Selling Digital Health Software in Canada: Pentest Requirements by Province (2026)

Ontario Health's Virtual Visits Solution Requirements, version 3.1 dated 15 September 2026, make a penetration test a mandatory requirement for any video or secure messaging solution that wants to appear on the province's verified list: requirement 2.3.10 reads "Penetration tests are to be done, at a minimum, on an annual basis, or when there has been a major software release or change in architecture or infrastructure." Quebec's TGV certification has required an independent test since 2022. Most other Canadian rules that reach a digital health vendor, from Alberta's Health Information Act to British Columbia's FIPPA and federal PIPEDA, never use the words "penetration test" at all.

This brief is for the vendor (telehealth, EMR, patient app, booking tool, AI scribe or integration service) selling to clinics, hospitals and health authorities in more than one province. For each jurisdiction it answers four questions: does the instrument name a penetration test (explicitly required, expected as evidence, or not mentioned), how often, who may perform it, and what the vendor submits. Every instrument below was read between 11 and 12 October 2026 in the version stated, with the operative words quoted. Hospitals buying testing for their own estate should read the Canadian healthcare ranking instead, and vendors comparing testing firms the healthtech ranking.

Where Stingrai fits: Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements. Stingrai performed the TGV-scoped penetration test for Bia Education, a Quebec healthtech platform, as part of its certification. For a vendor selling into several provinces, one white box engagement by two named penetration testers can be scoped to cover the application and its infrastructure, every role and patient-scoped endpoint, and the retest report that Quebec's annual self-declaration asks for as proof of the fixes.

Quick answer. Three Canadian instruments explicitly require a penetration test of a digital health vendor's product: Quebec's TGV certification (criterion S16.03, and attestation commitment 3, under which the supplier undertakes to undergo at least one test a year with an independent firm), Ontario Health's Virtual Visits Solution Requirements v3.1 (requirement 2.3.10, at least annually or after a major release or architecture change), and OntarioMD's EMR Hosting Requirements v1.4 (HST02.36, at least annually on Internet-facing applications that give access to PHI). OntarioMD's September 2026 drafts would extend the test to every certified EMR, but they are drafts for comment. Alberta's Health Information Act, BC's FIPPA and BC's conformance standards, Ontario's PHIPA regulation, Quebec's private sector law and PIPEDA do not mention penetration testing. Health Canada's device cybersecurity guidance expects testing evidence only for software that is a medical device. Stingrai runs one-time annual tests and continuous programs scoped to these requirements, with retesting included.

The answer in one table

The rest of this brief explains each row.

Quebec: the only province with a certification that names the test

Quebec has the most explicit requirement in the country, and Stingrai has covered it in depth in two guides: the TGV certification guide for the application process, and the TGV renewal brief for suppliers already certified. The summary for a multi-province vendor:

• What it is. The Trousse globale de vérification (TGV) is the certification a product needs to be deployed in Quebec's health and social services network, issued by Santé Québec's Bureau de certification. The Act respecting health and social services information (R-22.1, up to date as of 12 August 2026) frames certification in sections 92 to 96: section 94 requires a supplier of a certified product to ensure it complies with the certification criteria "throughout the term of the contract", and section 95 lets the certifier demand documents to verify compliance.

• The test criterion. S16.03 in the criteria list of 24 April 2026 reads "Soumettre votre application à un test d'intrusion administré par un prestataire indépendant et reconnu par Santé Québec" ("Submit your application to a penetration test administered by an independent provider recognised by Santé Québec"). The criterion itself sets no frequency.

• Where the yearly duty comes from. Commitment 3 in Annex 1 of the attestation (BC-D0001-01): "Le FOURNISSEUR s'engage à passer annuellement au moins un test d'intrusion auprès d'une firme indépendante suivant les orientations en vigueur au BC" ("The supplier undertakes to undergo at least one penetration test each year with an independent firm, following the bureau's orientations in force"). The commitment is to undergo the test; the results and any proof of mitigation go to the bureau "au plus tard lors du dépôt de l'autodéclaration" (at the latest when the annual self-declaration is filed).

• Who may perform it. The bureau's orientation on penetration tests accepts results only from a provider meeting six minimum conditions, the first being "avoir des représentants légalement autorisés au Canada" (having legally authorised representatives in Canada). White box testing is "acceptée dans tous les cas" (accepted in all cases); black box is "non acceptée".

