Healthcare.
Health information carries some of the highest impact ratings we assign, because the consequences of exposure are personal, permanent and legally consequential. Clinical continuity raises the stakes further, since a control that disrupts care is not a control anyone will keep.
Regulatory anchor. Ontario's PHIPA imposes duties on custodians of personal health information, including safeguards and breach notification.
What we assess that is specific to it.
The method does not change. What changes is what we look hardest at, and what counts as a serious result.
Personal health information. Data across clinical and administrative systems, where exposure is irreversible and reportable.
Connected medical devices. Devices and the networks they depend on, where a security control can collide with a clinical function.
Availability weighted properly. Downtime treated as a patient-safety issue, not only an operational one.
What counts as severe here.
Impact is calibrated to the sector. The same threat carries a different weight depending on what it would actually cost.
| Rating | What it means in this sector |
|---|---|
| Severe | Exposure of personal health information, or loss of a clinical system affecting patient care, with mandatory notification. |
| Major | Disruption to clinical or administrative operations requiring escalation. |
| Moderate | Contained impact managed without affecting care. |
What the report has to survive.
A healthcare report has to respect that a recommendation which disrupts clinical workflow will simply be ignored, however sound it looks on paper. Controls are tested against the way care is actually delivered, availability is weighted as a safety concern, and the duties PHIPA places on custodians are treated as the floor.
Working in healthcare?
Tell us what you run and what you need to decide. We will tell you plainly whether we are the right people for it.