Month: May 2026

You built the DLP policy. The compliance checkbox is checked. Three months later, sensitive data walks out the door anyway. This is not a hypothetical: it is the most common outcome for Microsoft 365 DLP deployments that were done right on paper but wrong in practice.

This post covers the five mistakes that consistently undermine Microsoft Purview DLP deployments in mid-market organizations, what the enforcement limits actually look like, and what a properly structured DLP policy set should include.

Mistake 1: Treating Microsoft Purview DLP as a Single System

The most damaging architectural misunderstanding in DLP deployments is treating “Microsoft Purview DLP” as a unified enforcement layer. It is not. When you create a policy in the Purview compliance portal, you are writing instructions that will be interpreted separately by up to four different enforcement engines: Exchange Online, SharePoint and OneDrive, Microsoft Teams, and Windows endpoint devices.

Each engine has its own enforcement model, its own latency, and its own limitations. A policy scoped to Exchange will not protect Teams messages, even if the content is identical. A policy covering SharePoint document libraries will not catch a file being copied to a USB drive. These are not bugs; they are the architecture. The problem is that the Purview portal makes it easy to scope a policy to “all locations” with a single toggle, but what that actually enforces in each context requires reading the DLP policy reference documentation carefully.

In our work with mid-market GTA organizations, this is the single most common gap we find when reviewing existing DLP configurations: a well-written Exchange policy that was never extended to Teams or SharePoint, because the team assumed one policy covered everything.

Mistake 2: Not Knowing Your Licensing Ceiling Before You Design

Microsoft Purview DLP capabilities are split across licence tiers in ways that are not obvious until you try to enable a feature. Teams message DLP, endpoint DLP, and Adaptive Protection (which dynamically tightens controls based on insider risk signals) all require licences beyond what most mid-market organizations already have.

If your organization is on M365 Business Premium or E3, Teams DLP and endpoint DLP are not available without adding the Microsoft 365 E5 Compliance add-on. Knowing this before you build your DLP program means you can scope policies realistically, communicate gaps to leadership, and budget for the correct licence tier if Teams or endpoint coverage is required.

Mistake 3: Ignoring Policy Priority Order and Conflict Resolution

When multiple DLP policies match the same event, Microsoft Purview applies the most restrictive action from the highest-priority policy. Priority is determined by the order policies appear in the Purview compliance portal: lower number equals higher priority. Most organizations never configure this deliberately. The result is that whichever policy was created first gets the highest priority by default, which is almost never the right outcome.

The practical consequence: if you have a broad informational policy set to audit-only that was created early in your deployment, and a stricter block policy created later, the audit policy will win for any content matching both. Your block rule never fires. This is not visible in normal portal views; you need to check Activity Explorer to see which policy matched and what action was taken.

Mistake 4: Treating False Positive Management as a Launch Task

Every Purview DLP deployment generates false positives. The volume depends on how broadly your sensitive information types are scoped and how much your organization’s legitimate work involves content that resembles sensitive data. Financial services, legal, and healthcare firms are especially prone to high false positive rates because credit card numbers, Social Insurance Numbers, and health identifiers appear regularly in day-to-day documents.

The mistake is treating false positive resolution as something you do at launch and then move on from. In practice, the alert queue grows continuously. Without a defined review workflow, it becomes a backlog that no one looks at. When the alert queue is ignored, legitimate violations get buried alongside noise, which defeats the purpose of the system entirely.

A workable false positive workflow has three components: a defined owner for the DLP alert queue (usually the IT security lead or a shared security operations function), a weekly triage cadence during the first 90 days of any new policy, and a documented threshold for when a false positive rate triggers a policy tune-up. The DLP Alerts dashboard allows you to classify each alert as a true positive, false positive, or benign — use that classification consistently so you can track your false positive rate over time and demonstrate to leadership that the policy is being actively managed.

Mistake 5: Assuming SharePoint DLP Coverage Is Real-Time

DLP enforcement on SharePoint and OneDrive operates on the search crawler index, not on the file upload event itself. When a file lands in SharePoint, it is not immediately scanned for sensitive content. It is evaluated when the search crawler processes it, which can take anywhere from minutes to several hours depending on crawl queue depth and file volume.

