PHIPA-ready IT management for Canadian hospitals, clinics, and health authorities.
Contact Us
Most healthcare IT content you'll find was written for American hospitals. It talks about HIPAA, covered entities, and ePHI. None of that is your legal framework.
In Canada you answer to provincial health privacy legislation. In Ontario that's PHIPA, the Personal Health Information Protection Act, which makes you a health information custodian with specific duties around who may access a patient record, how long you keep the evidence, and how quickly you report a breach. Manitoba, Nova Scotia, and Newfoundland and Labrador have their own Personal Health Information Acts. Alberta has the Health Information Act. The obligations differ, but they all come back to the same question: can you show who touched which record, and when?
Optrics has been an authorized Canadian ManageEngine reseller since 2010. We sell and support into Canada only, so the deployments we've done are Canadian deployments under Canadian rules.
Talk to Optrics
Privacy legislation doesn't ask whether you have a policy. It asks whether you can produce evidence. In practice, an audit or a breach investigation comes down to four things, and all four are IT problems before they're policy problems.
And were they entitled to? Snooping by an authorized user is the most common health privacy breach, and it's invisible without file and directory auditing.
Evidence that has already rolled off a server is the same as no evidence. Retention windows matter as much as capture.
Clinical staff rotate constantly. Accounts that outlive the placement are the standing risk.
Breach reporting timelines assume you can reconstruct events in days, not weeks. The tools you deploy determine which side of that line you land on.
Healthcare IT isn't ordinary corporate IT with stricter rules. The constraints are different, and they shape which capabilities matter.
Clinical systems have maintenance windows measured in hours a month. A workstation on a ward can't reboot mid-shift. Patching has to be scheduled around care, not around IT convenience.
When six clinicians use one terminal, "the account did it" isn't an answer to who did it.
Imaging equipment, infusion pumps, and lab instruments often run software you can't modify and versions you can't upgrade.
When the EMR is unavailable, care moves to paper, and recovery is measured in patient risk, not in tickets.
A clinician locked out at shift change will find a workaround, and the workaround is usually a shared credential.
Every capability on this list is delivered by a specific ManageEngine product. Follow the links to see how each one works in detail.
File and folder auditing across your record stores, with reports built for a privacy officer rather than a sysadmin.
Products: ADAudit Plus, DataSecurity Plus
Centralised log collection and retention so the trail still exists when someone asks about an access from eight months ago.
Products: EventLog Analyzer, Log360
Provisioning and deprovisioning tied to your HR process, with an audit trail of every permission change.
Product: ADManager Plus
Maintenance windows, phased rollouts, and per-department scheduling for workstations that can't reboot on demand.
Products: Endpoint Central, Patch Manager Plus
Self-service password reset from the login screen, so a clinician at shift change doesn't need a help desk ticket or a colleague's credentials.
Product: ADSelfService Plus
Network discovery and monitoring for connected clinical equipment, so unmanaged devices are at least visible.
Product: OpManager
Practical questions you can verify this week. Not one of these requires a lawyer to answer, but every one of them is what a privacy officer or auditor will ask.
Yes, through capabilities that map to what PHIPA actually asks of a health information custodian: access logging on record stores, log retention for as long as your obligation runs, evidence of provisioning and revocation, and the ability to reconstruct events during a breach investigation. The products that deliver these are ADAudit Plus, EventLog Analyzer, ADManager Plus, and Log360.
In IT terms, it comes down to four questions: who accessed a patient record, when did they access it, who authorized that access originally, and how fast can you produce that information if asked. The tooling you deploy determines whether those questions have answers.
Data residency is a real buying question for Canadian health data. All the ManageEngine products called out on this page are available in on-premises editions that run on your own servers in Canada. Cloud editions are also available, and where relevant we can point you at the ManageEngine Canada Cloud region for hosted deployments.
Endpoint Central handles the workstation itself: patching around shift schedules, enforcing configuration standards, and inventorying what's actually running. Identity attribution during a shift is handled at the login layer through Active Directory, which is where ADAudit Plus and ADManager Plus become the accountability backbone for who was on that terminal, and when.
Yes, but be honest about the scope. OpManager can discover and monitor network-connected medical devices for availability and network performance. You'll see when a device disappears or misbehaves on the network. What you can't do through OpManager is patch or reconfigure firmware on equipment the vendor has locked down. Monitoring gives you visibility; the vendor relationship is what gives you the ability to change anything.
Our Edmonton-based team quotes in CAD, supports on Canadian time zones, and has spent 15 years deploying ManageEngine into Canadian environments.
