Healthcare network security best practices for Canadian IT teams

Zero Trust architecture, network segmentation separating IT, OT, and medical devices, multi-factor authentication (MFA) across all accounts, TLS 1.2+ encryption for data in transit, and continuous monitoring through SIEM and EDR tools are the highest-impact controls a Canadian healthcare organisation can deploy right now. Pair those with tested, immutable backups and a ransomware recovery plan, and you have the foundation that CAN/DGSI 118:2023 requires and that PIPEDA and provincial health privacy laws expect.

Start this week:

• Enable MFA for all administrative and clinical accounts, prioritising privileged access first, aiming for broad coverage promptly.
• Isolate medical devices and OT systems onto dedicated VLANs, separated from general IT traffic as required by standards.
• Confirm your backup solution produces immutable copies and test a full restore against a recovery time objective.
• Deploy baseline logging on all network devices, servers, and EHR systems and route logs to a central SIEM.
• Run a complete asset inventory so every device on your network is known, classified, and owned for effective security tracking.

Table of Contents

• Why are Canadian healthcare networks targeted so heavily?
• Priority technical controls: your healthcare security checklist
• How to roll out these controls: a 30/90/180-day plan
• What are your Canadian regulatory obligations?
• How do you build a healthcare-ready incident response plan?
• Key takeaways
• Where healthcare IT teams most commonly misstep
• AccountNext-Nexus helps you implement these controls without the fragmentation
• Authoritative sources and further reading

Why are Canadian healthcare networks targeted so heavily?

Healthcare is among the most attacked sectors in Canada because the combination of high-value protected health information (PHI), life-critical operational dependencies, and legacy clinical systems creates an unusually profitable target. Attackers know that a hospital cannot simply take systems offline for days to recover; the pressure to pay a ransom or accept a workaround is enormous.

The attack surface has widened considerably as IT, IoT, and operational technology (OT) converge. A modern hospital network carries EHR traffic alongside MRI control systems, infusion pump telemetry, building management systems, and telehealth video sessions, often on the same flat or poorly segmented infrastructure. Medical devices and IoT introduce continuously evolving cybersecurity risks that standard IT vulnerability programmes are not designed to catch.

Ransomware incidents in Canadian healthcare have forced hospitals to divert ambulances, cancel surgeries, and revert to paper-based processes for days or weeks. The operational and patient-safety consequences are not hypothetical.

Regulatory exposure adds a second layer of urgency. Ontario's Information and Privacy Commissioner can levy administrative monetary penalties up to CAD 500,000 for organisations that fail PHIPA obligations, including failures in secure data disposal. PIPEDA breach-reporting obligations and Quebec's Law 25 add further reporting timelines and documentation requirements that a poorly monitored network makes nearly impossible to satisfy.

Priority technical controls: your healthcare security checklist

The controls below map to four defensive goals: prevent initial access, detect threats early, respond quickly, and recover without paying a ransom. They align with CAN/DGSI 118:2023 segmentation and monitoring requirements and are consistent with CISA's HPH Sector Mitigation Guide.

1. Zero Trust and least-privilege access. Treat every user and device as untrusted until verified, regardless of network location. Apply least-privilege access so a front-desk receptionist cannot view the same PHI as a physician. Automate access provisioning and revocation tied to HR events. Verify: audit privileged accounts quarterly and confirm no shared administrative credentials exist.

2. Network segmentation and microsegmentation. Separate IT, OT, and medical device traffic onto distinct VLANs with firewall-enforced access control lists (ACLs). Create a dedicated quarantine zone for newly connected or unpatched devices. CAN/DGSI 118:2023 explicitly requires segregation of healthcare technology, OT, and general IT to prevent lateral movement.

   Pro Tip: Stage segmentation using VLANs and ACLs rather than physical rewiring. Start with the highest-risk segments (medical devices, OT) and expand over 90 days. This approach cuts disruption to clinical operations while delivering immediate containment boundaries.

3. Identity and access management with MFA and PAM. Enforce MFA on every account, starting with privileged and remote-access accounts. Deploy a privileged access management (PAM) solution to vault and rotate credentials for servers, network devices, and clinical systems. Verify: confirm MFA coverage percentage monthly and target 100% for privileged accounts within 30 days.

