Written by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited. Helping Canadian businesses build and manage secure IT infrastructure since 2012 across Toronto, Hamilton, and Metro Vancouver.
An IPC investigation arrived at a Hamilton family-health team in February 2026. The clinic owner had 90 days to produce three years of email, Teams chat and SharePoint records tied to one patient file.
Their Microsoft 365 Business Premium tenant held the data. It lacked the tooling to isolate it, place a defensible hold, and produce it without spilling unrelated personal health information. They missed the first deadline and paid outside counsel to negotiate an extension.
This walkthrough is the playbook we built after that engagement. It covers what Microsoft Purview does for an Ontario clinic under PHIPA, where Business Premium stops and the Purview add-ons begin, and the eight-step rollout we run. It is technical guidance rather than legal advice.
Key Takeaways
- PHIPA s. 12(1) requires reasonable steps to protect personal health information against theft, loss and unauthorized use or disclosure, and the records against unauthorized copying, modification or disposal. That wording dates to 2004.
- Business Premium already includes eDiscovery (Standard), which carries case management and legal hold. It does not include custodian management, hold notifications, review sets, Communication Compliance or Customer Lockbox.
- There is no 60-day statutory breach clock in PHIPA. Section 12(2)(a) requires notice “at the first reasonable opportunity”. The 60-day window is a Fusion Computing operating standard, and worth keeping as one.
- Business Premium tenants reach the advanced tier through Microsoft Purview Suite add-ons, which need a Business Premium base licence and are capped at 300 seats in total. Microsoft publishes no Canadian list price for them, so scope that cost with your licensing partner.
- Verified Canadian list pricing, read August 5, 2026: Business Premium CA$29.80 per user per month and Business Standard CA$19.00, both on annual commitment.
The PHIPA and IPC regulator stack: what Purview must cover, explained
According to the Government of Ontario (2026), PHIPA s. 12(1) sets the security floor for any custodian holding personal health information in a Microsoft 365 tenant. It names two duties: protect the information against theft, loss and unauthorized use or disclosure, and protect the records against unauthorized copying, modification or disposal.
Purview covers most of that through sensitivity labels, data loss prevention, retention and eDiscovery. Disposal is the duty clinics still get wrong, because Business Premium retention defaults keep content indefinitely rather than deleting it on a clinical schedule.
[REGULATOR QUOTE] PHIPA s. 12(2)(a), read at source. The custodian shall “notify the individual at the first reasonable opportunity of the theft or loss or of the unauthorized use or disclosure”. There is no numeric deadline anywhere in the section. The 60-day figure clinics repeat back to me comes from the United States, not from Ontario.
Retention, disposal and the access-request exception
The second obligation worth naming is s. 13(1), which requires records of personal health information to be retained, transferred and disposed of in a secure manner. Section 13(2) adds that a record subject to an access request must be kept until the individual has exhausted their recourse, which is why a hold and a retention policy have to co-exist.
Ontario has also legislated an electronic audit-log duty at PHIPA s. 10.1, requiring custodians who use electronic means to maintain, audit and monitor a log. It sits in the consolidated statute awaiting proclamation, so treat it as a design target and check its status before relying on it.
Purview Standard vs Premium for Ontario clinics: the licensing decision
According to the Microsoft Purview service description (2026), eDiscovery (Standard) and Audit (Standard) reach down to Microsoft 365 Business Basic, Business Standard and Business Premium. eDiscovery (Premium), Communication Compliance and Customer Lockbox sit behind Microsoft 365 E5, Office 365 E5 or a Microsoft Purview Suite licence.
That boundary matters more than the price. A clinic on Business Premium already has legal hold, because hold is a feature of eDiscovery (Standard). What it lacks is custodian management, hold notifications, review sets with redaction, and the one-year audit retention in Audit (Premium).
Which seats actually need the advanced tier
For a 4-physician family health organisation, the economical pattern is Business Premium across clinical staff plus an advanced-tier licence for the privacy officer alone. Predictive coding and review sets only earn their cost when one person runs every hold and production cycle.
[ORIGINAL DATA] The add-on rule most clinics miss. Microsoft’s service description states that the Purview Suite add-ons for Business Premium require a Business Premium base licence and are capped at 300 seats in total. A group planning past 300 seats moves to an enterprise plan instead. Our engineers found this reshapes the roadmap for every multi-site group we quote.
Microsoft Canada (2026) lists Business Premium at CA$29.80 per user per month on annual commitment and Business Standard at CA$19.00. I read both on August 5, 2026. Microsoft does not publish a Canadian list price for the Purview Suite add-ons, so price those through your licensing partner rather than guessing.
