BC PIPA and Clinic IT for Surrey Dental and Medical Offices

Private dental and medical clinics in British Columbia hold some of the most sensitive information there is: health histories, x-rays, treatment notes, insurance details and payment information. Most of it now lives on computers, in practice management software and in email.

BC's Personal Information Protection Act (PIPA) sets the rules for how private organizations, including private clinics, protect that information. This post explains what PIPA says about security in plain terms and turns it into a checklist for a small Surrey clinic.

This is general information, not legal advice. Your regulatory college, professional association or lawyer may have additional requirements for your practice.

What PIPA actually says about security

Section 34 of PIPA is one sentence. An organization must protect personal information in its custody or under its control by making reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal, or similar risks (BC Laws, PIPA).

PIPA does not list required technologies. Instead, "reasonable" depends on the situation, including how sensitive the information is and the harm a breach could cause. The OIPC's Security Self-Assessment Tool suggests minimum security requirements.

Health information sits at the top of the sensitivity scale. In its guidance on AI scribes for BC healthcare organizations, the OIPC says it would expect health information to be protected with multiple layers of physical, technical and administrative safeguards. The examples it gives include multifactor authentication and strong passwords for all users, encryption in transit and at rest, procedures to detect and respond to incidents, and regular privacy and security training (OIPC, PIPA and AI scribes).

Other PIPA duties that touch IT

• Section 4(3) of PIPA requires an organization to designate one or more individuals to be responsible for ensuring it complies with the Act, and section 4(5) says the organization must make that person's position name or title and contact information available to the public. In a small clinic that is often the owner or office manager.
• Section 35 says that if you use personal information to make a decision about someone that directly affects them, you keep it for at least one year after using it. It also says to destroy it, or make it anonymous, once the purpose and any legal or business need for it are gone. For IT, that means old computers, drives and copiers need secure wiping before they leave the clinic.
• As of October 2026, PIPA does not require private organizations to report breaches. The OIPC continues to call on government to make breach reporting mandatory and strongly recommends reporting breaches to its office as a best practice.

A practical IT checklist for a small clinic

The OIPC's three categories of safeguards, physical, technical and administrative, make a good structure (OIPC, PIAs for the private sector).

Technical

• MFA on email, Microsoft 365 or Google Workspace, remote access and your practice management software where it supports it (our Microsoft 365 security checklist covers the tenant settings)
• Every staff member has their own login, with no shared front desk passwords
• Full disk encryption on laptops and any computer that stores patient data
• Automatic updates for Windows and macOS, browsers and the practice software
• Endpoint protection on every computer
• Backups that are encrypted, kept off site or in the cloud, and tested by restoring a file
• Separate Wi-Fi for patients and guests, kept off the clinic network

Physical

• Screens at reception angled away from the waiting room, and locking automatically when unattended
• Server or network cabinet in a locked room or closet
• Old drives and devices wiped or destroyed, with a record of it

Administrative

• Access based on role, so front desk staff see what they need and no more
• Accounts closed the day a staff member leaves
• A short written incident plan: who to call, how to isolate a computer, how to decide whether to notify patients and the OIPC
• Privacy and security training when staff start, then at least yearly
• A review of every vendor that touches patient data, including where their data is stored and how they report breaches to you

The OIPC's self-assessment tool suggests minimum security requirements in 17 different categories and is worth working through once a year.

Your website counts too

Online booking forms, contact forms and new patient intake forms collect personal information. Make sure the site uses HTTPS, that form submissions go somewhere secure rather than a shared inbox nobody manages, and that your privacy policy says what you collect and why.

How Astro helps clinics

Astro Developments is a Surrey, BC IT company. Our Full IT agreement covers the technical items on this list: help desk, patching, endpoint protection, backups, Microsoft 365 or Google Workspace administration and offboarding when staff leave, with 24/7 system monitoring and alerts. We also help you write down what is in place and build your incident response plan, which are the first things anyone will ask for after an incident. See our cybersecurity services. If you are still deciding between ongoing support and calling someone when something breaks, read our managed IT vs break fix comparison.

Offices that sign a 6-month Full IT agreement get a new website built at no charge. Our standard plans stay month to month for the first 3 months (pricing). Email [email protected] or book an IT assessment.