The medical record vendor
The software, its hosting, its certification, its access logs, its links to billing and to the health network.
Medical and dental clinics
IT for medical clinics and dental offices in Quebec
In a clinic, IT gets noticed when it is missing: the waiting room is full, the patient record will not open and the receptionist is writing names on a sheet of paper. Meanwhile, health information has to stay where it is.
A medical or dental clinic needs a network and workstations that hold up during appointment hours, named accounts on the shared front desk workstations, a backup of whatever lives on site, and technical measures that support the Act respecting health and social services information, in force since July 1, 2024.
What kind of IT does a medical or dental clinic need?
A medical or dental clinic needs IT that keeps the patient record reachable during opening hours and that protects health information, some of the most sensitive there is. Appointment schedules, test results and health insurance numbers all pass through the same few workstations. OKTO Solutions, a company from Trois-Rivières, offers private clinics in Quebec monitoring of the network and devices, patching, managed protection on every workstation, account management and a daily backup with one copy kept outside the clinic. Since July 1, 2024, the Act respecting health and social services information applies to private health facilities, which includes those of physicians and dentists. OKTO practises neither law nor auditing: its services are technical measures that support the clinic’s obligations. The electronic medical record is still supplied and supported by its vendor. The plans are called Base, Standard and Complet; employee support is part of the last two.
The laws
Which laws govern health information in a private clinic?
The Act respecting health and social services information covers anyone operating a private health facility, meaning the enterprise where physicians, dentists or other professionals practise privately. Here is what it asks for, along with its governance regulation, and the part that plays out in your systems.
| What the text asks for | Source | The technical side |
|---|---|---|
| Protection of information rests with the person exercising the highest authority; it can be delegated in writing | Act, s. 100 | A technical contact who hands that person logs and reports |
| A governance policy: roles, categories of authorized persons, logging mechanisms, security measures, an update schedule for technological products | Act, s. 105 | One account per person, permissions by role, patching that is tracked |
| A register of the technological products and services in use | Act, s. 107 | An inventory of devices and software, kept current |
| Where there is a risk of serious injury, prompt notice to the Minister, the Commission d’accès à l’information and the persons concerned; a register of incidents | Act, ss. 108 and 110 | The trail of the incident: what was viewed, by which account, at what time |
| Information that remains usable despite any incident affecting the medium it is stored on | Governance regulation, s. 5 | Daily backup, a copy outside the clinic, restore tests |
| An analysis of accesses, at least once a year for a private health facility | Governance regulation, s. 7 | Logs from Microsoft 365 and from workstations |
A summary, not legal advice. OKTO does not declare any clinic compliant. Section 103, which provides for logging all accesses, is still marked “Not in force” in the official text updated to August 12, 2026. Information about your personnel collected to manage human resources is not health information within the meaning of this Act; for personal information in general, see our page on Law 25.
Continuity
What happens when the patient record will not open at 8:15 a.m.?
Appointments follow one another every fifteen minutes, the waiting room fills up and the front desk screen shows an error.
When the electronic medical record is hosted by its vendor, the failure is often somewhere between it and you: the Internet link, a switch, the wireless, a workstation that will not start. That is the part we watch. In all three of our plans, monitoring runs day and night, which leaves a chance of seeing the problem before the first patient walks in.
During support hours, a clinic at a standstill goes to the front of the line, with a targeted pickup of 15 minutes. That target becomes a written commitment on the Complet plan, the only one that includes the 24/7 emergency line. The IT support page gives the rest.
Then there is what lives on site: the digital X-rays of a dental clinic, scanned documents, the accounting. The regulation asks that information remain usable despite an incident affecting the medium it is stored on. Our backup runs daily, keeps an off-site copy nobody can alter, and is put to the test twice a year from the Standard plan up.
Last night’s restore point, a machine that boots, a duration written down: proof that a copy can be read back.
The front desk
How do you manage shared workstations at the front desk?
At reception, three people take turns on two workstations, and the session stays open all day under the same name. It is convenient. It is also what keeps you from knowing who opened a patient’s record.
