IT for Nova Scotia clinics: PHIA, backups, and staying open

A clinic runs on two things that cannot fail: the health information you are trusted to protect, and the systems that let you see patients. When the practice-management software is down, the schedule stops. When patient records are exposed, the damage is not measured in an afternoon. For a small or mid-sized clinic in Nova Scotia, the IT that keeps both of those safe is not glamorous, and it is not optional.

This is a plain walk through what that IT looks like — the health-information rules you operate under, the backups that let you reopen after a bad day, and the everyday controls on devices, access, and email that prevent most incidents. We work with Atlantic Canada businesses, and clinics sit at the demanding end of the range because the stakes are higher and the obligations are specific.

One note before we start: nothing here is legal advice. The specifics of your obligations depend on your role, your setup, and current law, and you should confirm them with your own counsel and with the Office of the Information and Privacy Commissioner for Nova Scotia. What follows is how the practical IT tends to line up with those obligations.

Health information under PHIA

Nova Scotia’s Personal Health Information Act — PHIA — governs how health information is collected, used, kept, and disclosed in the province. If your clinic holds patient records, you are almost certainly operating as a custodian of personal health information under that law, with duties that flow from it. The exact wording and requirements are the law’s to define and can change, so treat the points below as the practical shape rather than the legal letter, and verify the detail.

In broad terms, the law expects custodians to protect personal health information with reasonable safeguards, to limit access to those who need it, and to be able to account for what happens to that information. It also contemplates notification when there is a breach — an unauthorized disclosure or loss — of a kind that could cause harm. The IT consequences of those expectations are concrete:

• Safeguards have to be real and demonstrable. “We are careful” is not a safeguard. Encryption, access control, patching, and audit logging are. If you were asked to show how patient data is protected, you would want a documented answer.
• Access should be least-privilege. Front desk, clinical staff, and administrators do not all need the same access. The system should reflect that, and you should be able to see who can reach what.
• A breach has a clock on it. Whatever the precise notification rules turn out to require for your situation, the practical version is that you need to know quickly when something has gone wrong, which means monitoring and logging that would actually catch it.

The theme is that PHIA rewards clinics that can show their safeguards, not just assert them. Good IT is what turns an assertion into evidence. Our broader take on privacy obligations in the region, including how PHIA sits alongside federal rules, is on our Atlantic Canada page.

Backups that let you reopen

For a clinic, backups are not only a data-loss protection. They are your ability to see patients tomorrow if today goes badly — a ransomware hit, a server failure, a corrupted database in the practice-management system.

The single most important thing to understand about clinic backups is that running them is not the same as having them. A backup only counts once you have watched it restore. Corruption, drifted scope (the new imaging folder that was never added to the job), and backups an attacker can reach and encrypt are all failure modes that stay invisible until the day you need the data. The full method — pick a real target, restore to a separate location, open what came back, time it, write it down — is in our note on why a backup is not a backup until you have watched it restore, and it applies to a clinic with more force than to almost any other small business.

Two clinic-specific points on top of the general rule:

• Your cloud practice-management vendor is not automatically your backup. Read what your vendor actually retains and for how long, and confirm you could recover from your own copy if you had to. Retention policies are not backups.
• Test the restore of the system that runs the schedule, not just the file share. If the practice-management database cannot be brought back quickly, the clinic is closed regardless of how safe the documents folder is.

Uptime and staying open

Downtime at a clinic is not an inconvenience — it is cancelled appointments, a waiting room with no schedule, and revenue that does not return. Keeping the doors open is mostly about removing the avoidable outages:

• Patched, monitored devices that fail less and are noticed when they start to.
• Redundancy on the connection, so a single internet outage does not stop billing and bookings for the day.
• A known recovery plan with a named owner, so an incident is a procedure rather than a scramble.

None of this is exotic. It is the ordinary discipline of keeping the machines that run the practice healthy and watched.

Devices, access, and email

Most incidents at a small clinic do not come from a sophisticated attack. They come from an unpatched laptop, a shared password, a lost phone with the email app still signed in, or a convincing message that got someone to click. The controls that prevent these are well understood and worth putting in place deliberately.

Managed devices. Every machine that touches patient information should be enrolled, encrypted, patched, and remotely wipeable if it is lost. A reception laptop that walks out the door should be a recoverable event, not a reportable breach. Centralized enrolment and policy — the substance of device management — is how you get there without chasing each device by hand.

Access control and multi-factor authentication. Individual accounts, not shared logins. Multi-factor authentication on anything that reaches health information or email. Access that matches the role, reviewed when people join and leave. This is the least-privilege principle from PHIA turned into settings.

Email security. Clinics receive referrals, results, and patient messages, which makes email both essential and a target. Strong authentication on accounts, phishing filtering, and a clear rule that patient information is only sent through channels you have vetted go a long way. The most common breach at a small practice is still an email sent to the wrong person or an account taken over because it had no second factor.

Where to start

If you are running a clinic and this list made you uneasy, the useful first move is not a full overhaul — it is an honest inventory. Which devices touch patient data, who can access what, when a restore was last proven, and whether every account has a second factor. That inventory usually tells you which one or two gaps matter most.

This is the kind of work we do for Atlantic Canada clinics: the device and access controls, the tested restores, and the documentation that turns “we are careful” into something you could show. We are engineers, not your lawyers — the compliance judgement stays with you and your counsel — but the technical safeguards those obligations imply are squarely ours to build and maintain.

Send us two paragraphs about how your clinic handles records and devices today, and we will reply in writing within one business day.