Pterion · Compliance
Compliance
The inspector, the regulator, and the privacy commissioner each have a list. We keep the clinic ahead of all three, in writing, before they ask.
Assess Design Build Operate
04 · Scope
Inspection readiness and facility permits, policies and quality assurance, privacy, confidentiality and cybersecurity under PHIPA, and website compliance: AODA accessibility and advertising rules.
The College inspects premises on a cycle and reads a year of records when it does. A facility permit is a file of signed documents before it is a certificate on the wall. Privacy is an agreement, a log and a habit; security is the lock on every account, device and network that holds it. None of this is difficult; all of it is easy to let slide while a clinic is busy being a clinic. We set the schedule, write the documents in the order they are read, and keep them current.
In practiceWebsites Privacy · Security OHPIP
What clinics ask
- Medical“We run, or are opening, a premises that gives sedation or anesthesia. What does the CPSO inspection actually look for, and what has to exist before the visit?”
- Dental“We want to offer sedation. What does the RCDSO facility permit require, and who signs what?”
- Aesthetics“A marketing menu, a premises nobody has inspected, a privacy policy copied from another site. Which of these is a regulatory exposure, and how bad is it?”
- Any clinic“Is our website actually accessible, is it collecting anything it should not, and is it saying anything the college would object to?”
- Any clinic“If ransomware locked our systems on a Monday morning, could we still see patients, and who would we have to tell?”
What we can name
The CPSO Out-of-Hospital Premises Inspection Program and its quality-assurance record-keeping. RCDSO facility permits for sedation and anesthesia. PHIPA and the Information and Privacy Commissioner of Ontario: safeguards, a privacy contact, a written statement of information practices, notice to patients when their information is stolen, lost, or used or disclosed without authority, reports to the Commissioner where the rules require them, and a yearly breach count. Health Canada’s restrictions on advertising prescription drugs to the public. CASL for electronic marketing. AODA for accessibility.
Behind the paperwork, security: two-step sign-in, encrypted devices, clinical equipment on a network with no route out, backups restored on a schedule, and a written plan for the day something goes wrong.
Online, the same discipline: the WCAG 2.1 AA standard that AODA requires of a website, privacy disclosures and consent for analytics, and the advertising rules of the college and Health Canada — checked by the publish step on every change, not by memory. Each regulator is named as a fact; none endorses us.
Proof
No case is one system. The cases are shown by industry, each with the balance of the four it touched.
We have run the front desk we are selling the fix for.
Being a clinician is hard enough. Running the business around it is not taught in professional school, and the field is corporatizing around the owners who learned it the hard way.
We exist to help clinician-owned clinics stay independent and succeed: to make the operation efficient, to teach what we had to learn ourselves, and to give owners back the part of the work they love.
an assessment.
No obligation · a diagnosis of the problem and what can be done about it · every scope quoted on its own