helps
- Support for EMR and practice software, workstations, printers, scanners and e-fax systems
- Individual accounts, multi-factor authentication and role-based access to patient information
- Encrypted devices and secure remote access for physicians and staff
- Backups and recovery planning designed to keep the clinic operating through an outage
- Technical input for privacy impact assessments and HIA safeguard documentation
- Privacy and phishing awareness training for front desk and clinical staff
Rules and standards that apply
- Alberta Health Information Act (HIA)
- Alberta Personal Information Protection Act (PIPA) for non-health personal information
- College of Physicians and Surgeons of Alberta standards of practice
- Alberta Netcare access and privacy impact assessment requirements
This is general information, not legal advice. Confirm your obligations with your lawyer or regulator.
Services for this sector
Managed IT Services
Our Managed IT Services puts all your technology under one phone call: computers, networks, cloud, cybersecurity, phones, printers, cabling, cameras and access control. We monitor, maintain and support it all for a predictable monthly fee, so problems are caught early and your team can focus on the business.
Learn moreBusiness Application Support
Our Business Application Support looks after the software your organization depends on, from accounting and payroll to practice management, ERP and industry-specific tools. We handle installs, updates, user access, integrations and troubleshooting, and we deal with software vendors on your behalf so your staff do not have to.
Learn moreCompliance and Privacy (PIPA and HIA)
Our Compliance and Privacy services help Alberta organizations understand and meet their obligations under PIPA, the Health Information Act, the public-sector privacy legislation and PIPEDA. We assess your safeguards, build practical policies and map controls to frameworks such as CIS Controls v8.1, NIST CSF 2.0, ISO/IEC 27001:2022 and SOC 2.
Learn moreBackup and Disaster Recovery
Our Backup and Disaster Recovery protects your servers, workstations and Microsoft 365 data with secure, monitored and regularly tested backups. We design recovery plans around how long your business can afford to be down, so a ransomware attack, hardware failure or site disaster does not become a permanent loss.
Learn moreQuestions we hear
Do you replace our EMR vendor's support?
No. Your EMR vendor supports the application itself. We support everything around it, including workstations, network, printers, scanners, internet, Microsoft 365 and security. We work with your vendor when problems cross between the two, so your staff have a single place to call and do not have to figure out who is responsible.
Can you help with our privacy impact assessment?
We can provide the technical information a privacy impact assessment requires, such as how data is stored, who can access it, how it is backed up and what security controls are in place. We can also help you identify and address gaps. The custodian remains responsible for the assessment and its submission to the Office of the Information and Privacy Commissioner.
What happens if we have a privacy breach?
We help contain the incident, determine what systems and information were affected, and preserve the evidence you need. That information supports your assessment of whether there is a risk of harm and your notification obligations under the Health Information Act. We then help fix the cause so the same problem does not happen again.