O. Reg. 51/26 · Hospitals

Cyber security maturity assessment for Ontario hospitals

Ontario hospital cyber security has a legal floor since 1 July 2026: O. Reg. 51/26 covers public hospitals graded Group A, B or C and the University of Ottawa Heart Institute.¹ Hospitals meet it mostly through Ontario Health’s Cyber Security Operating Model, with an annual maturity assessment run with their Local Delivery Group and incident reports sent to Ontario Health.² We help hospital teams prepare the evidence and close the gaps.

Ask us to call you back Book the free audit

An empty hospital corridor with a polished floor, a laptop on a rolling cart beside a closed green office door, snowy trees through the window at the end — Most of the work sits in the administrative side of the hospital, away from patient areas.

A person here calls you back the same business day, usually within an hour.

Written permission first
A report in plain words
Checked again after the fix

Which Ontario hospitals the regulation covers

Two kinds of Ontario hospital fall under the provincial cyber security regulation, as section 2 of O. Reg. 51/26 sets out: a public hospital graded as a Group A, B or C hospital under the Public Hospitals Act, and the University of Ottawa Heart Institute by name.¹ The Ministry’s sector guidance describes the same set as public acute care hospitals and states that private hospitals sit outside the regulation.²

A public hospital graded in another group is absent from section 2, so its board should confirm its position with the Ministry before planning around the deadline. The general rules that apply to every covered entity, from the program to the summary format, are set out on the main O. Reg. 51/26 page; this page covers what is particular to hospitals.

Hospital types and O. Reg. 51/26
Hospital	Status	Source
Public hospital, Group A, B or C	Covered (s. 2, para. 2)	¹
University of Ottawa Heart Institute	Covered by name (s. 2, para. 3)	¹
Public hospital in another group	Absent from s. 2; confirm with the Ministry	¹
Private hospital	Outside the regulation	²

How hospitals meet O. Reg. 51/26 through Ontario Health and the Local Delivery Groups

Hospitals already working inside Ontario Health’s Cyber Security Operating Model (CSOM) satisfy most of the regulation through processes they know: the annual maturity assessment, incident notification to Ontario Health and the naming of contacts all run through the Local Delivery Group (LDG).² The Ministry states that the CSOM assessment tool is built on NIST CSF 2.0 and meets its approved requirements, so a hospital that completed its assessment there does not repeat it for the Ministry.²

Contacts. The hospital chooses its primary and alternate cyber security contacts; the LDG and Ontario Health validate them and send them to the Ministry’s Chief Information Security Officer. Changes go through the LDG or Ontario Health within 10 business days.²¹
Annual assessment. Hospitals complete a yearly maturity assessment in the Ontario Health tool, with the LDG sharing the work of conducting it. The regulation itself asks for one every two years, so the hospital cycle runs faster than the legal minimum.²¹
Summary. Ontario Health extracts the summary from the tool, the hospital reviews and approves it, and Ontario Health with the LDG submits it to the Ministry.²
Accountability. The hospital stays answerable for the authorization and accuracy of everything submitted in its name.²

Incident reporting: Ontario Health first, the Ministry within 72 hours, PHIPA alongside

A hospital reports a cyber incident to Ontario Health as soon as it is detected or suspected, under the Incident Response Notification Guidance. Once the incident is confirmed as critical, Ontario Health helps report it to the Ministry’s CISO within the 72 hours the regulation allows.²¹ Privacy duties under PHIPA run in parallel, and the Ministry will not file them for the hospital.²

O. Reg. 51/26, s. 7. A critical cyber security incident goes to the Ministry’s CISO no later than 72 hours after the hospital confirms it.¹
PHIPA, s. 12 (2). When personal health information is stolen, lost, or used or disclosed without authority, the custodian notifies each affected individual at the first reasonable opportunity and tells them they may complain to the Information and Privacy Commissioner.³
PHIPA, s. 12 (3), with O. Reg. 329/04, s. 6.3. The Commissioner must also be notified in prescribed cases, among them theft, deliberate unauthorized access, further disclosure after a first breach, a pattern of similar breaches, or a breach the custodian judges significant.³⁴
O. Reg. 329/04, s. 6.4. By 1 March each year the custodian reports to the Commissioner how many times health information was stolen, lost, used or disclosed without authority in the previous year.⁴

The hospital route under O. Reg. 51/26: contacts, the annual assessment, the summary, and the two reporting paths after an incident.

Where a hospital’s annual assessment benefits from outside hands

A hospital maturity score is quick to produce and slow to raise, because each improvement area competes with clinical projects for the same small IT team. Outside help is most useful at three points: before the assessment, while the hospital reviews its ratings, and after the score, when the areas for improvement turn into work. We work beside your LDG and the Ontario Health process; the hospital keeps every approval.

Before the assessment: the evidence behind each answer

We gather, function by function, the records an assessor will ask for: who holds administrator rights, when backups were last restored, which suppliers reach clinical or business systems remotely, how patches are tracked. Ratings backed by records survive the next assessor and the next incident.

During review: a second look before the hospital approves

Hospital approvers sign a summary that leaves the building. We read the ratings against the evidence and flag any score that rests on intent alone, so the version Ontario Health submits is one the hospital can defend.

After the score: closing the improvement areas

We take on the technical items on the non-clinical side: vulnerability scanning of internet-facing systems, email domain protection against impersonation, backup and recovery tested by an actual restore, phishing training for administrative staff, and a review of PHIPA safeguards for health records.

What the hospital’s leadership receives

Every engagement ends with documents the hospital owns and can hand to its board, its LDG or the next assessor.

