North Star helps healthcare organizations turn privacy obligations into practical technology controls, documented ownership, repeatable evidence, and tested response procedures. Work is delivered remotely across Canada; any physical work is scoped separately from Prince George or Grande Prairie.
Ontario's Personal Health Information Protection Act governs how health information custodians and their agents handle personal health information. Technology supports compliance, but software alone cannot determine legal applicability or certify an organization. Your privacy officer and legal counsel define the obligations; North Star helps assess, implement, document, and operate the supporting IT controls.
Identify where personal health information is collected, stored, transmitted, backed up, printed, exported, and accessed. Record owners, vendors, integrations, retention rules, recovery paths, and unsupported systems.
Review joiner, mover, and leaver processes; privileged roles; MFA; shared accounts; emergency access; inactive users; and third-party access. Permissions should match duties and be reviewed on a defined schedule.
Confirm that important systems can record access and administrative activity, that logs are retained, and that someone is responsible for review and escalation. Monitoring must support investigation, not simply generate alerts.
Assess endpoint security, encryption, patching, email controls, network segmentation, secure configuration, protected backups, restoration testing, and the process for handling lost or stolen devices.
Document what each service provider can access, where data is handled, which safeguards apply, who owns the tenant and recovery accounts, how incidents are reported, and what happens when the relationship ends.
Build a practical response plan with decision owners, containment steps, preserved evidence, communications, legal and privacy escalation, recovery priorities, and after-action improvement.
The engagement starts with scope: applicable organizations and systems, business processes, data flows, people, service providers, physical dependencies, and existing evidence. North Star then records conditions and gaps against an agreed control set. Findings are prioritized by exposure and operational impact rather than presented as a generic checklist.
Typical deliverables can include an asset and data-flow register, access review, configuration findings, vendor responsibility matrix, backup and recovery evidence, incident-response runbook, remediation backlog, accountable owners, and a review cadence. The scope clearly distinguishes technical implementation from legal interpretation and organizational policy.
North Star is not a law firm, privacy regulator, or certification body. We do not guarantee compliance and do not replace legal advice. We provide technical assessment, implementation, documentation, monitoring, and evidence support within an agreed statement of work.
Use the Canada-wide privacy and anti-spam page for federal private-sector privacy and commercial electronic messaging requirements.
Use the cybersecurity hub for broader security assessments, identity, endpoint, email, backup, and incident planning.
Use the recovery page for retention design, protected copies, restoration testing, and documented recovery ownership.
Bring your systems, vendors, privacy responsibilities, known gaps, and deadlines. North Star will define the technical assessment and the evidence the work should produce.
Request an assessment