4. Encryption for data in transit and at rest. Enforce TLS 1.2 or higher for all web-based EHR access and internal application traffic. Use IPSec for site-to-site VPN connections between facilities. Disable SSL, TLS 1.0, and TLS 1.1 across all systems. For deeper guidance on end-to-end encryption principles, the underlying concepts apply directly to PHI in transit. Verify: run a TLS configuration scan quarterly using a tool like Qualys SSL Labs or Nessus.

5. Patch and vulnerability management. Maintain a risk-based patching cadence: critical vulnerabilities within 72 hours, high within 14 days, medium within 30 days. Use a vulnerability scanner with current plugins for continuous internal scanning. Prioritise patches for internet-facing systems and EHR platforms first. Verify: track mean time to patch (MTTP) and report it monthly to leadership.

6. IoMT and medical device inventory and lifecycle controls. Every connected medical device must appear in your asset inventory with make, model, firmware version, network location, and clinical owner. Require manufacturers to demonstrate post-market vulnerability monitoring and update plans at procurement. Health Canada's pre-market cybersecurity guidance recommends cybersecurity risk management run in parallel with ISO 14971 safety processes throughout the device lifecycle. For a structured threat modelling approach to device risk, the STRIDE framework provides a practical taxonomy. Verify: reconcile the device inventory against DHCP leases and switch port tables monthly.

7. SIEM, EDR, and continuous logging. Route logs from all network devices, servers, EHR systems, and endpoints to a centralised SIEM. Deploy EDR on all endpoints and servers. eHealth Ontario's Threat Risk Management standard mandates logging, monitoring, and regular threat risk assessments for EHR solutions. Set alert thresholds for anomalous authentication attempts, lateral movement, and large data transfers. For integration patterns, the enterprise threat detection guide covers SIEM and cloud telemetry configuration. Verify: confirm log retention meets provincial requirements (typically 7 years for health records) and test alert rules quarterly.

8. Secure remote access and telehealth hardening. Require VPN with MFA for all remote access. Enforce TLS for telehealth platforms and restrict access to approved, managed devices where possible. Segment telehealth traffic from clinical systems. Cloud-hosted EHRs and telehealth platforms carry their own configuration risks; the cloud security in healthcare guide covers those specifics. Verify: audit remote-access session logs weekly and confirm no split-tunnel configurations bypass security controls.

9. Backup strategy and immutable backups. Follow the 3-2-1-1 rule: three copies, two media types, one offsite, one immutable (air-gapped or object-locked). Test a full restore at least quarterly and document the recovery time objective (RTO) and recovery point objective (RPO). Verify: confirm restore tests are logged and that backup integrity checks run automatically.

10. Third-party and vendor risk management. Require security attestations (SOC 2 Type II or equivalent) from all vendors with access to PHI or your network. Include contractual security requirements, breach notification obligations, and the right to audit. Verify: maintain a vendor risk register and review it at each contract renewal.

11. Employee awareness and phishing defence. Run phishing simulations quarterly and provide targeted training to staff who click. Enforce email filtering with DMARC, DKIM, and SPF. The most common employee cybersecurity vulnerabilities in healthcare are credential theft via phishing and accidental PHI disclosure. Verify: track click rates on simulated phishing campaigns and target below 5%.

How to roll out these controls: a 30/90/180-day plan

A risk-based rollout balances urgent fixes against medium-term protective controls and longer-term architecture changes, without triggering clinical downtime. The table below maps milestones to owners and measurable success criteria.

Healthcare-specific constraint: schedule segmentation changes and vulnerability scans during maintenance windows agreed with clinical operations. Standard vulnerability scans can render devices like MRI or CT systems inoperable; coordinate OT testing with device manufacturers and clinical owners before running any scan against medical equipment.

What are your Canadian regulatory obligations?

Several controls described above are not just good practice; they are explicitly required or strongly recommended under Canadian standards and provincial privacy laws. Treating them as optional creates both patient-safety and legal exposure.

1. CAN/DGSI 118:2023 requires network segmentation, continuous monitoring, and a parallel risk management programme for medical devices and OT. Organisations subject to this standard must document segmentation architecture and demonstrate monitoring coverage to auditors.

2. PHIPA (Ontario) and equivalent provincial health privacy acts require breach notification, secure disposal of PHI-bearing assets, and documented access controls. The IPC treats missing ITAD records as evidence that destruction did not occur. A compliant ITAD programme includes per-device certificates of destruction, pickup documentation, secure transport records, and retention of those records for a minimum of 24 months.

