Medical Clinic Cybersecurity: What Your MSSP Should Cover

Medical clinic cybersecurity usually becomes urgent the morning the front desk cannot open the EMR, and a message on the screen asks for payment. Until then, it sits on a list behind payroll, scheduling and the phone system.

That is how most small clinics meet the problem. The IT is handled by an outside provider or by the person who set up the network years ago, and nobody has been asked to own security as a job.

Here is the part people get wrong. Handing your IT to a provider does not hand over your obligation. In its 2025 annual report, the Information and Privacy Commissioner of Ontario summed up a key decision this way: custodians can outsource services but not responsibility.

So the useful question in medical clinic cybersecurity is not whether you have an IT provider. It is who watches for an attack, who answers when it happens at night, and what you can show the commissioner’s office afterwards.

What PHIPA Expects from Medical Clinic Cybersecurity

Ontario’s Personal Health Information Protection Act (PHIPA) asks every health information custodian to take steps that are reasonable in the circumstances to protect personal health information against theft, loss and unauthorized use or disclosure. The commissioner’s office applies that duty to cyberattacks in PHIPA Decision 284, discussed below.

When records are stolen, lost, or used or disclosed without authority, you must notify the affected patients at the first reasonable opportunity. The IPC’s guidance on reporting a privacy breach adds a second duty: you must also report to the IPC at the first reasonable opportunity when a breach falls into one of seven categories set out in the regulation.

There is a third duty. By March 1 each year, custodians must send the IPC statistics on the previous calendar year’s breaches, and those numbers include breaches that did not meet the threshold for a report.

For a small practice, the IPC published a Privacy Management Handbook for Small Health Care Organizations on May 8, 2025. It covers governance and accountability, privacy policies, procedures and controls, and ongoing monitoring and review. Medical clinic cybersecurity is the part of that program that keeps the controls working every day.

One Shared IT Provider, One Ransomware Attack

PHIPA Decision 284, dated June 16, 2025, looks at a ransomware attack on TransForm Shared Service Organization, the shared IT provider for five hospitals and a family health team. The decision says the incident began late in the evening of October 22, 2023, and that the attackers used compromised administrator accounts on the provider’s network.

Personal health information of hundreds of thousands of patients was taken and published on the dark web in November 2023. Afterwards, the custodians added stronger detection, restrictions on network traffic and multi-factor authentication. The commissioner’s office found the response otherwise adequate and made recommendations to lower the chance of another attack.

For medical clinic cybersecurity, the finding that matters most is about encryption. The office found that the hostile encryption of records was, on its own, an unauthorized use and a loss of personal health information, so patients should have been told about the encryption too. In plain terms, an attack that only locks your files, without copying them, can still mean writing to your patients.

Two lessons carry straight over to a ten person practice:

• Administrator accounts are your exposure: the attackers used compromised administrator accounts, so every account with that level of access needs strong protection, including the ones your provider holds.
• Encryption is a breach: plan for ransomware as a privacy event from the first hour, not only as an IT outage.

The Medical Clinic Cybersecurity Threats That Matter Most

The Canadian Centre for Cyber Security’s ransomware playbook describes how attackers usually get in. Most of it applies directly to a clinic with a handful of workstations and a cloud EMR.

• Phishing email: a message to the front desk or a physician’s inbox that delivers malware or captures a password.
• Attacks on logins: repeated login attempts and password guessing against email, the EMR and remote access.
• Exposed services: remote desktop and other systems left reachable from the internet, attacked through known vulnerabilities and password spraying.
• The supply chain: a provider connected to many clients can be used to reach every one of them, which is exactly what Decision 284 describes.

The same playbook lists conditions that make an organization more vulnerable, including end-of-life or unpatched devices and not using multi-factor authentication. An old reception PC that still runs the fax software fits that description.

A small team can fix most of this. Medical clinic cybersecurity needs someone to own the list, close the easy openings first, and watch for the rest.

Medical Clinic Cybersecurity: What Your MSSP Runs and What You Keep

The Cyber Centre’s baseline controls for small and medium organizations are a good map of the work. They start with an incident response plan, because organizations should assume incidents will occur, and go on to automatic patching, security software, secure configuration, strong authentication, staff awareness training, backup and encryption, and securing cloud and outsourced IT services.

A managed security service provider (MSSP) is built to run the parts that never stop:

1. 24/7 monitoring and alerting on clinic workstations, laptops, servers and the systems that reach the EMR.
2. Managed endpoint protection that can isolate a device when it starts behaving like ransomware.
3. Email security that filters phishing and malware before staff see it.
4. Regular vulnerability and configuration checks, with a list of what to patch and in what order.
5. Triage of security events, so a real alert reaches a person who can act on it.

