We work with clinics and healthcare service firms in Quebec. It always starts with an operational problem. Compliance with Law 5 and Law 25 gets settled in the architecture, before any code is written.
Our clients did not call us to talk about compliance. They had a problem costing them hours every week.
People paid for their judgement spend their days retyping information from one system into another.
An EMR, an inbox, a shared folder, two spreadsheets. Nobody has the full picture and everyone wastes time rebuilding it.
When they take a week off, things stall. When they leave, things get lost.
The idea is good, the tool exists, but nobody knows for certain what is allowed. So the project waits.
Four ways in. Most engagements start small and grow.
We look at your tools and your data flows, then compare them against the real requirements: Law 5, Law 25, section 12.1 on automated decisions, and the criteria in the ministry's verification kit. You leave with a list of gaps, ranked by what is urgent.
When nothing on the market does the job, we build. Matching, document extraction, payment reconciliation, dashboards, portals. Delivered on subscription, hosting and maintenance included.
You already have a system and it does not tick every box. We fix it instead of replacing it: bring inference back to Quebec, add human review where the law requires it, make decisions traceable.
A privacy impact assessment is mandatory before acquiring or rebuilding a system that touches health information. The register of technology products must be published on your website. We produce both.
Our clients would rather we did not name them here. Here is what we built.
Requests were assigned to practitioners by hand, out of an inbox.
A system that reads the request, proposes a short list of relevant practitioners and lets the team choose. The final decision stays human, which keeps it on the right side of section 12.1.
Interac payments were reconciled against invoices manually, every week.
A system that matches payments to invoices automatically, partitioned by clinic all the way down to the database.
Scanned forms keyed in by hand, with the error rate that implies.
Two models read each form in parallel. Where they disagree, the reviewer sees both candidates and decides. The gap between models becomes the confidence signal.
Quebec's AI requirements are written down in black and white. Here is how we meet them.
No personal information leaves the territory, including in calls to generative AI models.
Once a person has validated a result, the system cannot change it.
The user sees what the recommendation rests on, not just the conclusion.
Access, decisions and corrections are recorded and exportable.
Every result carries the version of the system that produced it.
About twenty plain-language questions, roughly five minutes. Your answers stay in your browser.
The questionnaire covers some of the obligations, not all of them. It is not legal advice and it does not say you are compliant: it reports what follows from your answers.
Yes. Since 1 July 2024, the Act respecting health and social services information covers public network bodies, but also any person or group operating a private professional practice. A clinic with no link to the public network is subject to it.
Both apply inside the same clinic, to different data. Law 5 covers the medical side: records, diagnoses, results, and the information collected when a patient registers. Law 25 covers the rest: employee files, payments, newsletters, your website.
Certification applies to vendors of technology products, not to the clinics using them. It becomes mandatory when a product connects to a shared provincial information asset or is deployed across more than one institution. If you are buying a tool rather than selling one, your obligation is the privacy assessment.
The organisation acquiring or rebuilding the system. Santé Québec completed one for its own institutions, but it is valid only for them. A clinic outside the public institutions must do its own, for its own environment. No accreditation is required to produce one.
The border that matters is Quebec's. Plenty of people think about the Canadian one and watch the wrong line. As soon as personal information leaves Quebec, including through a call to a generative AI model, the law requires a prior assessment showing the information gets adequate protection, and a written agreement with the provider. Consumer ChatGPT terms fail that test. Commercial API terms, with their data processing addendum, can pass it, provided you actually do the exercise and document it. Most major models can also run out of Montreal, which settles the question at the source.
It depends what we build, and we will not know until we have talked. The automated diagnostic is free. For the rest, we take a call, look at the problem, and come back with a proposal.
Easiest thing is twenty minutes on a call. If we cannot help, we will tell you.
Book a call