3. PIPEDA requires organisations to report breaches of security safeguards that create a real risk of significant harm, within a reasonable timeframe, to the Office of the Privacy Commissioner of Canada. Document your breach detection and notification workflow before an incident occurs.

4. Quebec Law 25 imposes 72-hour notification to the Commission d'accès à l'information for incidents affecting personal information, and requires a privacy impact assessment for new technology deployments involving personal data.

5. eHealth Ontario's Threat Risk Management standard mandates logging, monitoring, regular threat risk assessments, and vendor assurance for EHR solutions used in Ontario. Retain TRA reports and penetration test results as audit evidence.

6. Health Canada medical device cybersecurity guidance places obligations on both manufacturers and purchasers. At procurement, require manufacturers to demonstrate post-market vulnerability monitoring, a software bill of materials (SBOM), and a documented update and patch plan. See the medical device cybersecurity compliance guide for procurement checklist details.

What auditors expect to see: network segmentation diagrams, SIEM log retention records, penetration test reports (with OT-safe methodology noted), ITAD certificates of destruction, incident response runbooks with notification timelines, and vendor security attestations. Gaps in any of these are findings, not observations.

• Maintain a documented device classification policy that maps PHI sensitivity to network zone to support segmentation controls.
• Keep ITAD records and store them separately from the disposed assets to maintain compliance and audit readiness.
• Test your breach notification workflow annually; confirm the responsible officer and the OPC reporting portal are known to your team before an incident.
• Participate in information-sharing groups such as Health-ISAC to access national and international threat intelligence that supports vulnerability prioritisation and threat hunting.

How do you build a healthcare-ready incident response plan?

An incident response (IR) plan for healthcare must pair technical containment with clinical continuity. The moment a ransomware event locks your EHR, the question is not just "how do we recover the data?" but "how do we keep patients safe for the next 72 hours?"

Minimum IR plan components:

• Roles and responsibilities: name an incident commander, a clinical liaison, a legal/privacy officer, and a communications lead. Every role needs a backup.
• Isolation procedures: document which systems to isolate first, in what order, and who has the authority to disconnect clinical systems.
• Forensic evidence handling: preserve logs and disk images before remediation. Engage a forensic vendor under a pre-negotiated retainer so you are not negotiating contracts during an active incident.
• Legal and regulatory notification triggers: map specific event types to PIPEDA, PHIPA, and Law 25 notification timelines. A breach affecting PHI in Ontario triggers PHIPA obligations; document the threshold and the clock.
• Communication templates: prepare plain-language templates for clinical staff, patients, and media before you need them.

Tabletop exercise structure. Run a 90-minute scenario quarterly. Assign roles, present an inject (for example: "Ransomware has encrypted three file servers and your EHR is unreachable"), and walk through detection, escalation, isolation, clinical continuity activation, and regulatory notification decisions. The goal is not to test technical skills; it is to surface gaps in decision-making authority and communication. Document findings and assign remediation owners before the next exercise.

Backup validation is where most plans fail. A backup that has never been restored is a theory. Test a full restore of your EHR and critical clinical systems at least quarterly, document the time to restore against your RTO, and confirm the restored data matches your RPO. If your RTO is 4 hours but your last restore test took 18 hours, that gap is your real risk. Coordinate forensic vendor engagement early; OT-focused penetration testing and post-incident forensics on medical devices require non-intrusive methods and manufacturer coordination to avoid rendering clinical equipment inoperable.

Key takeaways

Securing a Canadian healthcare network requires Zero Trust access controls, CAN/DGSI 118:2023-aligned segmentation, and tested recovery plans working together — no single control is sufficient on its own.

Where healthcare IT teams most commonly misstep

The conventional wisdom in healthcare security tends to frame Zero Trust as a multi-year transformation that requires a full architecture overhaul before it delivers value. That framing causes teams to delay the controls that would protect them this quarter while waiting for a perfect programme that may never be fully funded.

The reality is more practical. Segmenting medical devices onto a dedicated VLAN and enforcing MFA on privileged accounts are two-week projects that deliver immediate, measurable containment. They do not require a Zero Trust platform licence or a six-month design engagement. The architecture can mature around those quick wins.