This matters most during bulk data migrations or large file imports. If your organization migrates a file share to SharePoint, thousands of files enter the environment before DLP has had a chance to evaluate any of them. For organizations subject to PIPEDA breach notification obligations, this is a real compliance exposure window, not a theoretical one.

What Microsoft Purview DLP Cannot Protect Against

Understanding where enforcement ends is as important as knowing what it covers. These are the gaps no Purview DLP policy can close on its own:

• Images and screenshots: Purview DLP does not inspect image files or screen captures for sensitive content. A Social Insurance Number or credit card number in a scanned PDF or screenshot is invisible to the policy engine.
• ZIP and compressed archives: Files inside a ZIP archive are not inspected. Sensitive content inside a compressed file bypasses detection entirely.
• BYOD and unmanaged personal devices: Endpoint DLP requires Intune management or Purview device onboarding. Personal devices used for work are not covered unless enrolled in device management.
• Third-party SaaS applications: Purview DLP does not extend to Slack, Google Drive, Salesforce, or any non-Microsoft SaaS tool. Data moving to or from those platforms is outside scope.
• Camera and verbal disclosure: Someone photographing a screen or reading sensitive data aloud cannot be detected by any DLP system. These insider risk scenarios require procedural controls, not technical ones.

These gaps are not reasons to avoid Purview DLP; they are reasons to layer it with complementary controls including managed detection and response, Purview Insider Risk Management, and Conditional Access policies that restrict where sensitive data can be accessed from.

A Minimum Viable DLP Policy Set for Mid-Market Canadian Organizations

Based on deployments across GTA mid-market clients, this is the minimum policy set that provides meaningful coverage across M365 for organizations on E3 or Business Premium. Organizations on E5 should extend each policy to include endpoint and Teams locations where applicable.

If you are reviewing your M365 DLP configuration or starting from scratch, the team at Balanced+ works with mid-market GTA organizations on managed cybersecurity services that include Purview DLP design, deployment, and ongoing alert management. A configuration review is often enough to surface the most critical gaps before they become incidents.

Frequently Asked Questions

What is a DLP policy in Microsoft 365?

A DLP policy in Microsoft 365 is a rule set configured in the Microsoft Purview compliance portal that detects sensitive information (such as credit card numbers, Social Insurance Numbers, or health data) across M365 services and takes automated action when a match is found. Actions can include auditing the event, displaying a policy tip to the user, blocking the action, or alerting a compliance administrator. Each policy applies separately to the enforcement engine of each selected service location.

Does one DLP policy cover Exchange, Teams, and SharePoint at the same time?

A policy can be scoped to multiple locations, but each location is enforced by a separate engine with its own behaviour and limitations. Teams DLP requires an E5 or E5 Compliance licence; without it, Teams is not covered even if selected in the policy scope. SharePoint enforcement is based on the search crawler index rather than real-time file events. Exchange enforcement is near-real-time. Each location should be verified independently to confirm enforcement is actually active.

How long does it take for a new DLP policy to take effect?

According to Microsoft’s DLP documentation, policies generally take effect about an hour after being turned on. SharePoint and OneDrive enforcement depends on the search crawler, which may add additional lag. Do not test enforcement immediately after creating a policy; allow at least an hour before concluding that a rule is not working.

What is the difference between audit mode and enforce mode in Purview DLP?

In audit mode, Purview DLP logs all policy matches and generates alerts but does not take any action on the content or notify users. This is the recommended starting point for any new policy, as it lets you assess match volume, identify false positives, and tune rules before any user-facing disruption occurs. Enforce mode takes the configured action (such as blocking a send or displaying a policy tip). Moving from audit to enforce should happen only after at least two weeks of alert review and active tuning.

Sources

• Data loss prevention policy reference, Microsoft Learn, 2025
• Data Breach Investigations Report 2026, Verizon, 2026
• Privacy breaches: mandatory reporting of breaches of security safeguards, Office of the Privacy Commissioner of Canada
• Get started with the data loss prevention Alerts dashboard, Microsoft Learn, 2025

Every year, businesses lose more money to business email compromise than to ransomware, data breaches, and most other forms of cybercrime combined. And unlike ransomware, you often don’t know it happened until the funds are already gone and the attacker has disappeared.