• Privacy law. Quebec's private sector privacy statute (P-39.1, as amended by Law 25) does not mention penetration testing. Section 10 requires "the security measures necessary to ensure the protection of the personal information", reasonable given its sensitivity, and section 3.3 requires a privacy impact assessment for "any project to acquire, develop or overhaul an information system". The Quebec Law 25 brief covers where a test fits as evidence.

Classification: explicitly required (S16.03 for certification, commitment 3 every year after it). Not mentioned in P-39.1 and R-22.1.

Ontario: three programs, two of them explicit

Ontario has no single certification for digital health software: a vendor meets Ontario Health's digital standards, OntarioMD's EMR certification, or both, with PHIPA underneath.

Ontario Health: Virtual Visits Verification

The Virtual Visits Solution Requirements, version 3.1, dated 15 September 2026, set the requirements that patient-to-provider video and secure messaging solutions must meet to be verified. Section 1.5 defines the label: "Mandatory: Solution Providers must support these requirements." Its conformance language states "Shall/Must: Required/Mandatory" and "Should: Best Practice/Recommendation."

Four security requirements matter to the test:

• 2.3.10, Perform regular penetration tests (M): "Penetration tests are to be done, at a minimum, on an annual basis, or when there has been a major software release or change in architecture or infrastructure. Penetration tests must include the application and application infrastructure. For hosted environments, the hosting provider may need to submit their own penetration test results." The note ends: "Evidence of the annual scans or a summary of the results may be requested." The wording says "scans" in the requirement on penetration tests, so treat a summary of the latest test as the document to have ready.

• 2.3.9, Perform regular vulnerability assessment scans (M): "at a minimum on a quarterly basis or when there has been a major software release, change in architecture or infrastructure."

• 2.3.8, Meet security controls assurance requirements (M): a current SOC 2 Type 2 report, ISO 27001 certification, HITRUST r2 certification, or OntarioMD Certified EMR status. A SOC 2 Type 2 must have been "completed within the last year" by "an AICPA certified third-party organization" and refreshed every year; a Type 1 is accepted provisionally if the Type 2 follows within six months. Local Solution Providers may instead submit a threat risk assessment, and for them the standard says: "Latest penetration test results are to be submitted with the TRA report. Penetration tests must include the application and application infrastructure."

• 2.3.7: a privacy impact assessment summary completed within two years.

The standard does not say who must perform the test or require tester independence.

Ontario Health's verification page (last updated 4 June 2026) summarises the submission differently. It lists three steps: sign an attestation letter "that affirms that your solution meets all mandatory requirements as detailed in the standard"; "Submit up-to-date Privacy Impact Assessment and Threat Risk Assessment summaries. SOC 2 Type 2 audits may be submitted in place of Threat Risk Assessment"; and complete scenario-based validation testing within 12 months of verification. The page does not mention a penetration test, and its TRA wording does not reflect version 3.0 of the standard, which removed the TRA from 2.3.8 for all but local providers. In practice a vendor signs a letter affirming that 2.3.10 is met and must be able to produce a test summary when asked.

The program's Terms and Conditions (version 3.0, 14 July 2025) add the cadence: "Re-Attestation is required on a yearly basis" (4.5), "Re-Validation must be performed every three years" (4.6), and changes affecting security may require "updated documentation that may include assessments, audits, or certifications" (7.1). Verification is voluntary and free, but the Ministry of Health's Virtual Care billing brief (updated March 2025) states that "Video services are only eligible for payment when performed using a Verified Video Solution, as defined by Ontario Health." For a video platform selling to Ontario physicians, the verified list is the market.

Classification: explicitly required. Annually and on major change; performer not specified; summary on request, or results with the TRA on the local provider route.

Ontario Health: Online Appointment Booking

The Online Appointment Booking Service Standard, version 2.0 of spring 2024, is a procurement aid rather than a verification program. Requirement 5.11 is Mandatory, but what it mandates is a policy: the vendor "has a policy that describes when or how frequently it performs periodic penetration tests." The note uses "should": "Penetration tests should be done, at a minimum, on an annual basis", and "should include the application and application infrastructure where possible." Requirement 5.12 asks for ISO 27001, SOC 2 Type 2, HITRUST or OntarioMD certification.