The 6-row PHIPA Purview Decision Matrix
According to the Information and Privacy Commissioner of Ontario (2026), its custodian resources include a Privacy Management Handbook written for small health care organizations. This matrix maps those expectations to Purview features, the PHIPA section behind each row, the audit trail, and the licence tier.
| PHI category | Purview feature | PHIPA anchor | Audit trail | Minimum licence |
|---|---|---|---|---|
| Clinical email (referrals, lab results) | eDiscovery (Standard), retention policy | s. 12(1), s. 13(1) | Audit (Standard) | Business Premium |
| Teams chat with referring physicians | eDiscovery hold, Teams retention | s. 12(1), s. 13(1) | Audit (Standard) | Business Premium |
| Message monitoring for conduct or policy risk | Communication Compliance | s. 12(1), s. 17 (agents) | Policy match log | E5 or Purview Suite |
| OneDrive consent forms | DLP policy, retention policy | s. 12(1), s. 18 (consent) | DLP rule match log | Business Premium |
| Microsoft support access to tenant data | Customer Lockbox | s. 12(1), s. 17 (agents) | Lockbox approval log | E5 or Purview Suite |
| Litigation or IPC hold scope | eDiscovery (Premium) custodian management, review set | s. 12(1), s. 13(2) | Hold notification and custodian log | E5 or Purview Suite |
Legal hold for clinic records: the definition, what triggers a hold, and what Purview preserves
According to the College of Physicians and Surgeons of Ontario (2026), physicians must retain adult medical records for at least 10 years from the date of the last entry, and records of a child for 10 years after the day the patient reached or would have reached 18. The duty sits in the Medicine Act General Regulation, s. 19(1).
A legal hold is the decision to stop deletion because litigation, an investigation or a complaint is reasonably anticipated. In Purview it overrides every retention policy beneath it for the scoped custodians, which is the only defensible posture once a demand letter lands.
A hold preserves Exchange Online mailboxes, OneDrive accounts, SharePoint sites and Teams chat, including channel messages and anchored Loop components. It survives mailbox deletion, account disablement and policy-based purges. It does not survive tenant deletion, which is why offboarding a departing physician partner is its own runbook.
CPSO also flags s. 15(2) of the Limitations Act, 2002. Some proceedings can be brought as long as 15 years after the act complained of, so holding clinical records past the 10-year floor is defensible. In our practice that argument is what finally moves a partner group off tenant-wide defaults.
eDiscovery for PHIPA breach response: how to run the first five days
Per O. Reg. 329/04 (2026), s. 6.3 lists when a custodian must notify the Commissioner under PHIPA s. 12(3). Triggers include theft, use or disclosure by someone who knew they lacked authority, further unauthorized use after a loss, a pattern of similar losses, and any breach the custodian judges significant.
Section 6.3 also names the factors behind that judgment: sensitivity of the information, volume, how many individuals were affected, and whether more than one custodian or agent was responsible. Nothing in the regulation sets a day count.
The five-step case template
The breach workflow we run on every Ontario clinic engagement reuses one eDiscovery case template. Scope custodians to the affected accounts. Place a preservation hold. Run a content search across the suspected window. Stage the results into a review set, then hand it to the privacy officer with redaction wired in.
We measured the first three steps at roughly two hours on a pre-configured tenant. That is the difference between answering the Commissioner inside a week and reconstructing for a month.
Microsoft 365 Business Premium vs E5 Compliance: Purview feature gating
Per Microsoft Learn (2026), advanced indexing now runs automatically inside each search. Collections have been replaced by statistics-driven results, and the classic tools retired on August 31, 2025. Any clinic runbook older than that is describing screens which no longer exist.
The licensing question every clinic owner asks is whether the advanced tier earns its spread. That depends on who owns privacy at the clinic. A solo practitioner handling their own complaints can run on Business Premium plus disciplined retention. A family health organisation with a designated privacy officer needs one advanced seat.
A multi-site group with a compliance committee needs it for every member, and that is where the 300-seat cap starts to bind. The licence decision is a staffing decision first.
Customer Lockbox, the gate clinics forget
The gate most Ontario clinics underestimate is Customer Lockbox. When a Microsoft support engineer needs access to tenant data to resolve a ticket, Lockbox forces an explicit approval request to a named tenant admin before the access happens. Without it, that access leaves no clinic-side record. Talk to our team about scoping this for your clinic.