An evidence register mapped to the six NIST CSF 2.0 functions used by the Ontario Health tool.
A short note for the board on where the hospital stands, written in plain language.
A ranked list of improvement items with owners and realistic dates, separating clinical systems from administrative ones.
For technical work: what was changed, how it was checked, and the result of the retest.
A one-page map of who calls whom during a suspected incident: Ontario Health, the Ministry route, the privacy office and the insurer.

Why a contracted team: the risks of doing it alone, with a chatbot or a freelancer

Hospital IT teams carry clinical systems that cannot go down, and the annual assessment arrives on top of that load; under time pressure the easiest rating to enter is the hopeful one. When a later incident shows the gap, the approved summary is already with the Ministry.

Pasting configurations, logs or patient-related details into a public chatbot can itself amount to a use or disclosure without authority under PHIPA, the very event section 12 requires the hospital to report.³ A lone freelancer with remote access becomes one more supplier connection to track, often without insurance, a signed scope or anyone covering the hours after an incident is confirmed.

A contracted team works under a written scope and a confidentiality agreement, keeps a record of every access, and stays available when the improvement plan becomes work.

Five plain reasons to trust us with this

A registered Canadian company
INNOVA CONSULT LTD., federal corporation 1522612-1, based in Ottawa. itopsi is its brand.
In practice since 2013
The group behind itopsi has run legal and marketing practices since 2013. Its founder has worked in law and compliance for more than 14 years.
We run servers of our own
Our own servers and more than 80 websites are checked for known vulnerabilities every day.
Insured
Commercial general liability insurance of CAD 1 million is in force.
Your scope, your report
A fixed scope in a signed letter before any work starts. Licences and equipment at cost, with no vendor commission. The report belongs to you.

How the work goes

Five steps, in the same order every time.

Before any test, you sign a scope letter: what we test, on which dates, who to call, and what we must leave alone.

Your signature comes first

Step 1

We agree what to check

A short call, or the form at the foot of this page. Together we decide which website, server or office systems we look at.

Step 2

You sign the scope letter

It sets the targets, the dates, the contacts, and what we must leave alone. Work starts only once it is signed.

Step 3

We check, and write it down

One report in plain words for you, with the technical detail attached for whoever looks after your systems.

Step 4

We fix it

We make the repairs ourselves, or together with your current IT provider or web developer.

Step 5

We check again

A second check confirms that each problem is closed.

What it costs

Each job is a different size, so each one gets a fixed quote once the scope is agreed. You see the price in writing before any work starts.

Ask for a quote →

A fixed quote once the scope is agreed
The price in writing before work starts
A second check after the fixes

Questions

Questions owners ask us

Your question is missing? Leave your number and ask it in your own words.

Ask on a call

Which Ontario hospitals are covered by O. Reg. 51/26?

Public hospitals graded as Group A, B or C under the Public Hospitals Act, plus the University of Ottawa Heart Institute, which the regulation names. The Ministry’s guidance calls these public acute care hospitals and says private hospitals are outside the rule. A public hospital in another group is absent from the list and should confirm its status with the Ministry.

How does the CMA fit with Ontario Health’s cyber requirements?

Hospitals inside Ontario Health’s Cyber Security Operating Model complete an annual maturity assessment in the Ontario Health tool with their Local Delivery Group. The Ministry accepts that tool, which is built on NIST CSF 2.0, for the regulation. Ontario Health extracts the summary, the hospital approves it, and Ontario Health with the LDG submits it to the Ministry’s Chief Information Security Officer.

Do we need a second assessment if we already use the Ontario Health tool?

The Ministry says a hospital that completed its maturity assessment through the Ontario Health tool does not need a duplicate. The same assessment and summary serve both Ontario Health and the regulation. What changes is accountability: the hospital approves the summary and answers for its accuracy, so the evidence behind each rating matters more than before.

How does PHIPA interact with incident reporting?

They run side by side. The regulation sends critical cyber incidents to the Ministry within 72 hours of confirmation, through Ontario Health for hospitals. PHIPA section 12 requires notice to affected patients at the first reasonable opportunity and, in prescribed cases such as theft or a significant breach, notice to the Information and Privacy Commissioner. The Ministry does not file privacy notices for the hospital.

How long does a hospital maturity assessment take?

The provincial standard assessment holds more than 100 statements across six functions, and the Ministry notes that completion time depends on how prepared the organization is. Hospitals with evidence already organized move quickly; those starting from scattered records need longer. After a first conversation and a look at your records, we put a realistic schedule in the scope letter, with dates your LDG can plan around.

What should a hospital do first when it suspects a cyber incident?

Avoid wiping, rebuilding or restoring affected machines, paying anyone, or deleting logs before the right people are involved. Notify Ontario Health under the Incident Response Notification Guidance, call the police if the incident looks criminal, and tell your cyber insurer. The Canadian Centre for Cyber Security also accepts reports. For hands-on help, use our emergency page and the person on duty calls you back.

What does hospital cyber security work with you cost?

The price depends on the number of sites, the systems in scope, how much evidence already exists and whether you want the technical fixes done as well. After a 30-minute conversation we send a scope letter with one fixed price for the agreed work. The hospital approves that figure before anything starts, and it is the figure you pay.

Tell us what worries you.

Leave your name and a number. A person here calls you back the same business day, usually within an hour, and asks what you want checked. Would you rather start on your own? The free audit takes about three minutes.

Book the free audit instead

Same day callback
Written permission first
Fixed quote