Classification: expected as evidence. The policy is mandatory; the annual test is a recommendation.

OntarioMD: EMR certification

EMR offerings "must be certified in order to subscribe to provincial EHR products and services, for example, in Ontario OLIS, HRM", according to OntarioMD's certification overview. Two specifications carry the security requirements, and both are in transition.

• EMR Hosting Requirements, version 1.4 Final (4 July 2024), for hosted EMR offerings: HST02.36 (Mandatory) "The vendor or their agent MUST perform penetration tests, at a minimum annually, on all their Internet-facing applications that provide access to PHI", and HST02.37 requires "web-application testing techniques executed against a documented set of industry standards such as the Open Web Applications Security Project (OWASP) Top 10". HST02.35 sets quarterly vulnerability and configuration scans.

• Privacy and Security Requirements, version 2.1 Final (4 October 2024): the version history records "Removed Penetration Test requirements (PS05.XX requirements previously in section 2.5)". What remains is a threat and risk assessment "by an independent third-party Information Security Professional" holding CISSP, CISM or CISA "every two years" (PS04.01 and PS04.03), a TRA summary (PS04.05), a current ISO 27001, HITRUST r2 or SOC 2 Type II report (PS05.01), and the Cyber Centre's "Vetting Software Suppliers" questions every two years (PS05.02).

• The September 2026 drafts. OntarioMD's specifications library now lists drafts for comment of both documents dated 11 September 2026, and no longer lists the 2024 finals. The draft EMR Hosting v1.5 notes "HST02.35, HST02.36: Requirements moved to Privacy and Security" and retires HST02.37. The draft Privacy and Security v2.2 adds PS05.06 ("EMR vendors MUST conduct penetration testing at least annually on their EMR offering", including pre-deployment testing in "an environment simulating a typical clinic LAN setup"), PS05.07 (testing before significant changes), PS05.08 (testing "at a minimum, every 12 months on all customer-facing or Internet-facing applications" by "an independent third-party Information Security Professional" holding CEH, OSCP or GPEN (other credentials only after review and consultation with OntarioMD before testing), "from an external organization specializing in information security reviews"), and PS05.09 (an 11-element report that "MUST be provided to OMD once every 12 months").

Classification: explicitly required for hosted EMRs under the final hosting requirements; proposed for every certified EMR under the drafts. A draft for comment is not a final requirement, so check the library before you scope, but a test that already meets the draft's independence, credential and report rules will not need redoing if they pass as written.

PHIPA and its regulation

The Personal Health Information Protection Act, 2004 reaches vendors through section 10(4): a person who provides goods or services that let a custodian use electronic means to handle personal health information "shall comply with the prescribed requirements, if any." Section 6 of O. Reg. 329/04 (consolidated from 1 January 2026) prescribes them.

• Every electronic service provider that is not the custodian's agent (s. 6(1)) "shall not use any personal health information ... except as necessary in the course of providing the services", "shall not disclose" it, and must have staff agree to the same restrictions.

• A health information network provider (s. 6(2) and (3)), one serving two or more custodians "primarily to custodians to enable the custodians to use electronic means to disclose personal health information to one another", must also keep access and transfer logs, publish a description of its safeguards, sign a written agreement with each custodian, and under paragraph 5 "perform, and provide to each applicable health information custodian a written copy of the results of, an assessment of the services provided ... with respect to, i. threats, vulnerabilities and risks to the security and integrity of the personal health information".

Sections 26 to 34 of the same regulation also let Ontario Health set interoperability specifications for "digital health assets", which may cover "privacy or security", and certify compliant assets.

Classification: not mentioned. The network provider's written threat and vulnerability assessment is where a penetration test report is natural supporting evidence, but the regulation asks for an assessment, not a test.

Alberta: the information manager agreement carries the obligation

Alberta's Health Information Act (current as of 2 July 2026, a consolidation that includes only amendments in force) and the Health Information Regulation (AR 70/2001, current as of 2 July 2026) do not mention penetration testing. A vendor that hosts, processes or stores health information for a physician, clinic or Alberta Health Services is an "information manager", and the duties flow through the custodian.