This post breaks down what BEC is, how attacks unfold step by step, and what controls actually stop them before money moves.

What Is Business Email Compromise?

The FBI tracks BEC separately from other cybercrime precisely because of its outsized financial impact. According to the FBI Internet Crime Complaint Center (IC3) 2023 Annual Report, BEC and its variant email account compromise (EAC) generated over $2.9 billion in reported losses in the United States alone in 2023, making it the highest-loss cybercrime category tracked by the FBI for the third consecutive year.

How Does a BEC Attack Work?

BEC attacks follow a recognizable pattern even when the specifics vary. The attacker doesn’t need malware or a zero-day exploit. They need a convincing email, a sense of urgency, and a target who hasn’t been trained to pause and verify.

The Five Types of BEC Attacks

The FBI IC3 categorizes BEC into five primary scenarios. Knowing which type is targeting your organization shapes how you respond and train.

• CEO fraud: An executive’s email is spoofed or compromised. Finance or accounting receives an urgent wire transfer request, often referencing a real deal or deadline.
• Vendor/invoice impersonation: Attackers pose as a known supplier and request a banking detail change on a pending invoice. The next legitimate payment lands in the attacker’s account.
• Account compromise: A legitimate employee’s email account is hacked and used to request fraudulent payments from customers or partners who trust the sender.
• Attorney impersonation: Criminals pose as a law firm handling a sensitive, time-critical transaction and pressure the target to act quickly and confidentially.
• Data theft (W-2 and payroll fraud): HR or finance is tricked into sending employee payroll data, W-2 equivalents, or PII that enables follow-on identity fraud or tax fraud.

BEC vs. Phishing: What’s the Difference?

BEC is often grouped with phishing, but they are meaningfully different attacks that require different defenses. Phishing is a scattershot campaign; BEC is a targeted strike built around research and impersonation.

Why Are BEC Attacks So Hard to Stop?

Three factors make BEC attacks unusually dangerous compared to other email threats.

They bypass technical defenses. A well-crafted BEC email contains no malicious links, no attachments, and no executable code. It can pass SPF, DKIM, and DMARC checks if the attacker has registered a convincing look-alike domain. Standard email security tools have nothing to flag.

They exploit human psychology. Urgency, authority, and secrecy are baked into every BEC script. “I need this done before the wire cutoff at 3 PM.” “Don’t loop in accounting on this, it’s a confidential matter.” These triggers short-circuit the verification habits that people apply under normal circumstances.

They’re cheap to run. Researching a target on LinkedIn costs nothing. Registering a look-alike domain costs under $20. The attacker’s return on investment is extraordinary relative to the effort required, which is why BEC volume has grown steadily even as other cybercrime tactics have faced increasing technical barriers.

Warning Signs of a BEC Attempt

Domain spoofing is subtle. Attackers register variations that look correct at a glance: adding a hyphen, swapping a letter (rn for m), or using a country-code TLD like .ca instead of .com. Training employees to check the actual sending address, not just the display name, catches a large percentage of attempts before any action is taken.

How to Protect Your Business From BEC

No single control stops BEC. The organizations that avoid significant losses combine technical safeguards with process controls and ongoing training, so that multiple layers must fail simultaneously for an attack to succeed.

What to Do If Your Business Has Been Targeted

Speed is the only meaningful variable in BEC recovery. If a fraudulent transfer has occurred, every hour reduces the chance of recovery.

At Balanced+, our managed cybersecurity services include email security configuration, security awareness training tailored to BEC scenarios, and ongoing monitoring that catches the account compromise attempts that often precede a BEC attack. If you’re not confident your team and your controls would stop a well-researched impersonation attempt, let’s talk.

Frequently Asked Questions

What is the most common type of BEC attack?

CEO fraud and vendor/invoice impersonation are the most frequently reported BEC variants. In CEO fraud, an executive’s email is spoofed or compromised and used to pressure a finance employee into an urgent wire transfer. In vendor impersonation, attackers pose as a known supplier and request a banking detail update before a scheduled payment, redirecting the next legitimate payment to an attacker-controlled account.

