IT for healthcare organizations

Yes. We do this regularly, and we can price it before you commit to the purchase.

Every practice you buy comes with somebody else’s decisions inside it. It has its own software, its own passwords, its own backup arrangements, and usually nothing written down. The previous owner or a local technician set things up over many years, and the reasons are not recorded anywhere. Some of what you inherit will be fine. Some of it will be a risk you did not know you were buying, such as computers that no longer receive security updates or backups that have not worked for months.

It helps to look before the deal closes. An IT review of the practice you are buying tells you what it will cost to bring it up to the standard of the rest of your group, and that figure belongs in your purchase decision.

After the purchase, we bring the new location onto the same setup as your other clinics. That covers the network, the computers, logins, security, and backups. We write up the site as we go. The period right after a purchase is also the cheapest time to fix whatever the previous owner left behind, because you are already making changes.

When each new clinic joins the same setup, the next one you buy takes weeks and not months. The steps are known, and the work is the same each time.

Your EMR or practice management software is supplied and supported by its vendor. The vendor looks after the application itself, including updates, features, and problems inside the software. What the vendor does not look after is everything the software depends on at your clinic: the network, the computers, the printers and scanners, the internet connection, the logins, and the backups of anything held on your own equipment.

That is our part. When the system is slow, the cause is often outside the application. It may be a network problem, an old computer at the front desk, an internet connection that is too small for the number of people using it, or a server that is short on space. We find the cause and fix it, and when the problem does belong to the vendor, we deal with the vendor so your staff do not have to.

We treat your practice management software as the system the whole day depends on. That affects how we plan updates, when we do maintenance, and what we fix first.

If your platform is not one we have named, ask us. We have worked alongside a range of clinical systems, and the assessment will show us how yours is set up. We will tell you plainly if we are not the right fit for it.

It depends on where your records are kept, and the assessment is where we find out.

If your practice management or EMR system is hosted by its vendor, the vendor usually backs up the patient records held in that system. You should still know what the vendor’s arrangements are and have them in writing. If the system runs on a server at your clinic, the backups are your responsibility, and they need to be made, protected, and checked.

Either way, a clinic holds more than what is in the EMR. Scanned documents, imaging, shared files, email, and financial records often sit on local computers or in Microsoft 365. Those need backing up too.

Backups are part of Elevate. The part many clinics have never done is testing. A backup job can report success every night for years and still fail when somebody tries to restore from it. The only way to know is to restore something. We test your backups, so you know they work.

How the backup is stored matters as well. If an attacker who gets into your network can also reach your backups, the backups may be encrypted along with everything else. Cyber insurers ask about this directly: whether backups are kept separate, whether they are tested, and when you last restored from one.

We record your backup arrangements in writing, so you can answer those questions when they are asked.

We set every location up the same way and write down how it works.

In a practice group that has grown over time, each clinic often has its own arrangements. One site has a newer firewall and another has the one that was installed 10 years ago. Passwords are managed differently. Backups go to different places, and at some sites nobody is sure where. Staff who move between clinics cannot log in at the second site without help.

That makes every problem harder. A fix that works at one clinic does not apply at the next. An audit or a privacy question at one site becomes a separate investigation at each of the others.

When every location follows the same setup, those problems largely go away. The same security applies everywhere. Staff can log in securely from any of your locations. A problem solved once is solved for all of them. If an auditor asks how patient information is protected, one written description covers the whole group.

Under Elevate, we manage the network, servers, and Microsoft 365 accounts across your locations. The help desk supports staff at every site, and on-site escalation is available when something cannot be fixed remotely.

The assessment covers all of your clinics. The plan sets out what each one needs to be brought onto the same setup, in priority order, with a firm price.

We control who can get into what and how they prove who they are.

The starting point is that every person has their own account. Shared logins are common in clinics because they are convenient at a busy front desk, but they make it impossible to know who opened a record. Individual accounts also mean that when somebody leaves, their access can be removed without changing a password for everyone else.

The second step is multifactor authentication, which is included in Elevate. A password alone can be guessed, reused, or stolen. With multifactor authentication, a person needs something more, such as a code or an approval on their phone. Insurers ask where it is turned on, and remote access and email are the two places they care about most.