Configuration walkthrough: the 8-step deployment rollout and its go-live criteria
Retention policy, audit-log enablement and data loss prevention are the three baselines we treat as non-negotiable on any tenant holding sensitive data. This rollout layers PHIPA-specific eDiscovery and legal-hold configuration on top of them, in the order we run it on every new clinic engagement.
- Enable Audit at the tenant level. Verify audit search is on and reaching back at least 90 days. On a tenant where it was disabled at provisioning, backfill takes about 24 hours.
- Provision the advanced compliance licence for the privacy officer. Assign it standalone in the Microsoft 365 admin centre rather than bundled, so the cost stays traceable.
- Create the PHI sensitivity label. Scope it to Exchange, SharePoint, OneDrive and Teams, with encryption at rest plus do-not-forward and watermark sub-rules.
- Publish the retention policy. 10 years for SharePoint sites tagged Clinical Records, 7 years for Exchange mailboxes, 1 year for Teams chat unless a hold supersedes it.
- Configure the Microsoft Purview DLP policy. Block external sharing of any document carrying OHIP numbers, health card numbers or drug identification numbers. Set clinical staff to block with override and justification.
- Build the eDiscovery case template. Pre-create a Breach Response case and a Legal Hold case with standard custodians, search queries and production pipelines already wired.
- Configure Customer Lockbox. The approver group needs at least two named admins, with reject-by-default if no approval lands inside 12 hours.
- Run a tabletop test. Walk the privacy officer through a simulated IPC notice end to end. The first run takes 90 minutes and the third takes 25.
Common configuration mistakes Canadian clinics make
Per the Government of Ontario (2026), PHIPA s. 17 makes a custodian responsible for personal health information handled by its agents. An integration vendor misconfiguring a share does not shift accountability. Four mistakes recur on roughly two thirds of our clients’ inherited tenants.
- Retention set to delete after 7 years tenant-wide. This breaks the CPSO 10-year floor for adult records, and for a child the record can run to their 28th birthday. Scope retention by record type, never by tenant default.
- Audit search disabled at provisioning. Microsoft Learn (2026) notes the default flipped to on for new tenants in 2023, so tenants provisioned between 2018 and 2022 often have it off. Verify rather than assume.
- Legal hold scoped to mailboxes only. Clinic workflow runs on Teams chat and SharePoint as much as on email, so a mailbox-only hold misses most of the evidentiary record.
- External sharing left at anyone with the link. A 12-person clinic in the Halton region shared a consent-form SharePoint folder with a community pharmacy this way in 2025. Our engineers found the link surfacing in a third-party preview crawler within 48 hours.
Cost line items: per-user CAD pricing for a 4-physician FHO clinic
According to the Canadian Centre for Cyber Security (2026), ITSM.50.062 frames cloud as a shared-responsibility model where the split moves with the service model. Under software as a service, identity, data classification and configuration stay with the customer.
Which is the honest framing for this table. Microsoft supplies the platform; the clinic owns the labels, the retention schedule and the hold decision. The model below covers 8 seats.
| Seat type | Licence | CAD per user per month | Count | Monthly total |
|---|---|---|---|---|
| Privacy officer | Business Premium plus a Purview Suite add-on | CA$29.80 plus add-on (quoted by partner) | 1 | CA$29.80 plus add-on |
| Physicians | Business Premium | CA$29.80 | 4 | CA$119.20 |
| Practice manager | Business Premium | CA$29.80 | 1 | CA$29.80 |
| Medical office assistants | Business Standard | CA$19.00 | 2 | CA$38.00 |
| Managed Purview configuration and monthly review | Fusion Computing service line | CA$950 to CA$1,200 flat | 1 | CA$950 to CA$1,200 |
“We went from a panic call on day three of an IPC notice to a 48-hour scoped response with a defensible audit trail. The privacy officer can now answer the partner-meeting question about where our exposure sits without a follow-up email.”
The line that surprises Ontario clinic owners is the managed configuration and monthly review. A privacy officer who has never run a hold cannot defend one under cross-examination. The review keeps case templates current and produces a written attestation that the controls were tested. Get in touch if you want the attestation template.
Answers reviewed by Mike Pearlstein, CISSP.
Frequently Asked Questions
Does Microsoft 365 Business Premium include Purview eDiscovery?
Yes. Business Premium includes eDiscovery (Standard): case management, content search, basic production and legal hold. It excludes custodian management, hold notifications, review sets, predictive coding, Communication Compliance and Customer Lockbox, which need Microsoft 365 E5, Office 365 E5 or a Microsoft Purview Suite licence.