• The custodian's safeguards. Section 60(1) requires a custodian to "take reasonable steps ... to maintain administrative, technical and physical safeguards" against "any reasonably anticipated ... threat or hazard to the security or integrity of the health information", and regulation section 8(3) says a custodian "must periodically assess" those safeguards.

• The agreement. Section 66(2): "A custodian must enter into a written agreement with an information manager in accordance with the regulations". Regulation section 7.2 lists its contents, including how the health information "is to be protected, managed, returned or destroyed in accordance with the Act". Section 66(5) binds the information manager to the Act and the agreement, and section 66(6) leaves the custodian responsible.

• The PIA. Section 64(1) requires the custodian to prepare a privacy impact assessment and submit it to the Information and Privacy Commissioner "before introducing a new ... information system" or changing one.

• The new vendor route. Section 64.2, added by the 2025 amendments (2025 c21) and in the July 2026 consolidation, provides that an information manager or prospective one "may prepare and submit to the Commissioner for review and comment an information security policy" describing the system's functions and safeguards. A vendor that does not do so must give the custodian a plain-language description of the same components "in sufficient detail to enable the custodian to prepare a privacy impact assessment" (s. 64.2(6)). A secondary source, an IAPP analysis of 21 August 2026, reports that the amendments came into force in June 2026.

Stingrai found no published Alberta Health Services vendor standard naming a penetration test; AHS's public FAQ for vendors covers report delivery and data standards. A recent test summary is most useful in the safeguards description, the PIA appendix and the contract's security schedule.

Classification: not mentioned. Frequency, performer and submission are left to the custodian's contract and PIA.

British Columbia: no named test, but required security testing for Ministry systems

British Columbia's Freedom of Information and Protection of Privacy Act (current to 6 October 2026) governs health authorities as public bodies. Section 30 requires a public body to protect personal information "by making reasonable security arrangements against such risks as unauthorized collection, use, disclosure or disposal", and section 30.5(2) requires a service provider's employees to report unauthorized disclosure "immediately". Section 69(5.3) requires the head of a public body that is not a ministry, such as a health authority, to "conduct a privacy impact assessment". The Act does not mention penetration testing. Health authority vendor security schedules are set contract by contract; Stingrai found no published one that names a test.

Vendors whose product connects to the Ministry of Health's health information exchange systems (PharmaNet, the Provincial Client Registry and the Provider and Location Registry) meet a more technical document: the BC Professional and Software Conformance Standards, Volume 2: Information Privacy & Security, version 3.7, 20 February 2026, which "define the mandatory standards for all software organizations". The word "penetration" does not appear in it, but several rules require security testing, evaluated by method D, "demonstrate that your product conforms":

• PS6.2 Secure Code Review: "Application code must be reviewed prior to release to production", with Critical, High and Medium findings fixed before release.

• PS6.15 Application Vulnerability Scanning: "Regular application vulnerability scanning (i.e., automated tools and/or manual methods) must be used", and "No new information system shall be considered in production until" assessments are done and Critical, High and Medium vulnerabilities addressed.

• PS7.4 Web Application Vulnerabilities: web applications and interfaces "must be tested and remediated for, at a minimum," cross-site scripting, "Improper access control" and CSRF.

• PS1.1: electronic health information must stay "within Canada unless permitted in writing by the Ministry".

Classification: not mentioned in FIPPA and the conformance standards. An authenticated web application penetration test is the most direct way to demonstrate PS7.4, especially improper access control, which automated scanners handle poorly.

Federal pieces

• Health Canada, software as a medical device. Only software that is a medical device needs a licence, and Health Canada's SaMD guidance excludes software "intended to serve as electronic patient records", software for "patient registration, scheduling visits, voice calling, video calling" and administrative support. For devices, the Pre-market Requirements for Medical Device Cybersecurity (adopted 17 June 2019, effective 26 June 2019) list "Structured Penetration Testing" among types of testing, performed by "a cybersecurity expert ... who is familiar with hacking techniques", and state that "Cybersecurity testing evidence should be provided": a detailed summary for Class III and IV devices and "reports showing evidence of cybersecurity testing" for Class IV. Classification: expected as evidence, devices only. The medical device ranking covers that buyer.

• PIPEDA. Schedule 1, Principle 7 (Safeguards): "Personal information shall be protected by security safeguards appropriate to the sensitivity of the information", with "technological measures, for example, the use of passwords and encryption" as examples (4.7.3). Classification: not mentioned.