Can spam filters stop a BEC attack?

Standard spam filters and antivirus tools are largely ineffective against BEC because the attacks contain no malicious links or file attachments. The email often looks entirely legitimate. Effective defenses are process-based (verbal verification policies) and technical (MFA, DMARC/DKIM/SPF, external sender banners) rather than filter-based.

What is the difference between BEC and EAC?

BEC (Business Email Compromise) typically involves impersonation without actually accessing a real email account. EAC (Email Account Compromise) goes further: the attacker gains control of a legitimate account and sends fraudulent requests directly from it. EAC is harder to detect because the emails originate from a real, trusted address and pass all authentication checks. The FBI IC3 tracks both under the same reporting category because the financial impact and attack goals are the same.

How much do BEC attacks cost Canadian businesses?

The Canadian Anti-Fraud Centre (CAFC) tracks BEC as one of the top fraud categories affecting Canadian organizations, though losses are widely underreported. The CCCS National Cyber Threat Assessment 2025-2026 identifies BEC as a persistent and growing threat to Canadian businesses of all sizes. US figures from the FBI IC3 serve as a useful proxy: $2.9 billion in reported losses in 2023 from roughly 21,000 complaints, suggesting an average loss well above $100,000 per incident.

Sources

• FBI Internet Crime Complaint Center (IC3) 2023 Annual Report , Federal Bureau of Investigation, 2024
• Business Email Compromise: The $50 Billion Scam , FBI IC3, 2024
• Implementation Guidance: Email Domain Protection , Canadian Centre for Cyber Security (CCCS), 2023
• National Cyber Threat Assessment 2025-2026 , Canadian Centre for Cyber Security (CCCS), 2025
• Report a Fraud , Canadian Anti-Fraud Centre (CAFC)

In late April 2026, a threat actor known as ShinyHunters quietly compromised Instructure, the company behind Canvas LMS, one of the most widely used learning management systems in the world. By the time the breach surfaced publicly in early May, an estimated 275 million students and educators across roughly 9,000 institutions had their personal data sitting in the hands of a ransomware group with a May 12 deadline to collect.

This post breaks down exactly what happened, how attacks like this unfold, and what the warning signs look like. More importantly, it covers what organizations outside education should take from this. If your business relies on a SaaS vendor for anything mission-critical, the Canvas breach is a direct signal about your own exposure.

What Actually Happened: The Canvas Breach Timeline

According to Krebs on Security, the intrusion appears to have begun around April 29-30, 2026. ShinyHunters, a prolific cybercriminal group previously tied to the 2021 AT&T breach and the 2022 Wattpad leak, gained access to Instructure systems and began exfiltrating data. The group claimed to have taken records covering names, email addresses, student IDs, and internal platform messages.

Instructure confirmed the breach but stated that no passwords, financial data, or government-issued IDs were among the stolen records. That is meaningful context, but it does not eliminate the risk. Names combined with institutional email addresses and internal communications are more than enough to fuel targeted phishing campaigns against students, faculty, and administrative staff.

By May 7, Canvas entered maintenance mode, disrupting access for institutions across the US, UK, Canada, Australia, New Zealand, Sweden, and the Netherlands. Multiple Canadian post-secondary institutions confirmed they were affected, though the full scope is still being assessed.

How Breaches Like This Actually Happen

ShinyHunters does not operate like a script-kiddie running vulnerability scanners. The group is known for patience and for targeting credential databases, API keys, and cloud storage misconfigurations. Based on DataBreaches.net reporting, the Canvas intrusion follows a pattern the group has used repeatedly: gain initial access via exposed or stolen credentials, move laterally through cloud infrastructure, exfiltrate quietly, then surface with ransom demands once data is secured.

The mechanics generally follow a predictable kill chain. Understanding each stage is how defenders know where to interrupt it.

Warning Signs Your Organization Should Never Ignore

Most breaches are not discovered by the victim. Inside Higher Ed noted that Canvas institutions learned about the breach from external security researchers and media reports, not from Instructure’s own detection. That gap between compromise and notification is where the real damage accumulates.

