PHIPA Compliance Case Study - Toronto Dental Group
PHIPA Compliance Case Study - Toronto Dental Group. What Group 4 Networks changed for this Toronto engagement, and which limits. Call (416) 623-9677.
When their cyber insurance broker sent the renewal questionnaire, the answers to several key questions - "Is all PHI encrypted at rest?", "Do you have an EDR solution on all endpoints?", "Do you maintain audit logs of PHI access?" - were all "No." The insurer declined to renew coverage until the practice could demonstrate remediation. Without cyber insurance, the practice faced significant exposure: a single ransomware attack on a dental practice with 3,200 patient records could trigger PHIPA breach notification obligations and regulatory investigation.
The client was a dental practice group operating four locations across Toronto and North York, serving approximately 3,200 active patients. They had been running their practice management software (Dentrix) on aging on-premises servers - three of which were running Windows Server 2012, which had reached end-of-life and was no longer receiving security patches. Patient records were stored locally with no encryption at rest, and the practice had never implemented access control auditing to track which staff members accessed which patient files.
Migrated all four locations from aging on-premises servers to Microsoft Azure Canada Central, using Azure Virtual Machines with BitLocker encryption at rest and Azure Backup with 90-day retention. Dentrix was reconfigured to operate in the new environment with zero data loss and zero downtime during business hours - migrations were performed overnight at each location.
The practice group passed their cyber insurance IT audit on day 87, with all required controls documented and evidence packages delivered to the insurer's assessors. Zero findings were raised during the audit. Cyber insurance was renewed - with a 23% reduction in premium compared to the prior year's quote, reflecting the significantly improved security posture.
Since migration, the practice has maintained 99.9% availability across all four EMR environments. A ransomware attempt detected at one of the North York locations six weeks post-deployment was blocked by SentinelOne in real time - the SOC alert fired, the endpoint was isolated automatically, and practice operations at that location were unaffected.