What PHIPA section does eDiscovery in Purview map to?
Section 12(1), which requires reasonable steps to protect personal health information against theft, loss and unauthorized use or disclosure, and the records against unauthorized copying, modification or disposal. Section 13(1) adds secure retention, transfer and disposal. Purview eDiscovery covers the preservation and logging halves.
How long should an Ontario clinic retain patient records in SharePoint or Exchange?
CPSO sets the floor at 10 years from the last entry for an adult record. For a child it is 10 years after the day the patient reached or would have reached 18, so the record can run to their 28th birthday. Scope retention by record type in Purview, never by tenant default.
What triggers a legal hold under PHIPA?
Reasonable anticipation of litigation, an IPC investigation, a complaint or a court order. The trigger a clinic actually sees is a written demand from patient counsel or an IPC notice. Place the hold within 24 hours. A pre-configured template turns that into minutes rather than a four-hour scramble.
Can a clinic place a Purview legal hold on Teams chat?
Yes, and eDiscovery (Standard) on Business Premium is enough. The hold preserves one-to-one chat, group chat, channel messages and anchored Loop components, and survives account disablement and policy-based purges. Custodian management and hold notifications are what need the advanced tier.
How does Customer Lockbox protect PHI from Microsoft support engineers?
Lockbox forces any Microsoft engineer requesting tenant data to submit a named approval request. A clinic admin or approver group sees the scope and engineer identity, then approves or rejects inside a configured window. Without it that access leaves no clinic-side record, and PHIPA s. 17 keeps accountability with the custodian.
Does PHIPA give clinics 60 days to notify a breach?
No. PHIPA s. 12(2)(a) requires notice to the individual at the first reasonable opportunity, with no numeric deadline. O. Reg. 329/04 s. 6.3 lists when the Commissioner must also be told, again with no day count. The 60-day figure comes from United States health privacy law. Fusion Computing holds its clinic engagements to a 60-day close as an operating standard, not a statutory rule.
What does a managed Purview configuration cost for a 4-physician FHO?
Roughly CA$950 to CA$1,200 per month flat, plus Microsoft 365 licensing at CA$29.80 per Business Premium seat and CA$19.00 per Business Standard seat, plus whatever your partner quotes for the Purview Suite add-on. The flat fee covers the eight-step rollout, monthly review, a quarterly tabletop and a written attestation.
Where does CLOUD Act exposure fit into a PHIPA-compliant Purview rollout?
Microsoft 365 tenants provisioned in the Canadian region hold core workload data in Canada Central and Canada East. The United States CLOUD Act still gives US courts a route to compel a US-headquartered provider. PHIPA imposes no residency rule, so residency is a control the clinic chooses. See our piece on cross-border PHI and the CLOUD Act.
Can a solo practitioner skip the advanced tier and run on Business Premium alone?
For day-to-day operations, yes. eDiscovery (Standard), legal hold, DLP and retention cover most PHIPA s. 12 obligations. The trade-off is that a real investigation means buying the advanced tier reactively, which takes 24 to 48 hours to provision under pressure. Pre-provisioning one seat is the defensible posture.
How does this interact with the CPSO AI disclosure rules for clinics using AI scribes?
CPSO expects Ontario physicians to disclose AI use to patients and retain the consent record. Purview labels and retention cover consent storage; eDiscovery covers the audit trail. Our CPSO AI Disclosure to Patients in Ontario covers the policy side.
Does Fusion Computing train the privacy officer to run eDiscovery cases independently?
Yes. The quarterly tabletop walks the privacy officer through a simulated IPC notice end to end, scoped against PHIPA s. 12. By the third quarter most can run a hold and a content search without us on the call. We stay involved for production work, where the risk of spilling unrelated information is highest.
Reviewed by Mike Pearlstein, CISSP, CEO of Fusion Computing Limited.
Related Resources
- AI for Healthcare Clinics in Canada: The Flagship Guide.
- OHIP Billing Data Security: A Clinic Owner’s Checklist.
- CPSO AI Disclosure to Patients in Ontario.
- Cross-border PHI and the CLOUD Act.
- Purview Legal Hold and eDiscovery Cost for an Ontario Law Firm.
- Fusion Computing Cybersecurity Services.
Bottom line
A PHIPA-ready Purview rollout is a four-week project when the licence tier is right and the eight steps run in order. Pre-configure the hold templates before you need them. The case template separates a 48-hour scoped response from a 30-day reconstruction. Contact us to scope your clinic rollout.