• Canada Health Infoway. Stingrai found no current Infoway vendor certification program in October 2026: Infoway's former certification pages return "not found", and the version 3.0 change notes of Ontario Health's virtual visits standard record the "Removal of CHI certification" from the assurance options it accepts. Classification: no current certification found.

• Canadian Centre for Cyber Security. Protecting your organization from software supply chain threats (ITSM.10.071, February 2023), whose "Vetting software suppliers" questions OntarioMD uses, advises the buyer: "In addition to relying on the vendors' self-certification ... you should conduct your own audits, source code reviews, and penetration testing." One of its supplier questions is "Are their software security activities and products reviewed by a third-party?" Classification: recommended (to buyers). Its cloud provider assessment process (ITSM.50.100) does not mention penetration testing.

Recurring evidence: what renews when

The penetration test is the only technical test on this chart that all three explicit programs require every year; SOC 2, HITRUST and ISO 27001 run on their own cycles and, as Ontario Health's 2.3.8 and 2.3.10 show, sit beside the test rather than replacing it.

One test for several provinces

A vendor selling in Quebec and Ontario faces the strictest overlap, and one engagement can be designed to satisfy both if it is scoped to the stricter rule on each point.

Vendor checklist

• [ ] List every program you sell into and the version in force on the day you scope the test.

• [ ] In Quebec, confirm the TGV anniversary and plan the yearly test and retest before the self-declaration is due.

• [ ] For Ontario virtual care, check that your annual test covers the application and its infrastructure, and keep a summary ready: the attestation letter affirms requirement 2.3.10.

• [ ] For an OntarioMD-certified hosted EMR, test every Internet-facing application with access to PHI at least annually, and follow the September 2026 drafts until a final version is published.

• [ ] If you operate a shared record or exchange between Ontario custodians, give each custodian the written threat, vulnerability and risk assessment that O. Reg. 329/04 s. 6(3) requires.

• [ ] In Alberta, decide whether to submit an information security policy to the Commissioner under section 64.2, and include testing evidence in the safeguards description you give custodians.

• [ ] For BC Ministry integrations, keep records of code review, vulnerability scanning and testing for XSS, improper access control and CSRF.

• [ ] If any feature could make the product a medical device, check Health Canada's SaMD guidance before the testing plan is fixed.

How Stingrai tests digital health products for Canadian buyers

Stingrai holds firm-level CREST accreditation as a penetration testing service provider (CREST marketplace listing) and is one of a small number of CREST-accredited firms headquartered in Canada. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, with 18 published CVEs across the team, bug bounty Hall of Fame recognition at Apple, Google, Facebook, Yahoo, the US Department of Defense and the US Federal Reserve, and a founding member of Uber's offensive security team. The human-led testing guide for regulated industries explains why regulated buyers ask for named testers.

• Scope for several provinces at once: web application, mobile, cloud and AI and LLM components tested white box in one engagement, every role covered, with the infrastructure in scope as Ontario asks.

• Evidence that matches the asks: findings posted to the PTaaS portal as they are confirmed, each with a working proof of concept; live chat with the testers; Jira and Slack integration; redactable PDF reports; retesting included; and an attestation letter on human-led and hybrid engagements.

• One-time or continuous: a one-time annual test timed to the TGV anniversary, or a continuous program that tests every release, which also covers Ontario's "major software release" trigger.

• Where Snipe fits: for the web application and its APIs, Snipe, Stingrai's autonomous AI agent for web applications, works alongside the penetration testers in a hybrid engagement, hunting broken authorization, IDOR and business logic flaws across roles, with automated retests and pull-request gating between annual tests. Mobile, cloud and network testing is done by the penetration testers. The web application testing guide compares the delivery models.

Published pricing: the Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month, both covering one web application and associated APIs. A multi-province scope with mobile, cloud or AI components is quoted as a human-led or hybrid Enterprise engagement.

Frequently Asked Questions

Do Canadian provinces require penetration testing for digital health vendors?

