The short answer
O. Reg. 51/26, the cyber security regulation under Ontario's Enhancing Digital Security and Trust Act, 2024, took effect on 1 July 2026. It applies to public hospitals classified as Group A, B or C, according to the Ontario Hospital Association. They must designate a cyber security contact, assess maturity by 1 July 2027 and every two years after, and report critical incidents within 72 hours of confirming them.
The details, and who is covered
The contact
A senior management employee with decision-making authority, plus an alternate, deals with the Ministry.
The assessment
Under standards or best practices endorsed by the Ministry's Chief Information Security Officer.
The summary
To the Ministry within 30 days: framework used, any maturity scores, areas for improvement.
An assessment completed between 1 July 2025 and 1 July 2026 counts as completed on 1 July 2026, so the next is due by 1 July 2028. The Act is Schedule 1 of Bill 194 (Royal Assent 25 November 2024) and also covers entities such as school boards, colleges, universities and children's aid societies. Coverage turns on your Public Hospitals Act classification. In a shared IT or health information system partnership, each member hospital has its own contact, assessment and reporting duties. General information, not legal advice: confirm with your legal and privacy advisers.
What counts as a critical incident
An incident affecting the digital information your hospital collects, uses, keeps or discloses, or the infrastructure holding or moving it, is critical if it meets at least one of:
Public services
A significant adverse impact on the delivery of public services.
Public safety
A risk to public safety.
Recovery
Significant recovery efforts, or activation of a cyber security incident response plan.
Public confidence
A significant risk of harm to the hospital's reputation and public confidence.
Building the 72-hour step into your incident plan
- Define "confirmed"Write down what it means and who decides: the clock starts there.
- Name the reporterDesignated contact and alternate in the call tree, with after-hours details.
- Template the reportWhat happened, services and systems affected, what you did, what you need.
- Track other dutiesYour privacy officer owns them; the incident lead knows when to involve them.
Rather talk it through? If your incident plan has no clear activation point or your vendors would not tell you quickly, we can help you fix both before the next incident. Talk to a Promatics specialist
What your vendors and shared service providers must give you
The duties sit with the hospital, but many incidents begin at a software vendor, host or shared service organization, and one provider's incident can become five hospitals' incident.
Example: TransForm, October 2023
A ransomware attack on TransForm Shared Service Organization, the IT provider for five southwestern Ontario hospitals (Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare and Windsor Regional Hospital), caused an outage announced on 23 October 2023 and delayed appointments. TransForm said data on about 267,000 people was taken and that it would not pay the ransom.
To meet a 72-hour deadline, your contracts should give you:
Notice in hours
Not days, for any suspected incident affecting you, with named contacts on both sides.
Logs and evidence
Kept for an agreed period, so you can confirm what happened.
Cooperation
With your investigation, insurer and the Ministry, including a summary for your report.
Their controls
A description of their own controls, and a seat at your tabletop exercises.
Read your largest contracts first: the hospital information system, hosting, managed IT and any provider with remote access.
Preparing for your first maturity assessment
The regulation's text names no single framework, and the Ministry has published implementation guidance: check it before choosing. Many organizations use frameworks such as the NIST Cybersecurity Framework; let the guidance decide. Start early by gathering:
- Policies
- Asset inventory
- Access reviews
- Backup test results
- Patching records
- Incident history
Assess honestly: a low score with a clear improvement plan serves your board and the Ministry better than an inflated one, and the summary asks for areas for improvement anyway.
Practise with tabletop exercises
A two-hour tabletop tests the plan on paper and in people's heads. Walk IT, clinical leadership, privacy, communications and a key vendor through a scenario (say, ransomware at a shared provider on a Friday evening). Time how long confirming the incident and drafting the Ministry report take. Fix what you learn; repeat yearly.
When to bring in help
Hospitals with a security team often need help only with pieces, such as an independent assessment or vendor contract review. Smaller or stretched teams benefit from help updating the incident plan, running the first tabletop, reviewing vendor terms and preparing assessment evidence while they keep the hospital running.
Our managed and co-managed IT and security for hospitals works alongside your IT team, with 24/7 monitoring and support for managed-service clients. To check the suppliers behind your clinical software, see our checklist for choosing a hospital software partner.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- O. Reg. 51/26: Cyber Security, under the Enhancing Digital Security and Trust Act, 2024, Government of Ontario (e-Laws)
- Enhancing Digital Security and Trust Act, 2024, Government of Ontario (e-Laws)
- Ontario introduces cyber and educational technology regulations, Borden Ladner Gervais LLP
- Compliance Compass: legal and regulatory highlights for hospitals, July 2026, Ontario Hospital Association
- Cyber incident updates and frequently asked questions, TransForm Shared Service Organization
- Cybersecurity Framework, National Institute of Standards and Technology (NIST)
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.