Discuss your project
Healthcare

Hosting healthcare and clinical applications in Canada

A healthcare application is only as dependable as where it runs. We host and operate yours in Canadian cloud regions, a Canadian data centre or your environment, with the safeguards health information demands.

Discuss your project How the work is delivered

A good fit if

  • A custom or vendor application needs a secure, supported home in Canada.
  • It runs on an ageing server or a contractor's account, and nobody is accountable.
  • Your privacy office or healthcare customers require Canadian hosting, access logs and documented safeguards.
  • You want a cloud move designed properly, not copied across, with recovery actually tested.

Another approach may suit you better if

  • It is vendor SaaS (review its contract and safeguards) or a public website without health information.
  • Your own infrastructure team runs it well and needs occasional advice: IT consulting may suit better.

What is included

  • Hosting design: region, network, identity, encryption, backups, recovery, monitoring
  • Private networking; encryption in transit and at rest, keys managed
  • SSO and MFA for administrators, and staff where supported
  • Health information access logs, kept for the period you set
  • Automated backups, regular restore tests and a disaster recovery plan
  • Monitoring, scheduled patching, and monthly service and cloud cost reports

What this service is

Hospitals, clinics, labs, care providers and digital health companies run many applications outside their main clinical system, each needing a secure place to run and someone accountable for it:

  • Departmental tools
  • Research databases
  • Interface services around the HIS
  • Patient portals
  • Booking and intake tools
  • Reporting databases
  • Custom applications
  • Digital health products

We design the hosting, move the application in and run it, with 24/7 monitoring and support for managed-service clients: a documented environment in Canada and a named team that answers for it. Changes are planned with your IT, privacy and security teams in windows that suit clinical operations, each with a rollback plan; alerts reach people who know the application; vendor updates and patches are tested outside production, then scheduled with your approval.

Where it can run

OptionDetails
Canadian cloud regionsAWS Canada Central (Montréal) and Canada West (Calgary); Azure Canada Central (Toronto) and Canada East (Québec City); Google Cloud Montréal and Toronto. Chosen to fit your agreements, skills and application.
Canadian data centreDedicated infrastructure: data centre hosting.
Your environmentYour servers or cloud tenancy, with our team running the application platform alongside your infrastructure staff.

Servers and databases are not exposed to the internet; administrators connect through secure, named, logged access, and backup and disaster recovery is proved before go-live.

PHIPA and service providers

Under Ontario's Personal Health Information Protection Act (PHIPA), a provider whose services enable a health information custodian, such as a hospital, clinic or lab, to collect, use, modify, disclose, retain or dispose of personal health information electronically must not use it except as needed to provide the services, must not disclose it, and must make sure anyone acting for it with access agrees to the same restrictions. We work under those restrictions and the written agreement your organization requires.

Where a service primarily enables two or more custodians to share personal health information with one another, PHIPA's general regulation adds requirements for health information network providers, including:

  • An electronic record of all accesses and transfers
  • A written assessment of threats, vulnerabilities, risks and privacy effects
  • A plain-language description of services and safeguards
  • A written agreement with each custodian

We design hosting so these records and documents can be produced, complete your vendor security questionnaire and provide inputs to your threat and risk assessment (TRA) and privacy impact assessment (PIA). Hospitals and agencies engage us through their procurement process; clinics, labs and companies usually start with a written proposal. If we also support or built the application, source code ownership and access are set in the same agreement, with hand-over at agreed milestones or escrow. General information, not legal advice.

Delivery

How the work is delivered

  1. Assess

    Application, data, users and dependencies; confirm residency, security and recovery requirements.

    Output: Assessment and recommended design.

  2. Design

    Network, identity, encryption, backup, recovery and monitoring, with safeguards documented for privacy and security.

    Output: Design, safeguards description, TRA inputs.

  3. Build and migrate

    Build and test, then migrate in a planned window with a rollback plan.

    Output: Production environment, migration report.

  4. Prove recovery

    Restore from backup and run a disaster recovery test before acceptance.

    Output: Recovery test results.

  5. Operate

    Monitor, patch, back up and report; review capacity, costs, risks and end-of-support dates with you.

    Output: Monthly reports, updated runbook.

Scope at a glance

Not included unless agreed

  • Cloud, data centre and licence costs, billed or passed through
  • Application code changes, unless under an application support agreement
  • Legal advice; vendor software whose licence does not allow it

What we need from you

  • Residency, retention, security and recovery requirements, and their approver
  • Installation media, code or packages; vendor hosting requirements
  • Signed privacy and security agreement before hosting health information

Before handover

  • Restores tested before go-live and on an agreed schedule after.
  • Named administrator accounts with MFA, logged; health information access logs on request.
  • Design, safeguards and runbook shared; response targets set in the agreement.

What affects the cost

  • Application size, data and users
  • Availability and recovery targets; second region or site
  • Cloud, data centre or on-premises; retention periods
  • Dedicated infrastructure, extra monitoring, application support

No package prices: estimates in Canadian dollars from an agreed scope, taxes shown separately.

Questions buyers usually ask

Does hosting in a Canadian region keep data in Canada?

The most important step, not the whole answer: backups, monitoring, support access and some managed services can involve other locations, and contracts matter as much as region. We check where every component runs and who can reach it, and document it for your privacy office.

Can you host software from another vendor?

Often, where the vendor's licence and support terms allow it. We confirm the vendor's hosting requirements first and agree who supports what, so nothing falls between us.

Who can access the data?

Only people who need to for the service, with named accounts, MFA and logged access. Under the restrictions PHIPA places on service providers, personal health information is used only as needed to provide the service and is not disclosed.

What happens if we move to another provider?

The agreement includes an exit plan: your data returned in an agreed format, documentation, configuration and credentials handed over, support for the move, and confirmed deletion of our copies.

Need a secure home in Canada for a healthcare application?

Tell us what the application does, where it runs and your privacy and recovery requirements. We will arrange a conversation and suggest a hosting approach.

Discuss healthcare hosting