In our work with GTA mid-market firms, the signals that precede a confirmed breach tend to cluster around the same overlooked indicators.

What Data Was Taken and Why It Matters

Instructure confirmed that the stolen data includes names, email addresses, student IDs, and internal platform messages. No passwords, no payment card data, no government IDs. That framing is accurate but can be misleading when evaluating actual risk.

Consider what an attacker can do with a name, an institutional email address, and the content of internal messages. They can craft a spear-phishing email that references a real conversation, a real course, a real colleague. That specificity is what makes socially engineered attacks effective. The targets are not abstract; they are 275 million real people with names, affiliations, and communication histories now sitting in a threat actor’s database.

Under PIPEDA (Canada’s federal private sector privacy law), organizations that experience a breach involving a real risk of significant harm are required to notify both the Privacy Commissioner of Canada and affected individuals. “Significant harm” explicitly includes humiliation, damage to reputation, and financial loss. A breach of this nature, particularly where internal messages are involved, likely clears that threshold for Canadian institutions. Provincial health data held by universities may also trigger PHIPA obligations depending on the context.

How to Protect Your Organization from Vendor-Side Breaches

You cannot prevent a breach at your vendor’s data center. What you can do is limit how much of your exposure depends on their security posture, and build the capability to respond fast when something goes wrong on their end.

What ShinyHunters’ Track Record Tells Us

This is not a first offense. ShinyHunters has been linked to breaches at AT&T, Ticketmaster, Santander Bank, and dozens of other organizations. The group operates with a commercial mindset: they find high-value targets, exfiltrate at scale, and monetize through ransom or data sales on criminal marketplaces. Education platforms are attractive because they aggregate massive user populations with historically under-resourced security teams.

According to DataBreaches.net, the word “again” in their headline is deliberate: Instructure has faced security incidents before. Repeat targeting by sophisticated threat actors is common when organizations do not remediate root causes after an initial incident.

Decision Framework: Assessing Your Vendor Risk Right Now

Use this framework to prioritize which vendors in your stack need immediate attention. It is not exhaustive, but it surfaces the highest-risk exposure quickly.

• Data sensitivity: Does this vendor store employee PII, customer data, financial records, or communications? Higher sensitivity means higher priority.
• Access scope: Does the vendor integration have broader system access than the use case requires? Excessive permissions amplify breach impact.
• Breach history: Has this vendor had a prior incident? How did they handle notification, remediation, and communication?
• Contractual protections: Do your vendor agreements include breach notification timelines, data deletion clauses, and liability provisions? If not, renegotiate at renewal.
• Substitutability: If this vendor went into maintenance mode tonight, how long before your operations are critically impacted? Document that number and plan around it.

If you are not sure where your vendor risk exposure actually sits, that is exactly the kind of gap we help GTA mid-market organizations identify and close. Balanced+ provides cybersecurity assessments, third-party risk reviews, and managed security services built for organizations that cannot afford to find out the hard way. Start with our cybersecurity services page to see what a structured approach looks like.

Frequently Asked Questions

Was my Canvas account hacked?

If you have an account on any Canvas LMS platform, your name, email address, student or faculty ID, and possibly internal messages may have been included in the exfiltrated data. Instructure confirmed that passwords and financial data were not compromised. Watch for phishing emails that reference specific course names, colleagues, or internal details, as these would indicate your data is being used in follow-on attacks.

What is ShinyHunters and how dangerous are they?

ShinyHunters is a well-documented cybercriminal group known for large-scale data theft and ransom extortion. They have been linked to breaches at AT&T, Ticketmaster, Santander, and others. They typically operate by accessing cloud environments using stolen or exposed credentials, exfiltrate large datasets quietly, and then surface with ransom demands. The group is considered a persistent and sophisticated threat actor, not an opportunistic script operation.

What do businesses need to do after a vendor breach like this?

First, contact the vendor directly and request a written impact assessment confirming whether your data was in scope. Second, brief your security team and review any integrations that may have exposed data. Third, increase phishing awareness among employees, since follow-on spear-phishing is a near-certain outcome when contact data is stolen. If the vendor stores data covered by PIPEDA or PHIPA, review your notification obligations under those frameworks with legal counsel.

