Answer 18 questions across 6 PHIPA compliance domains. Get your clinic's readiness score instantly — and know exactly what to fix before the IPC calls.
Foundational policies and designated leadership that every clinic must have in place under PHIPA.
Q01Do you have a formally designated Privacy Officer with documented responsibilities?High Risk
The Privacy Officer must be a named individual with a written job description covering their PHIPA responsibilities. "Everyone is responsible" does not satisfy this requirement.
Q02Does your clinic have a written Privacy Policy that has been reviewed within the past 12 months?High Risk
The policy must be current, version-controlled, and producible to the IPC on demand. It should describe how your clinic collects, uses, and discloses personal health information.
Q03Do you have a written Consent Management Policy defining when patient consent is required?Medium Risk
This policy should define implicit vs. express consent, how consent is recorded, and how patients can withdraw consent. Must cover all forms of PHI disclosure including referrals.
Q04Do you have a documented Records Retention and Destruction Policy?Medium Risk
PHIPA requires records to be retained for a minimum of 10 years (or until a patient turns 18). The destruction method must also be secure and documented (e.g. shredding certificates).
Domain 2 of 6
🔐 Access Control · 25% weight
Staff Access Management
Individual, role-based, and time-limited access controls are the most common source of IPC investigations.
Q05Does every staff member have their own individual EMR login — no shared accounts?High Risk
Shared accounts make audit trail attribution impossible and are a clear PHIPA violation. Each person must have unique credentials so access events can be traced to an individual.
Q06Is role-based access enforced — e.g. reception cannot view clinical notes, billing cannot view full charts?High Risk
PHIPA's "minimum necessary" principle requires that staff access only the PHI needed for their role. Unrestricted access for all staff is a significant compliance gap.
Q07Is EMR access formally revoked on an employee's last day, with written documentation?High Risk
This is the single most common finding in IPC investigations. "We meant to" is not acceptable. A formal offboarding checklist with date-stamped EMR revocation is required.
Q08Do you conduct quarterly reviews of who has EMR access at what level?Medium Risk
Regular access reviews catch stale accounts and inappropriate permissions before they become breaches. Document these reviews with a dated report showing who reviewed and what was found.
Domain 3 of 6
📋 Audit Log Monitoring · 20% weight
Audit Log Monitoring
PHIPA 2020 amendments made active monitoring — not just log collection — a legal requirement.
Q09Do you actively review your EMR audit logs on a regular, documented schedule (monthly or quarterly)?High Risk
Having logs is not enough. PHIPA 2020 amendments require documented evidence of active monitoring. Minimum: spot-check 5–10 events monthly, full after-hours review quarterly.
Q10Can you produce a complete audit log to the IPC within 24 hours if requested?High Risk
The IPC can request audit logs with little notice. You must know how to export them from your EMR, how long they are retained, and have a process to deliver them promptly and securely.
Q11Do you have a documented process for reviewing audit logs after an employee departure or patient complaint?Medium Risk
Triggered reviews are expected after certain events. Document who performs these reviews, what they look for, and what happens when a suspicious access event is found.
Domain 4 of 6
🚨 Breach Response · 20% weight
Breach Notification & Response
A documented, practised response process is the difference between a contained incident and an IPC penalty.
Q12Do you have a documented Breach Response Policy with clear step-by-step procedures?High Risk
The policy must cover: how to identify a breach, who to notify internally, how to assess risk of significant harm, when and how to notify the IPC, and how to notify affected individuals.
Q13Do all staff know how to recognize a potential breach and report it to the Privacy Officer immediately?High Risk
The 90-day IPC notification clock starts at discovery. A staff member who discovers a breach and doesn't report it immediately can cost weeks of your reporting window.
Q14Do you maintain a breach log or incident register, even for minor incidents?Medium Risk
All incidents — including minor misdirected faxes or verbal disclosures — must be logged, even if they don't meet the threshold for IPC notification. This demonstrates a culture of compliance.
Q15In the past 2 years, have you identified, assessed, and properly documented any privacy incidents?Medium Risk
Answering "No" here is often a red flag — not a good sign. In a busy clinic, minor incidents occur regularly. No incidents logged typically means incidents are not being recognized or reported.
Domain 5 of 6
🎓 Staff Training · 10% weight
Privacy Training & Agreements
Documented, recurring training is a specific PHIPA requirement — not optional best practice.
Q16Do all staff complete PHIPA privacy training before receiving EMR access, and annually thereafter?High Risk
Training must be documented with dates and names. A verbal briefing is not sufficient. Audited organizations are expected to produce training records for every staff member.
Q17Do all staff sign a confidentiality agreement before accessing PHI, renewed annually?Medium Risk
Signed confidentiality agreements are a condition of employment, not a formality. They establish the legal obligation of confidentiality and must be renewed annually and retained securely.
Domain 6 of 6
🤝 Vendor Management · 5% weight
Third-Party & Vendor Compliance
Every vendor that touches PHI must have a signed agreement — most clinics have none.
Q18Do you have signed data processing agreements with all vendors who handle PHI (EMR, billing, fax, cloud backup, transcription)?High Risk
Under PHIPA, you remain responsible for PHI even when a vendor handles it. A signed agreement must define how they protect the data, what they can do with it, and what happens if they have a breach.
Your Clinic Details
Optional — enter your details to receive a PDF copy of your results by email.
Your answers are never stored. Results are calculated instantly in your browser.
Clinic Assessment Results
—/100
—
—
—
Score by Domain
Priority Gaps to Address
Ready to close these gaps?
Auditra guides you through fixing each gap — policies, staff training, breach response, and your complete IPC documentation pack. Start your 14-day free trial today.