The trade-offs that actually slow teams down are operational, not technical. Scheduling a segmentation change that touches infusion pumps or imaging systems requires clinical buy-in, a maintenance window, and a rollback plan. Vulnerability scanning OT devices without coordinating with manufacturers and clinical owners risks taking equipment offline mid-shift. These are solvable problems, but they require IT and clinical operations to plan together, which most security programmes are not structured to do.

Budget constraints are real, but the framing matters. A tested backup and a segmented network are not expensive relative to the cost of a ransomware recovery without them. The organisations that struggle most are those that treat security as a capital project rather than an operational discipline. Monthly patching, quarterly restore tests, and annual tabletop exercises cost far less than the alternative.

The compliance side is where documentation gaps create the most exposure. Missing ITAD records, untested breach notification workflows, and vendor contracts without security clauses are the findings that turn a manageable incident into a regulatory penalty. Build the documentation habits before the auditor or the incident arrives.

AccountNext-Nexus helps you implement these controls without the fragmentation

Most healthcare IT teams are not short on knowledge about what needs to be done. They are short on the capacity to do it across identity, segmentation, monitoring, backups, and compliance simultaneously, without disrupting clinical operations. That is the gap AccountNext-Nexus fills.

AccountNext-Nexus consolidates 24/7 threat monitoring, managed detection and response, SIEM and EDR integration, segmentation projects, tested backup management, and ITAD compliance support under one programme with transparent pricing. No coordinating five separate vendors. No gaps between your monitoring tool and your incident response team.

A free readiness assessment covers:

• Current segmentation architecture review against CAN/DGSI 118:2023 requirements
• MFA and privileged access coverage audit
• Backup integrity and RTO validation check
• Regulatory gap analysis against PHIPA, PIPEDA, and applicable provincial obligations
• Prioritised 30/90/180-day remediation roadmap delivered within two weeks

Healthcare organisations across Canada use AccountNext-Nexus to move from a fragmented security posture to a consolidated, auditable programme. Book your free readiness assessment to get a prioritised roadmap specific to your environment, or visit AccountNext-Nexus to learn more about the full service offering.

Authoritative sources and further reading

The following sources are cited in this article and provide the primary standards, government guidance, and technical frameworks referenced throughout.

• CAN/DGSI 118:2023, HealthCareCAN — The Canadian standard for cyber resiliency in healthcare. Covers segmentation, monitoring, OT risk management, and the patient-safety framing of cybersecurity obligations. Start here for compliance alignment.
• CAN/DGSI 118:2023 full PDF, HealthCareCAN — The complete standard document, including OT-specific vulnerability management, penetration testing guidance, and device lifecycle requirements.
• Health Canada — Pre-market Requirements for Medical Device Cybersecurity — Manufacturer and purchaser obligations for device cybersecurity, including NIST framework alignment and post-market monitoring requirements.
• eHealth Ontario — Threat Risk Management Standard v1.7 — Ontario's EHR security standard covering logging, monitoring, TRAs, and vendor assurance requirements.
• Information and Privacy Commissioner of Ontario (IPC) — PHIPA enforcement authority. Relevant for ITAD compliance, breach notification obligations, and administrative monetary penalty exposure up to CAD 500,000.
• eCycle Solutions — Secure Healthcare ITAD Canada — Practical ITAD guidance for healthcare organisations, including chain-of-custody documentation requirements and 24-month record retention.
• CISA — HPH Sector Mitigation Guide — U.S.-origin but widely referenced in Canadian healthcare security programmes. Covers asset inventory, segmentation, encryption, and vulnerability management best practices for the health sector.
• CISA — Healthcare and Public Health Cybersecurity — Toolkit consolidating key resources, threat intelligence, and training for health sector organisations.
• HHS HICP Technical Volume 2 — Detailed technical cybersecurity practices for medium and large healthcare organisations, including network management, segmentation, and endpoint protection sub-practices.
• Cyber.gc.ca — Cyber Security for Healthcare Organizations — Canadian Centre for Cyber Security guidance specifically for healthcare organisations; the Canadian equivalent of CISA's HPH resources.
• Health-ISAC — The global health information sharing and analysis centre. Participation provides access to sector-specific threat intelligence and peer collaboration on emerging threats.

Recommended

• Cloud security in healthcare: protecting patient data in 2026
• Security operations: a complete guide for 2026
• Managed IT services: the 2026 Canadian business guide
• Computer networks explained: types, components, and security