Clinics, health professionals and businesses that manage employee or insured-member files hold some of the most sensitive information there is.
Why is it so sought after?
It lasts. A credit card number can be changed in minutes. A diagnosis, medical history or date of birth cannot.
It is rich. A health record often combines identity, contact details, health card number, insurance information and history: ideal raw material for fraud and identity theft.
It enables pressure. Its sensitivity makes extortion more effective: criminals threaten to publish rather than just encrypt.
Organizations must keep running. A paralyzed clinic can't wait, which raises the pressure during ransomware.
What privacy laws say
Health information is sensitive personal information. Under Quebec's Law 25, using it for other purposes generally requires express consent, and its protection must be proportionate to its sensitivity. In Ontario, health information custodians are also subject to PHIPA. An incident involving health information will often present a significant risk of harm, triggering notification obligations.
Priorities for a clinic or practice
- Multi-factor authentication on the patient record system, email and remote access.
- Isolated, tested backups.
- Access limited to what each role needs.
- Staff training on fraud and phishing.
- A clear rule: no health information in public AI tools.
- An incident response plan and incident register.
The Cyber & AI Assessment evaluates these priorities in 90 minutes. See also privacy and governance.