A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Ontario's Personal Health Information Protection Act, 2004 (PHIPA) governs how health information custodians in Ontario collect, use, and disclose personal health information. It applies to custodians such as hospitals, clinics, and practitioners, and to the organizations that handle health data on their behalf. The Information and Privacy Commissioner of Ontario oversees it, and it requires notification of individuals when their health information is breached.
For a vendor, the first question is your role: are you an agent of a custodian, a service provider, or neither. That status determines which PHIPA obligations flow to you and what the custodian will require in your contract.
The safeguards PHIPA expects overlap heavily with those in SOC 2 and HIPAA Security Rule work, so health-tech vendors often satisfy much of it through the compliance programme they already need for enterprise buyers.
traztech delivers health information privacy readiness for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
PHIPA reaches technology vendors through the custodians they serve. If you handle personal health information for an Ontario hospital or clinic, you are typically acting as an agent or service provider under PHIPA and inherit obligations through that relationship. We ground this in health information privacy readiness.
People often assume HIPAA when the governing law in Ontario is PHIPA, which is a distinct provincial statute with its own custodian and agent model. Our HIPAA in Canada post untangles which regime actually applies.
No. PHIPA is Ontario's provincial health privacy law; HIPAA is a US federal law. They address similar data but are separate regimes, and an Ontario health context is governed by PHIPA, not HIPAA.
Health information custodians in Ontario, such as hospitals, clinics, and healthcare practitioners, and the agents and service providers that handle personal health information for them. Vendors usually inherit obligations through the custodian they serve.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.