The third step is matching access to the person’s role. Somebody who works at the front desk of one clinic does not necessarily need everything that a manager across the whole group needs. We manage who can get into what.

The fourth step is the device. A computer or laptop used to reach patient information should have endpoint protection and up-to-date patches, both of which are part of Elevate.

Once every location is set up the same way, staff can log in securely from any of your clinics. We write the arrangement down, which supports your PHIPA record-keeping.

PHIPA is the Personal Health Information Protection Act, the Ontario law that governs how personal health information is collected, used, and disclosed. It applies to health information custodians, a group that includes many clinics and health care practitioners. Among other things, it requires custodians to take reasonable steps to protect personal health information against theft, loss, and unauthorized use or disclosure.

For IT, that leads to practical questions. Who can open a patient record, and is that limited to people who need it? Does each person log in with their own account, so there is a record of who looked at what? Are computers, laptops, and phones that hold patient information protected if they are lost or stolen?

Are backups protected as carefully as the live system? If something goes wrong, will you know, and do you have a plan?

PHIPA also has rules about privacy breaches, including when patients and the Information and Privacy Commissioner of Ontario must be notified. A clinic needs to be able to tell what happened and what information was involved in order to meet them.

We help with the technical side. We set up access, logins, and backups, and we write down how your PHIPA obligations are met so you can show what you do. For the legal interpretation of PHIPA in your situation, speak to your privacy contact or lawyer, or to your regulatory college. We set up the technology to match their advice.

Managed IT for a clinic covers everything your clinical software depends on. Your practice management or electronic medical record system is what the working day depends on. It cannot run without a reliable network, working computers at the front desk and in every room, secure logins, and backups.

With Unimatrix, that work is delivered through Elevate. We manage your network, your servers, and your Microsoft 365 accounts. We apply patches and updates. We look after imaging and the hardware attached to it. We manage who can get into what, so staff can log in securely from any of your locations. We test your backups, so you know they work.

Your staff get a help desk to call. The help desk is available from 7 a.m. to 7 p.m., Monday to Friday.

Security is included. Elevate comes with email threat protection, a firewall for up to 75 users, endpoint protection, and multifactor authentication. Clinics that need monitoring and a written record of their security add Citadel Security.

We also help with the record-keeping that comes with patient information in Ontario. We write down how your PHIPA obligations are met on the technical side.

Two named people know your account, and you get a written IT plan that we review with you on a set schedule.

Your staff call the help desk, and the people who answer already know your clinic.

Two named people know your account and both have worked on it. They know which practice management system you run, how your network is laid out, and what has gone wrong before. Your staff do not have to explain the setup while patients are waiting.

The first job is to find where the problem is. If one computer cannot reach the system, it is probably that computer or its connection. If nobody can reach it, the cause may be your network, your internet connection, a server, or the software vendor’s own service. We work through those quickly. Where the cause is on your side, we fix it. Where it is on the vendor’s side, we contact the vendor and tell your staff what is happening.

The help desk, emergency network support, and on-site escalation are available from 7 a.m. to 7 p.m., Monday to Friday.

Most of the work happens before an outage. We apply updates, look after your equipment, and test your backups. The written IT plan flags equipment that is likely to fail so it can be replaced on your schedule.

Act quickly and follow a set order. A lost device is one of the most common ways patient information is put at risk, and the first hours matter.

Tell your IT provider straight away, by phone. If the device is managed, it may be possible to lock it, sign it out of clinic accounts, or erase it remotely. The staff member’s passwords should be changed, and any active sessions on their accounts should be ended.

Work out what was on the device. Was it encrypted? Did it hold patient records, or only a way to log in to a system that holds them? Was multifactor authentication turned on for those accounts? The answers decide how serious the loss is.

Tell the person responsible for privacy at your clinic. PHIPA has rules about notifying patients and, in some cases, the Information and Privacy Commissioner of Ontario when personal health information is lost or stolen. Your privacy contact or lawyer decides what those rules require in your situation.

Write down what happened, when, and what was done.

Preparation makes this much easier. Under Elevate, clinic computers have endpoint protection, staff accounts use multifactor authentication, and we manage who can get into what. We write down how your devices and logins are set up, so you can answer those questions from a record.