The clinic keeps what PHIPA puts on the custodian:

1. Accountability for patient records, including the notices to patients and the IPC.
2. Decisions about access, meaning who can open which records, and removing access on the day someone leaves.
3. The privacy program in the IPC handbook, with its policies and annual breach statistics.
4. The vendor list, with every provider that holds an administrator account in your systems.

Medical clinic cybersecurity works best when both lists are written down, with a name next to each line.

Seven Steps to Start This Month

Each of these medical clinic cybersecurity steps works with the EMR you already have. Give each one a named owner.

1. List every system that holds patient information: the EMR, imaging, fax to email, the booking tool, shared drives and the backup drive in the back office.
2. Turn on multi-factor authentication for the EMR, email and any remote access, starting with administrator accounts.
3. Close remote desktop to the internet, or put it behind a VPN with multi-factor authentication.
4. Patch automatically and retire end-of-life devices, including the PC that only runs one old program.
5. Keep an offline backup: the playbook describes offline backups as stored in a separate location and disconnected from your networks, so ransomware cannot reach them. Test a restore before you need one.
6. Write a one page incident plan: who calls whom, how you reach your IT provider, and how you notify patients and the IPC. The playbook says to report ransomware to local police, the Canadian Anti-Fraud Centre and the Cyber Centre.
7. Ask your IT provider in writing which administrator accounts it holds in your systems, and how each one is protected.

Where Secur-IT Data Fits

Our team runs medical clinic cybersecurity through a program built around the two lists above. The healthcare cyber protection program has three tiers:

• Healthcare Cyber Health Check: a focused review of access and multi-factor authentication on the EMR, email and phishing risk, backup and recovery readiness, and administrator and vendor remote access.
• Clinic Protection Essentials: managed endpoint protection, 24/7 security monitoring and alerting, email security, regular vulnerability and configuration checks, and triage of security events.
• Healthcare Compliance and Continuity: a risk assessment, support for privacy and security documentation, incident response plans, and tabletop exercises that rehearse a ransomware day.

You can read how the 24/7 side works day to day in our overview of managed cybersecurity services in Toronto. Your existing IT provider keeps running your systems, and our team watches them and works alongside it.

Frequently Asked Questions

Q: What does medical clinic cybersecurity cover?

Medical clinic cybersecurity covers the controls that keep patient records available and private: multi-factor authentication, patching, email security, backups, monitoring and an incident plan. Under PHIPA, the clinic as custodian stays accountable for those safeguards, even when a provider runs them.

Q: Do I have to tell patients about a ransomware attack?

Often, yes. In PHIPA Decision 284, the commissioner’s office found that hostile encryption of records was, on its own, an unauthorized use and a loss, so patients should be notified about the encryption, not only about stolen data.

Q: Does PHIPA still apply if my IT provider was the one attacked?

Yes. The IPC’s 2025 annual report sums up Decision 284 as custodians being able to outsource services but not responsibility. Your duties to patients and to the IPC stay with you.

Q: Is multi-factor authentication required for a clinic?

PHIPA asks for safeguards that are reasonable in the circumstances. The Canadian Centre for Cyber Security recommends strong authentication for small organizations, and multi-factor authentication was one of the measures the custodians in Decision 284 added after the attack.

Q: Who do I report a ransomware attack to?

Report to the IPC when the breach meets one of the seven categories, and notify affected patients. The Cyber Centre’s playbook also says to report ransomware to local police, the Canadian Anti-Fraud Centre and the Cyber Centre.

If you want to know which of your clinic’s systems an attacker could reach today, and what to close first, our team at Secur-IT Data can walk you through it.

References

1. Information and Privacy Commissioner of Ontario: PHIPA Decision 284
2. Information and Privacy Commissioner of Ontario: Report a privacy breach (health organizations)
3. Information and Privacy Commissioner of Ontario: Privacy Management Handbook for Small Health Care Organizations
4. Canadian Centre for Cyber Security: Baseline cyber security controls for small and medium organizations
5. Canadian Centre for Cyber Security: Ransomware playbook (ITSM.00.099)

For securing AI systems as part of a modern security program, SecuritAI is built for exactly that.

Krikor Tengerian

Krikor Tengerian is the CEO and founder of Secur-IT Data Solutions, a Toronto-based cybersecurity firm focused on helping Canadian organizations secure their infrastructure and critical systems. With over 25 years of experience across cybersecurity and IT infrastructure, he has supported organizations in hardening networks, protecting critical workloads, and aligning security controls with business and regulatory requirements.​
Krikor actively shapes the direction and themes of Secur-IT’s educational content, collaborating with AI tools to structure, refine, and expand articles while providing the real-world context, use cases, and review to keep them accurate and practical for readers. He regularly shares insights on OT security, threat detection, incident response, and Canadian cybersecurity compliance to help industrial and commercial organizations better understand and reduce their cyber risk.