Cybersecurity for Healthcare Practices in Ontario: Keep Patient Records Out of an Attacker’s Reach

Because patient records are valuable, clinics can’t work without them, and most practices have no one watching their systems full time. That combination makes a clinic more likely to pay, and attackers know it.

• The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025-2026 reports a 75% increase in ransomware incidents affecting Canada’s healthcare sector from 2022 to 2023, and notes that 5 hospitals in Southern Ontario were hit by a single ransomware group in October 2023.
• Ontario’s Information and Privacy Commissioner received reports of 27 ransomware attacks under PHIPA in the 3 years ending December 2023, according to a Medical Post article republished by OntarioMD. The same piece notes the Barrie Community Family Health Team reported a cybersecurity incident involving stolen health information on March 6, 2024.
• Suppliers are a way in too. A ransomware attack on Ontario Medical Supply, a vendor to Ontario Health atHome, affected as many as 200,000 patients’ names, contact details and supply orders, Global News reported.

The point isn’t to frighten anyone. It’s that the attacks clinics face are mostly ordinary, and ordinary attacks have well-known fixes. The Cyber Centre’s Ransomware Threat Outlook 2025 to 2027 says it plainly: regular updates, MFA and caution with phishing are effective.

That one forgotten account and one reachable backup can close a clinic. In a case summarized by the IPC, attackers got into a medical imaging clinic through a dormant account with significant administrative privileges, then deleted its backups.

The IPC’s ransomware case study (PHIPA Decision 249) describes an attack discovered in December 2022. The attackers encrypted and copied files from the clinic’s electronic medical records and file-sharing servers, deleted the backups and demanded a ransom. The affected files could have included up to 550,000 patient records. Unable to restore, the clinic closed temporarily and paid. Activity during the attack also overwrote the logs before anyone could review them, so the clinic never established exactly how the intrusion happened.

What changed afterward is the useful part. The clinic limited domain administrator rights to 2 staff, started monitoring for and deleting dormant accounts, kept at least one backup copy offline and began uploading its VPN and firewall logs daily. The IPC’s own takeaways add MFA, current security patches, regular staff training and logs with enough capacity to survive an incident. The IPC found the clinic had responded adequately. None of those fixes is exotic, and every one is cheaper than a closed clinic.

Around-the-clock monitoring, identity and endpoint protection, email protection, staff training, patching and backups kept out of an attacker’s reach, all scheduled around clinic hours.

• Identity protection for Microsoft 365: MFA for every account, monitoring for unusual sign-ins, and dormant accounts removed.
• Admin rights kept to a named few, with separate admin logins that nobody uses for email or browsing.
• 24/7 monitoring and endpoint detection and response (EDR) on workstations, laptops and servers.
• Log analysis (SIEM) from firewalls and Windows events, kept long enough to answer “what was accessed?” after an incident.
• Email protection against phishing and malicious attachments, plus security awareness training with simulated phishing for front-desk and clinical staff.
• Firewall and network hardening, including a separate network for guest and patient Wi-Fi.
• Backup and disaster recovery for the EMR data you hold and your patient files, with an offline or immutable copy and restores tested on a schedule.
• Patching outside clinic hours, vendor management and regular configuration reviews.

For what a full review looks at before any of this is put in place, read what a cybersecurity assessment actually covers.

Your EMR vendor secures its platform; everything around it is yours. OntarioMD says a hosted EMR provider handles data security, disaster recovery and server infrastructure, while a locally hosted EMR leaves those jobs with the practice.

OntarioMD’s EMR certification FAQ draws that line clearly. Even with a hosted EMR, the workstations, logins, Microsoft 365 email, scanned documents, Wi-Fi and the remote access your clinicians use from home are the practice’s responsibility. With a local EMR server in the back room, the server, its patches and its backups are yours too.

The supplier side needs attention as well. The Ontario Health atHome incident started at a vendor, not at the agency. For a clinic, that means knowing which vendors can reach your systems, giving them one controlled way in, and removing access nobody uses. It also means asking your EMR and other software vendors how they protect your data, in writing.

Cybersecurity is how most PHIPA safeguards actually get done. PHIPA makes your practice responsible for protecting personal health information against theft, loss and unauthorized use or disclosure, and nearly every attack above is one of those.

There’s a practical link too. Whether a stolen or encrypted device was protected affects what your privacy lead has to report. Our page on PHIPA compliance for healthcare practices covers the reporting rules, IPC penalties and the records to keep. ACT360 isn’t a law firm or a privacy officer. We put the technical safeguards in place and keep the evidence that they work, so your privacy lead can answer with facts.

A six-figure payment redirect. A convincing email used a real employee’s name and an active payment conversation to ask a business partner to change banking details for an EFT payment worth over six figures.

This client wasn’t a clinic, but practices that pay suppliers, landlords and locums see the same kind of attempt. The partner paused and asked for confirmation. ACT360 reviewed the Microsoft 365 environment, confirmed there was no breach, and traced the email to a newly registered lookalike domain one letter off from the real one. The payment was protected, and the client added phone verification and dual approval for payment changes. The full story is in the fraud investigation case study.

It depends on users, devices, protection layers and your obligations, so ACT360 prices cybersecurity after an assessment instead of quoting from a headcount.

For most practices, security sits inside a broader managed IT arrangement, priced per user per month. Our guide to IT support costs for healthcare providers breaks that budget down by practice size. When security is delivered as part of an ACT360 Managed IT agreement, that agreement includes a 90-day exit clause. Standalone cybersecurity projects are scoped and quoted on their own. Backups and recovery are covered in more depth on our business continuity and disaster recovery page.