Does this breach affect businesses outside the education sector?

Directly, no. Canvas LMS is used primarily in education. But the broader lesson applies to any organization using SaaS platforms: your vendor’s security posture is part of your attack surface. The tactics ShinyHunters used in the Canvas breach are the same ones targeting HR platforms, CRMs, and cloud storage providers in the commercial sector. Third-party vendor risk management is not an education problem; it is a business problem.

Sources

• CBC News: Ontario universities affected by Canvas data breach
• Time: Canvas Cyber Attack — ShinyHunters Hack, What to Know
• Krebs on Security: Canvas Breach Disrupts Schools and Colleges Nationwide
• DataBreaches.net: ShinyHunters Hacks Instructure Again — Canvas Down
• Malwarebytes: Millions of Students’ Personal Data Stolen in Major Education Cyberattack
• Inside Higher Ed: Pay or Leak — Hackers Target Big Higher Ed Vendor

In October 2023, a ransomware attack against a shared IT vendor knocked five southwestern Ontario hospitals offline for months, cost those organizations over $7.5 million, and compromised the personal health information of more than 516,000 patients and employees. Surgeries were postponed. Cancer radiation treatments were transferred to other facilities. Most systems were not restored until February 2024. The attack didn’t require a sophisticated breach of each hospital’s own infrastructure; it came through a single shared service provider that all five organizations trusted.

That case illustrates exactly why PHIPA compliance is not a paperwork exercise. This post covers what Ontario’s health privacy law requires from your IT environment, where most healthcare organizations in the GTA fall short, and what to look for in a managed IT provider that actually understands the regulatory landscape.

What PHIPA Actually Requires from Your IT Environment

PHIPA doesn’t mandate specific technologies. What it requires is that health information custodians take steps “reasonable in the circumstances” to protect personal health information. The IPC has consistently interpreted this through its investigations and orders to include a defined set of technical controls that any healthcare IT environment needs to address.

• Encryption: Personal health information must be encrypted at rest and in transit. Unencrypted devices are among the most cited causes of reportable breaches in IPC investigations.
• Access controls and audit logging: Only authorized personnel should access patient records, access should be role-based, and every access event should be logged. Without audit logs, you cannot investigate a breach or demonstrate compliance.
• Breach detection and response: You must have the ability to detect breaches and respond to them. Ontario’s PHIPA requires notification to affected individuals at “the first reasonable opportunity,” which the IPC has interpreted as within 72 hours in most circumstances, far tighter than the 60-day window under the US HIPAA framework.
• Written vendor agreements: Any IT provider or cloud service that handles personal health information on your behalf must be bound by a written data sharing agreement that addresses PHIPA obligations. This applies to your EMR vendor, cloud storage provider, and managed IT provider.
• Privacy governance: The IPC’s first administrative monetary penalty, issued in August 2025 against a physician and his private clinic, found that the clinic had “sorely lacked any of the essential elements of a data privacy and security governance program.” That phrase (from the IPC’s own decision) is now the benchmark against which Ontario healthcare organizations are being measured.

The SickKids Ruling: Ransomware Is a Breach Even If Nothing Was Stolen

In 2025, an Ontario court issued a significant ruling in the Hospital for Sick Children case that every healthcare organization in the province needs to understand. The court found that a ransomware attack that makes personal health information inaccessible triggers PHIPA’s breach notification obligations, even when there is no evidence that the information was actually accessed, viewed, or stolen by the attacker.

The same ruling found that an email account compromise lasting as little as one hour constitutes both unauthorized disclosure and unauthorized use under PHIPA, triggering the duty to notify at the first reasonable opportunity.

Real Consequences: What Has Happened to Ontario Healthcare Organizations

The southwestern Ontario hospital attack is the clearest illustration of supply chain risk in healthcare IT. All five organizations used the same IT service provider, TransForm Shared Service Organization. When that vendor was compromised, every connected hospital was affected simultaneously. The attack forced postponed surgeries, diverted cancer treatments, and generated millions in recovery costs, across organizations that individually may have had reasonable security practices.