The Act wants the governance policy to name the categories of persons who may use the information and to describe the logging mechanisms. A common account empties both of their meaning.
- One account per person, with fast user switching
- An automatic lock when the workstation is left unattended
- Permissions by role: the front desk does not need employee files
- A screen that cannot be read from the waiting room
A clinic also sees replacement staff, trainees and agency personnel come and go. Every departure has to close access everywhere. Account management is part of our managed IT services; the method is on our page about employee arrivals and departures.
When someone leaves, their accesses close one by one the same day, until the counter reaches zero.
The patient record
Electronic medical record, imaging, billing: who looks after what?
The Collège des médecins du Québec regulation on clinical records, in force since July 11, 2024, calls for a record kept on a technological medium, in a certified product. For a physician already in practice on that date, paper remains allowed until December 31, 2026, with exceptions; after that, every new entry is made on a technological medium. MYLE, OFYS, Omnimed, Medesync and MobileMed appear in the September 2026 table of certified electronic medical records. OKTO sells none of them. The only software it sells is OKTO PSA, a Quebec-made ERP and CRM.
OKTO Solutions
The network, the wireless, workstations, printers, accounts, email, the backup of what stays on site and the inventory that the register of technological products calls for.
The clinic
The choice of products, the governance policy, how long records are kept and who has the right to see what.
Remote access
Email, laptops, access from home: how do you close the other doors?
The electronic medical record has its own protections. What surrounds it often has fewer: the clinic’s mailbox, the laptop of a physician who reviews files from home, the Microsoft 365 account of an employee who left last year.
Three measures close most of it. Multi-factor authentication on every account, so that a stolen password is not enough. Conditional access that refuses a sign-in coming from a country where nobody from the clinic is. And encrypted laptops, so that a lost device does not give up what it holds.
These settings fall under our Microsoft 365 management and our managed cybersecurity. Email protection filters what comes in and prevents spoofing of your domain. For physicians who work from home, see secure remote work.
To find out where you stand. Our cybersecurity audit reviews six areas and ranks the findings by risk. It is a good starting point before writing the governance policy.
A stolen password is not enough: the approval request lands on the employee’s phone, and she declines it.
Questions and answers
Questions clinic managers ask
Can OKTO make our clinic compliant with the health information act?
No, and no IT provider can do that alone. The Act places responsibility on the person exercising the highest authority in the clinic. What we install are technical measures in support of your obligations, namely named accounts, logs, patching and backups. The governance policy and the legal assessment belong to the clinic and its advisor.
Our electronic medical record is hosted by its vendor. What is left to manage?
Everything that lets you reach it and everything that lives beside it: the Internet link, the network, the wireless, workstations, printers, Microsoft 365 accounts, email, scanned documents and, in a dental clinic, often the imaging server.
Our clinic opens in the evening and on Saturday. Who answers during an outage?
Regular support covers weekdays, 8 a.m. to 5 p.m. With the Complet plan, an emergency line answers critical outages at any time. On the Base and Standard plans, alerts received outside business hours are recorded, then handled on return.
How long do patient records have to be kept?
The Collège des médecins regulation sets retention at 10 years or more after the last entry in the record. The Ordre des dentistes regulation refers to the 5 years following the last entry. How long backup copies are retained is then settled with you.
Front desk staff share the same Windows session. Is that a problem?
Yes. With a common account, the log says “reception” and never a name, which empties the yearly analysis of accesses of its meaning. One account per person and fast user switching settle the matter.
What do we do if a clinic laptop is lost or stolen?
First, cut: the account is closed, sessions are revoked, and disk encryption keeps the contents unreadable. Then the Act: where there is a risk of serious injury, the clinic notifies the Minister, the Commission d’accès à l’information and the persons concerned. We supply the technical trail; the decision to notify is yours.
What would happen at the front desk if the network went down tomorrow morning?
Tell us how many workstations the clinic has, which electronic medical record you use and what is still kept on site. We tell you what is fragile, with no obligation.
Reviewed by Antonio Pazzi, president of OKTO Solutions · updated