If you read the BC Office of the Information and Privacy Commissioner reports from the last three years, the most-named industries in privacy-breach orders are healthcare and real estate, with dental clinics now appearing more often as ransomware shifts toward the small end of the SMB market. The reason is not that these firms are careless. The reason is that the data they hold (medical records, dental imaging, real-estate transaction files) is dense, well-organised, and worth more on resale or extortion markets than a generic SMB's data.
The protective controls overlap heavily with what we cover in the 25-employee IT maturity checklist: identity, MFA, EDR, tested backups, segmentation, awareness training, and an incident-response plan. But each of these three verticals has industry-specific obligations and operational patterns that change how the baseline gets deployed. Below is the vertical-by-vertical translation.
Vertical 1
Medical clinics (BC PIPA, federal PHIPA-adjacent, college bylaws)
BC medical clinics operate under the Personal Information Protection Act (PIPA) and the bylaws of their professional college (CPSBC for physicians, CRNBC, CNPBC, etc.). The Office of the Information and Privacy Commissioner of BC has consistently emphasised that health information requires a higher standard of protection than general personal information, and that "reasonable security arrangements" means controls proportionate to the sensitivity, not just whatever is convenient.
- EMR access controlled by named accounts only. No shared "front-desk" logins; the audit trail must show which staff member viewed which patient file.
- Encrypted at rest on every device. Encrypted in transit between the clinic and any cloud-hosted EMR (Oscar, Ava, Telus EMR, etc.).
- Backup separation: patient data backup must be physically or logically isolated from general practice data, with retention matching college bylaws (typically 10 to 16 years post-encounter).
- Patient portal MFA: if the clinic offers a portal, MFA on patient accounts is now a basic expectation, not an upgrade.
- Break-glass procedure documented: how an emergency clinician accesses a record outside normal hours, with after-the-fact logging.
Our medical clinic compliance hub covers PIPA expectations and the college bylaw overlay. Our medical clinic IT support service is built around EMR integrity, backup separation, and after-hours coverage.
Vertical 2
Dental practices (BC PIPA, CDSBC bylaws, imaging integrity)
Dental practices in BC sit under PIPA plus the College of Dental Surgeons of BC bylaws, plus the operational reality that the practice runs on imaging (intraoral, panoramic, cone-beam CT) that connects to a Windows machine in the operatory. That imaging workstation is almost always the weakest point in the dental-IT environment: it runs vendor software with kernel-level drivers that go years without a security patch, it stays logged in, and it is treated as "the X-ray machine" rather than as a computer that has full network access to the patient management system.
- Network-segment the imaging workstations. Treat them as untrusted endpoints on their own VLAN with only the explicit ports to the imaging server allowed.
- Endpoint detection and response on the imaging workstation specifically, with allowlist exceptions for the imaging software where required by the vendor.
- Patient management system (Dentrix, Tracker, ClearDent, Open Dental) MFA enforced, with strict role separation between hygienists, dentists, and billing.
- Backup of imaging studies tested quarterly. Image restore on a dental practice is non-trivial; if you have not tested it, you do not know whether it works.
- After-hours pager rotation defined: ransomware on a Sunday with Monday morning patient appointments is a real scenario; the IT response has to be in place before that Sunday.
Our dental compliance page walks the CDSBC obligations, and our dental IT support service is built specifically around the imaging workstation and the practice management system patterns that dominate BC clinics.
Vertical 3
Real-estate brokerages (RECBC, BCFSA, wire fraud, FINTRAC for managing brokers)
BC real estate brokerages now sit under the BC Financial Services Authority (BCFSA), with the Real Estate Council of BC functions absorbed. The dominant operational risk is wire fraud and business-email compromise targeting deposit transfers between buyer, brokerage, and conveyancing lawyer. Industry reports consistently show real estate as one of the top three sectors for impersonation-based fraud losses in Canada.
- Mailbox protection: DMARC at reject, anti-impersonation rules on the broker's domain, mailbox auditing on for every licensed agent.
- Out-of-band verification protocol for every banking instruction. New beneficiary or changed routing details must be confirmed by phone using a number from the previous correspondence, not from the current email.
- Trust account access via named users with MFA. Suspicious-transaction monitoring on the trust account flagging round-number deposits and rapid in-and-out movement.
- Document-storage controls: M&A confidentiality is unusual in residential, but assignment letters, deposit slips, and offers carry PIPA-grade personal information; treat them accordingly.
- Awareness training every 90 days that includes a wire-fraud phishing simulation specifically; click-through metrics tracked per agent.
Our real estate compliance page covers BCFSA and wire-fraud risk, and our real estate IT support service is built around brokerage operations and the agent-by-agent identity model. See also our deep-dive on real-estate wire fraud at BC brokerages for incident response specifics.
What the three industries share at the operational level
Beyond the regulator-specific lists above, the three verticals share four operational realities that change how IT must be delivered:
- Small, senior, time-poor user base. Most BC clinics, practices, and brokerages have 5 to 30 staff, of whom 3 to 10 are licensed practitioners with high autonomy and low tolerance for IT friction. Controls have to be transparent in the normal workflow and only surface when something is genuinely wrong.
- Vendor-locked line-of-business software. The EMR, the dental imaging suite, and the real-estate transaction platform are vendor-controlled. Patch cycles, integration points, and supported configurations are constrained by the vendor, and the IT partner has to work with that.
- Reputation-sensitive incident response. A breach of patient or client trust is professionally damaging in a way that a generic SMB outage is not. The incident-response plan has to anticipate the patient or client letter, the college or regulator notification, and the local-news risk.
- After-hours dependence. All three industries operate on tight appointment or transaction schedules. An incident on a Sunday is not a Sunday problem; it is a Monday-morning catastrophe unless it is contained Sunday night. The IT partner has to be reachable.
The good news is that closing the gap is mostly a sequencing problem, not a capital problem. The annual IT spend for a 10-to-25-staff BC clinic, dental practice, or brokerage that is fully on top of the controls above is comparable to a single mid-tier insurance premium and well below the cost of a single ransomware recovery.
Industry-Specific Readiness Review
We run a 60-minute readiness review tailored to your specific vertical (medical, dental, or real estate). You get a control-by-control score against the list above and a sequenced 90-day plan with concrete owners and effort estimates. No commitment to engage us further.
Book the Readiness Review Or request a managed IT quote