Only some programs do. Quebec's TGV certification requires an independent test (criterion S16.03) and, after certification, at least one test a year (attestation commitment 3). Ontario Health's Virtual Visits Solution Requirements v3.1 make an annual test mandatory under requirement 2.3.10, and OntarioMD's EMR Hosting Requirements v1.4 require an annual test of Internet-facing applications that give access to PHI. Alberta's Health Information Act, BC's FIPPA, Ontario's PHIPA regulation and PIPEDA do not mention penetration testing.

Does Ontario Health require a penetration test for virtual care verification?

Yes. Requirement 2.3.10 of the Virtual Visits Solution Requirements, version 3.1 of 15 September 2026, is Mandatory: tests at least annually or after a major software release or change in architecture or infrastructure, covering the application and application infrastructure. According to the program web page, the initial submission package asks for PIA and TRA summaries, with a SOC 2 Type 2 accepted in place of the TRA, and an attestation letter affirming all mandatory requirements; the v3.1 standard itself asks most vendors for SOC 2 Type 2, ISO 27001, HITRUST r2 or OntarioMD status and keeps the TRA only for local providers; evidence or a summary of the test results may be requested.

How often must a TGV-certified product be penetration tested?

At least once a year. Criterion S16.03 itself sets no frequency; the yearly duty comes from commitment 3 of the attestation, under which the supplier undertakes to undergo at least one penetration test a year with an independent firm following the bureau's orientations, and sends the results and proof of mitigation by the time the annual self-declaration is filed.

Does OntarioMD EMR certification require penetration testing?

For hosted EMRs, yes: HST02.36 of the EMR Hosting Requirements v1.4 Final requires tests at least annually on Internet-facing applications that provide access to PHI. The final Privacy and Security Requirements v2.1 removed its penetration test section in 2024. Drafts for comment dated 11 September 2026 would require every certified EMR to be tested at least every 12 months by an independent third party holding CEH, OSCP or GPEN (other credentials only by prior agreement with OntarioMD), with a report to OntarioMD every 12 months.

Does Alberta's Health Information Act require vendors to have a penetration test?

No. The Act and its regulation do not mention penetration testing. Custodians must maintain reasonable safeguards, periodically assess them and prepare a privacy impact assessment before introducing a new information system, and a vendor acting as an information manager must sign a written agreement and comply with the Act. Since the 2025 amendments came into force in June 2026, an information manager may submit an information security policy to the Commissioner for review and comment.

Does Health Canada require penetration testing for health software?

Only when the software is a medical device. Health Canada's SaMD guidance excludes electronic patient records, scheduling, video calling and administrative software. For devices, its 2019 cybersecurity guidance lists structured penetration testing as a type of testing and says cybersecurity testing evidence should be provided, as a summary for Class III and IV devices and as reports for Class IV.

Related reading

• TGV certification in Quebec (2026): the application process, the criteria list and the test orientation.

• Keeping TGV certification in 2026: the annual test, the self-declaration and product changes.

• Best healthtech penetration testing companies (2026): firms that test health technology products for Canadian and US buyers.

• Best healthcare penetration testing companies in Canada (2026): the ranking for hospitals and health systems.

• Quebec Law 25 penetration testing (2026): what Quebec's privacy law asks and where a test fits.

• Pentest completion letter vs full report: what to send a program office and what to send a hospital customer.

• Penetration test cost calculator: a scoped range for a multi-province test.

Talk to Stingrai

A vendor selling across Canada usually answers to two or three of these programs at once, and the efficient path is one annual test designed for the strictest of them: white box, every role, the application and its infrastructure, an independent firm with Canadian representation, and a retest that proves the fixes. Stingrai scopes that engagement from the programs you actually sell into. Book a free scoping call, get a quote for a multi-province scope, or see published pricing.

References

1. Bureau de certification de Santé Québec. Attestation, certification TGV (BC-D0001-01). https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/BC_TGV_ATTESTATION.pdf

2. Bureau de certification. Orientation concernant les tests d'intrusion. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/orientation-tests-intrusion.pdf

3. Ministère de la Santé et des Services sociaux. Critères de vérification de la TGV, version 2026-04-24. https://cdn-contenu.quebec.ca/cdn-contenu/sante/documents/Professionnels/certification-produits-services-technologiques/liste-criteres-TGV_v2026-04-24.xls

4. Québec. Act respecting health and social services information (R-22.1), up to date as of 12 August 2026. https://www.legisquebec.gouv.qc.ca/en/document/cs/R-22.1

