- SOC 2 Readiness
- 24/7 Security Monitoring
- Canadian-Based SOC
Healthcare · Health Information Act compliance scoping assessment · Alberta
Two clinics, one clear picture of their privacy and security position.
Two clinics under shared ownership had privacy documentation on file, and no independent check of whether day-to-day systems matched it.
- Client
- Silverado Medical Clinic and Vanguard Medical Clinic
- Stage
- Delivered
- Sector
- Healthcare
- Organization
- Two clinics under shared ownership
- Framework
- Alberta Health Information Act (HIA)
- Service
- Compliance scoping assessment with on-site technical work
The situation
Silverado and Vanguard share ownership, staff and clinical systems. Both hold patient health information under Alberta's Health Information Act.
The clinics had a Privacy Impact Assessment and a security manual on file, but no independent check of whether day-to-day systems matched them.
What GuardsArm did
- Reviewed the clinics' Privacy Impact Assessment, security manual and HIA forms against what was actually deployed
- Went on site at both locations to check endpoints, network equipment, email and account practices
- Captured evidence for every observation, so each one could be shown and not only asserted
- Walked the physician owner and clinic management through the results in plain language
What we found
- Practice and documentation diverged in four areas: endpoint protection, access management, network design and email security.
- Every observation in the report is tied to captured evidence.
Findings are confidential. Counts and themes are published, never hosts, addresses or finding detail.
The outcome
The clinics received a prioritized view of where practice and documentation diverged, with a costed remediation plan.
Following the walkthrough, the clinics asked GuardsArm for a remediation statement of work.
Deliverables
- Findings report
- Executive summary
- Evidence-backed readout presentation
- Remediation statement of work
More from the record
Want the same standard of work?
Tell us what you need tested, monitored or evidenced. We will come back with a scope you can act on.
24/7 SOC Monitoring Available