IT Security For Healthcare Providers
Your EMR Provider Does Not Secure Everything Else
Your EMR provider secures patient records in its software. TUCU secures everything else, from the computers and phones that open those records to email, network and backups.
The EMR Security Gap
Your EMR vendor is not responsible for.
Your Devices
Office computers, tablets and phones that open patient records. These need encryption, patching and EDR.
Your Network And Email
Firewall, WiFi, guest network separation and email security. Phishing email is a common way into a practice.
Your People And Backups
Staff access, onboarding and offboarding, backups of everything outside the EMR, and protection from ransomware.
Ontario Healthcare IT Security Basics
What we put in place for every practice we manage.
Endpoint Security
Every computer, tablet and phone that opens patient data is encrypted, patched and protected by EDR.
Network Protection
Firewall, WiFi security, guest network separation, VoIP phones and monitoring.
Email Security
Encrypted patient communication, phishing protection and spam filtering.
Access Management
Password policies, multi-factor authentication, and secure onboarding and offboarding of staff.
Complete Backups
Backups of everything beyond the EMR, tested recovery and ransomware protection.
IT Support
Fast help desk, computer setup, printer support and technology planning.
What You Can Expect
-
Rated 5 out of 5
TUCU fills that need for us
“We have been using TUCU’s services for well over a year and they have taken away our tech aches! As a small business owner, we do not have an IT person on our staff and TUCU fills that need for us. If any issues come up they are always quick to respond and help us get back up and running. We are so happy we found them!”
Natalie McCulloch
Owner, Healthcare Practice
-
Rated 5 out of 5
TUCU takes good care of our server
“We have been using TUCU as our computer support company as needed since 2010. Our dental office server support has to be good, because without it, we can’t serve patients. TUCU takes good care of our server. They also built our website and manage it for us. Their service is prompt, friendly, professional and easy to recommend.”
Su
Managed IT Services For Medical And Dental Practices
One team manages every part of your IT. Each service below runs inside a fully managed plan.
Managed IT Services
Help desk, devices, accounts, patching and backup, run by in-house technicians who know your people and your setup by name.
Microsoft 365 Security
Intune, Entra ID and conditional access configured properly, so only managed devices reach company data and access ends when someone leaves.
Cybersecurity
EDR on every managed device and identity threat detection on email and cloud accounts, monitored 24/7.
IT Compliance And Vendor Screening
Help putting in place the security safeguards that PHIPA and PIPEDA expect, with documentation and the controls to back it up.
Apple IT For Business
Macs, iPhones and iPads managed to the same security standard as Windows, by Apple Certified Consultants.
Networks, Servers And Cloud
Firewalls, WiFi, servers and imaging equipment connections configured, segmented, kept current and monitored.
Client Spotlight
How Dr. Semoff grew from 1 to 4 medical locations.
Ready To Close The Security Gaps Your EMR Does Not Cover?
Most practices assume their EMR vendor has security covered. The vendor protects its database. It does not protect your office computers, tablets and phones, your network and WiFi, your email, staff access or your backups.
Those are the places an attacker gets in. A practice can have a well protected patient database and still lose access to it for days, because ransomware locked every computer in the office.
TUCU manages and secures IT for medical and dental practices across Toronto and Durham Region, and helps you put in place the security safeguards that privacy laws such as PHIPA and PIPEDA expect.
What Fully Managed IT Covers
Every plan is built around your team, and covers:
- Help desk access for every staff member.
- Device and identity management with Intune and Entra ID.
- Conditional access and EDR as standard.
- Security monitoring, patching and backup.
- A documented onboarding and offboarding process.
Healthcare IT Security FAQ
Not sure yet? See our managed IT pricing ranges.
Is my EMR provider responsible for securing my office computers?
No. EMR providers secure the patient database, not the devices that open it. Every computer, tablet and phone in your practice needs its own protection.
What happens if ransomware locks our computers but our EMR is in the cloud?
Your patient database stays safe in the cloud, but you cannot reach it, because the computers, network and imaging systems in your office are locked. Cloud-hosted EMRs protect the database. They do not stop ransomware on your local network and devices.
That is why we protect every device, back up everything outside the EMR and test recovery.
Does PHIPA require security beyond what my EMR provider manages?
Yes. Under Ontario’s Personal Health Information Protection Act (PHIPA), the health information custodian is responsible for protecting personal health information. In a private practice that is the physician, dentist or practice, not the EMR vendor. Your EMR provider works on your behalf, but the duty stays with you.
PHIPA requires custodians to take reasonable steps to protect personal health information against theft, loss and unauthorized use, disclosure, copying, modification or disposal. If health information is stolen, lost or accessed without authority, you must tell the affected patients at the first reasonable opportunity. In some cases, such as theft or a significant breach, you must also notify the Information and Privacy Commissioner of Ontario.
That duty covers patient information wherever it sits, not only inside the EMR. It includes referral letters saved to a desktop, scanned documents, imaging files, email, and the laptops and phones your team uses.
We protect those systems for you: every device, email, accounts and access, backups and recovery testing, with documentation of the controls in place. We do not give legal advice. Your privacy officer, your college or your lawyer decides what applies to your practice.
Do you support dental practice software and equipment?
Yes. We support servers and integration for Dentrix, Open Dental and AbleDent, imaging equipment connectivity, network segmentation, and secure remote access for dentists and staff.
Do you support medical EMRs and multiple locations?
Yes. We support PS Suite, Accuro and TELUS Health EMR environments, telehealth security, and secure connections between locations, whether each site uses the same EMR or a different one.
How quickly do you respond when technology affects patient care?
Urgent issues, such as a failed network, a server down or an active security incident, get a response within 30 minutes during business hours and within 3 hours after hours. Problems that affect appointments, EMR access or digital imaging go to the same in-house technicians who manage your systems.
Do you offer hourly or break and fix IT support for medical and dental practices?
We work with clients on a fully managed basis. One team owns your devices, accounts, security and support every day, under one monthly plan that covers your whole team.
How much do managed IT services cost for a medical or dental practice?
Managed IT is a monthly fee based on the number of staff and devices you have and the security and compliance requirements you need to meet. Team size changes what you pay. It does not change what you need.
Our pricing page shows the ranges, so you know where you stand before you book a call.
Other industries we serve Accounting firms CFO services Business consultants Private equity Wealth and investment management Market research Law firms Non profits Manufacturing Engineering and architecture Property management Telecom and infrastructure All industries Service areas
Security Driven. People Powered.
Curious What Managed IT Would Look Like For You?
Book a free discovery call with one of our co-founders. No sales team and no tech jargon, just a real conversation about your business.
Month-to-month contracts. No pressure.
On The Call, You Can
- Tell us how your team works and what is getting in the way
- Ask anything about how we work and what is included
- See how we stop the most common attacks on small teams
- Leave with clear next steps, whatever you decide