Cybersecurity for Healthcare Clinics in Quebec: What to Do First

Monday, 7:45 a.m., at a physiotherapy clinic in Pointe-Claire. The booking software won't open, and neither will the electronic records. On the front-desk PC, a note demands a ransom. Twelve patients are due before noon, and nobody can see who they are.

Health information is about as sensitive as data gets, and the sector is squarely in the crosshairs. According to the Canadian Centre for Cyber Security, ransomware incidents affecting healthcare have been steadily increasing worldwide, and they directly disrupt the ability to deliver care.

Many clinic owners still assume Law 25 is the only privacy law that applies to them. But since July 1, 2024, a sector-specific Quebec statute governs the health information held by private clinics, with very concrete security obligations. Here's what it means in practice.

Which law applies to your clinic?

The Act respecting health and social services information (CQLR, c. R-22.1) was passed in 2023. In French it's often called "loi 5," after its chapter number in the 2023 statutes. Most of its provisions have been in force since July 1, 2024.

It applies to "bodies in the health and social services sector." Beyond the public network, its Schedule II covers persons or groups operating a private health facility: a business where physicians, dentists or other professionals practise privately and on their own account, without providing lodging or specialized medical treatments. Specialized medical centres, laboratories and private seniors' residences are also listed.

For these bodies, Law 25 doesn't apply to the health and social services information they hold; the health information act takes over. But Law 25 still covers everything else.

The line isn't always sharp, especially in multidisciplinary clinics. Confirm your situation with legal counsel.

What the health information act requires on security

The act and its Regulation respecting the governance of health and social services information turn security into specific duties. These are the ones that hit a private clinic most directly.

If your information is communicated or hosted outside Quebec, the act also requires a prior assessment and a written agreement (s. 78), a mechanism similar to Law 25's.

Typical blind spots in a clinic

Clinics face constraints ordinary offices don't: staff moving between rooms, patients in the waiting area and specialized equipment. The same weaknesses keep showing up:

• The shared front-desk login. "reception1," known to everyone. It makes the logging the law requires almost useless, since nobody can tell who looked at what.
• PCs attached to medical devices. X-ray, ultrasound, ECG: these computers sometimes run old Windows versions managed by the device vendor, on the same network as everything else.
• Waiting-room Wi-Fi connected to the same network as the medical records.
• Unencrypted email used to send documents to patients, for lack of a secure portal.
• Cloud vendors whose hosting location and incident notification process nobody has checked.

Take a 15-person dental clinic in Sherbrooke. Its digital X-ray workstation ran an unsupported operating system on the same network as the front desk. The fix wasn't an overnight replacement: the workstation was moved to a separate network with no internet access until the replacement scheduled in the end-of-life calendar.

Priority measures

This is the checklist our team uses as a starting point with private clinics:

• Multi-factor authentication on email, the EMR and all remote access.
• A named account for every person, with fast automatic screen locking.
• Tested backups, including an offline or immutable copy (see our guide to the 3-2-1-1-0 backup rule).
• A separate network for medical devices and a separate guest network for the waiting room.
• Automatic updates on workstations; an end-of-life calendar kept current.
• EMR access logs turned on and reviewed at least once a year.
• An email domain protected with SPF, DKIM and DMARC to limit spoofing aimed at patients.
• Vendor contracts that specify hosting location, security measures and incident notification timelines.
• The technology product register published on your website.
• A downtime procedure: how to keep seeing patients when everything is offline.

When an incident happens

The day a workstation gets infected or a laptop is stolen, the law first asks you to take reasonable measures to reduce the risk of injury and prevent a repeat. Then, if the incident presents a risk of serious injury, you must promptly notify the Minister of Health and Social Services and the Commission d'accès à l'information, as well as the people concerned.

The assessment weighs the sensitivity of the information, the anticipated consequences and the likelihood of harmful use. With health information, sensitivity starts high. The reporting process is covered in our article on reporting a confidentiality incident to the CAI.

Our team can assess your clinic's security posture, check your registers and logs, and give you a prioritized plan through a cybersecurity audit. For questions about interpreting the act, your legal counsel and your professional order remain your best allies.