In 2025, a vendor contracted by Ontario Health atHome suffered a ransomware attack that compromised patient information, with the breach confirmed more than two months after the initial incident. The IPC’s 2024 annual report also highlighted an investigation involving a medical imaging clinic where a ransomware attack compromised more than 500,000 patient records and the clinic ultimately paid the ransom to restore access to its systems.

These are not edge cases. They are the norm in Ontario healthcare cybersecurity, and the IPC’s enforcement posture is getting more aggressive. August 2025 saw the first-ever administrative monetary penalties issued under PHIPA, the first time any Canadian privacy commissioner had used this enforcement mechanism. The IPC can now impose penalties of up to $50,000 on individuals and $500,000 on organizations for PHIPA contraventions.

Compliant vs. Non-Compliant: What Each Looks Like in Practice

What to Look for in a Managed IT Provider for Ontario Healthcare

Not every managed IT provider is equipped to work in a PHIPA-regulated environment. A provider that serves manufacturing clients operates under entirely different risk and compliance requirements. When evaluating a managed IT partner for your healthcare organization, these are the criteria that matter:

Balanced+ works with healthcare organizations across Toronto and the GTA to build IT environments that meet PHIPA requirements without disrupting clinical operations. If you are not sure where your current environment stands, our healthcare IT services page outlines how we approach compliance and security for Ontario health information custodians. We are happy to walk through a gap assessment before you commit to anything.

Frequently Asked Questions

What is PHIPA and who does it apply to in Ontario?

PHIPA is Ontario’s Personal Health Information Protection Act, which governs how health information custodians handle patient data. It applies to physicians, hospitals, pharmacists, laboratories, long-term care homes, community health centres, and other regulated health professionals in Ontario. There is no size threshold: a sole-practitioner clinic has the same obligations as a regional hospital. The IPC enforces PHIPA and now has the authority to issue administrative monetary penalties of up to $500,000 for organizational violations.

How quickly does PHIPA require breach notification in Ontario?

PHIPA requires that affected individuals be notified “at the first reasonable opportunity” after a breach is discovered. The IPC has interpreted this as approximately 72 hours in most circumstances, which is considerably faster than the 60-day window under the US HIPAA framework. Serious and deliberate breaches must also be reported to the IPC immediately. The 2025 SickKids ruling confirmed that ransomware attacks that render data inaccessible, even with no evidence of data theft, still trigger these notification obligations.

Does my IT provider need to sign a special agreement to comply with PHIPA?

Yes. Any agent or third party that handles personal health information on behalf of a health information custodian must be bound by a written agreement that addresses PHIPA obligations. This includes your managed IT provider, EMR vendor, cloud storage service, and any other technology partner with access to patient data. Using an IT provider without a signed PHIPA-compliant data sharing agreement puts your organization in violation, regardless of how secure the provider’s own systems may be.

What does a managed IT provider do for a healthcare organization?

A managed IT provider for healthcare handles the technical controls that PHIPA requires: device encryption, role-based access management, audit logging, patch management, 24/7 monitoring, and breach detection and response. They also assist with vendor agreement reviews, incident response planning, and ensuring that cloud services meet Ontario privacy standards. For smaller clinics and specialist practices without dedicated IT staff, a qualified managed IT provider is typically the most practical way to maintain sustainable PHIPA compliance without adding internal headcount.

Sources

• Southwestern Ontario hospital cyberattack cost organizations $7.5M — Cyber Secure Catalyst (August 2024)
• Southwestern Ontario hospitals cyberattack financial impact — CBC News (August 2024)
• Ontario Health atHome vendor ransomware attack — Global News (2025)
• Hospital for Sick Children v. Ontario IPC: ransomware notice obligations — BLG (September 2025)
• First administrative monetary penalty issued under PHIPA — IPC Ontario (August 2025)
• A New Era of Privacy Enforcement: Ontario’s first AMPs under PHIPA — Dentons Data (2025)
• Review of noteworthy cases — IPC Ontario 2024 Annual Report
• Personal Health Information Protection Act, 2004 — Ontario Legislature