5. Québec. Act respecting the protection of personal information in the private sector (P-39.1), up to date as of 12 August 2026. https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1

6. Ontario Health. Virtual Visits Solution Requirements, version 3.1, 15 September 2026. https://ontariohealth.ca/content/dam/ontariohealth/documents/virtual-verification-solutions-standard.pdf

7. Ontario Health. Virtual Visits Verification Standard (last updated 4 June 2026). https://ontariohealth.ca/system-planning/digital-standards/virtual-visits-verification

8. Ontario Health. Virtual Visits Verification Program Terms and Conditions, version 3.0, 14 July 2025. https://ontariohealth.ca/content/dam/ontariohealth/documents/virtual-verification-terms-conditions.pdf

9. Ontario Ministry of Health. Virtual Care 2: Terms and Conditions (updated March 2025). https://www.ontario.ca/document/education-and-prevention-committee-billing-briefs/virtual-care-2-terms-and-conditions

10. Ontario Health. Online Appointment Booking Service Standard, version 2.0, spring 2024. https://ontariohealth.ca/content/dam/ontariohealth/documents/online-appointment-booking-service-standard.pdf

11. OntarioMD. EMR Specifications Library, drafts for comment: EMR Hosting Requirements v1.5 DFC and Privacy and Security Requirements v2.2 DFC, both dated 11 September 2026. https://www.ontariomd.ca/emr-certification/library/specifications

12. OntarioMD. EMR Hosting Requirements v1.4 Final (4 July 2024) and Privacy and Security Requirements v2.1 Final (4 October 2024), PCON-2024-02 release package (no longer listed in the public library as of 12 October 2026).

13. OntarioMD. EMR Certification Overview. https://www.ontariomd.ca/emr-certification/emr-certification/overview

14. Ontario. Personal Health Information Protection Act, 2004, consolidated from 1 January 2026. https://www.ontario.ca/laws/statute/04p03

15. Ontario. O. Reg. 329/04, General, consolidated from 1 January 2026. https://www.ontario.ca/laws/regulation/040329

16. Alberta King's Printer. Health Information Act, RSA 2000, c H-5, current as of 2 July 2026. https://kings-printer.alberta.ca/1266.cfm?page=H05.cfm&leg_type=Acts&isbncln=9780779855209

17. Alberta King's Printer. Health Information Regulation, AR 70/2001, current as of 2 July 2026. https://kings-printer.alberta.ca/1266.cfm?page=2001_070.cfm&leg_type=Regs&isbncln=9780779855216

18. IAPP (secondary). PIAs, shared custody, AI highlight changes to Alberta's Health Information Act, 21 August 2026. https://iapp.org/news/a/pias-shared-custody-ai-highlight-changes-to-albertas-health-information-act

19. British Columbia. Freedom of Information and Protection of Privacy Act, current to 6 October 2026. https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_00_multi

20. BC Ministry of Health. Professional and Software Conformance Standards, Volume 2: Information Privacy & Security, version 3.7, 20 February 2026. https://www2.gov.bc.ca/assets/gov/health/practitioner-pro/software-development-guidelines/conformance-standards/vol-2-privacy-security.pdf

21. BC Ministry of Health. Conformance Standards (last updated 20 February 2026). https://www2.gov.bc.ca/gov/content/health/practitioner-professional-resources/software/conformance-standards

22. Health Canada. Pre-market Requirements for Medical Device Cybersecurity, effective 26 June 2019. https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/cybersecurity/document.html

23. Health Canada. Software as a Medical Device (SaMD): Definition and Classification. https://www.canada.ca/en/health-canada/services/drugs-health-products/medical-devices/application-information/guidance-documents/software-medical-device-guidance-document.html

24. Canada. Personal Information Protection and Electronic Documents Act, current to 21 September 2026. https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html

25. Canadian Centre for Cyber Security. Protecting your organization from software supply chain threats (ITSM.10.071), February 2023. https://www.cyber.gc.ca/en/guidance/protecting-your-organization-software-supply-chain-threats-itsm10071

26. Canadian Centre for Cyber Security. Cloud service provider information technology security assessment process (ITSM.50.100). https://www.cyber.gc.ca/en/guidance/cloud-service-provider-information-technology-security-assessment-process-itsm50100