Tips for Ontario Businesses5 min readAugust 15, 2026

The Ontario Clinic's Network Checklist: 7 Things to Verify Before Your Next Compliance Audit

Healthcare compliance audits in Ontario increasingly scrutinize network infrastructure. Here are seven things every clinic should verify before the auditor arrives.

If your clinic operates in Ontario, you're subject to PHIPA (Personal Health Information Protection Act) — and increasingly, compliance auditors are looking beyond your software and policies to the physical and network infrastructure that supports them. A network that leaks data or can't be audited is a compliance problem, regardless of how good your EMR security settings are.

Here are seven things every Ontario clinic should verify before a compliance audit.

1. Network Segmentation

Patient data should travel on a network segment that's separated from your guest Wi-Fi, your waiting room entertainment system, and any other non-clinical traffic. If your clinical systems and your guest network are on the same VLAN, that's a finding waiting to happen. Verify that your network is properly segmented and that the segmentation is enforced at the switch level, not just through Wi-Fi SSIDs.

2. Wireless Security

All clinical Wi-Fi should use WPA3 or WPA2-Enterprise authentication. WPA2-Personal (the kind where everyone uses the same password) is not appropriate for a network carrying patient data. Verify your wireless security settings and ensure that the clinical network requires individual credentials.

3. Firewall Configuration

Your firewall should be actively managed, not set-and-forgotten. Verify that your firewall rules are documented, that unnecessary ports are closed, and that the firmware is current. An unpatched firewall is a known vulnerability.

4. Remote Access Controls

If anyone accesses your clinical systems remotely — staff working from home, your IT vendor, your EMR vendor — that access should go through a VPN with multi-factor authentication. Verify that no remote access is happening over unencrypted connections.

5. Cable and Port Documentation

Auditors increasingly ask for network documentation: what's connected to what, where cables run, which ports are active. If your network isn't documented, you can't demonstrate control over it. Verify that your cabling is labelled and that you have current network diagrams.

6. Decommissioned Equipment

Old computers, servers, and networking equipment that are no longer in use but are still physically present in your clinic are a risk — especially if they contain patient data. Verify that decommissioned equipment has been properly wiped or destroyed, and that you have documentation to prove it.

7. Incident Response Plan

If your network is breached or a device containing patient data is lost, do you have a documented plan for what to do? PHIPA requires a breach response process. Verify that your plan exists, is current, and that the relevant staff know about it.