Canada · Readiness Scan
A privacy program you could hand over tomorrow.
Most organisations have the pieces. What is usually missing is the documentation showing how they connect, who owns them, and when they were last reviewed. The Scan produces that record.
Two versions of the Scan
Variant A
Public bodies under POPA
The privacy management program required by the Protection of Privacy Act, assessed against what the Act actually asks for rather than against a generic framework.
Municipalities, agencies, boards, commissions, post-secondary institutions and school authorities.
Variant B
Health custodians under the HIA
The same assessment against the Health Information Act as amended by Bill 11, including the PIA obligations that now attach to AI scribes and similar tools.
Multi-site custodians, continuing care operators, rehabilitation networks and larger practices.
What you receive
Seven documents, delivered together as one record.
- Information inventoryWhat personal or health information the organisation holds, where it sits, which systems touch it, and who has access.
- Authority and purpose registerThe stated basis for each collection, use and disclosure, matched against what the statute permits.
- Program gap assessmentYour privacy management program measured against what POPA or the Health Information Act actually requires, with each gap named rather than scored.
- PIA register and priority listWhich systems have a current privacy impact assessment, which need one, and which need updating. AI scribes and other automated tools are assessed here.
- Policy, procedure and agreement reviewThe documents you rely on, what is missing, what is out of date, and which vendor and information manager agreements do not cover what they need to.
- Remediation roadmapEach gap sequenced by exposure, with the effort involved and who would own it. Written to be handed to a team rather than re-interpreted.
- Board-ready summaryOne document for the people who approve the budget, in language that does not assume a privacy background.
How it runs
Step one
Kickoff pack
You send a defined set of documents and answers. The turnaround clock starts when that pack arrives complete, not when the agreement is signed.
Step two
Assessment and interviews
A fixed number of short interviews with the people who actually hold the obligations, alongside a documentary review.
Step three
Delivery and one revision
The full record, plus a summary written for people who will not read the full record. One round of revisions is included.
If you go further, the Scan pays for itself
The full Scan fee is credited against a qualifying follow-on engagement contracted within ninety days. The Scan is designed to tell you whether the larger piece of work is warranted, so it should not cost you twice if the answer is yes.
If you run a one or two-physician clinic
The Scan is built for larger organisations and is more than a single-site clinic needs. There is a smaller, faster version of this work on the clinic page.
Find out whether the Scan fits.
Forty-five minutes. Scope and fee follow the call, once it is clear which variant applies.
Book a scoping callOr write to hello@connextbusinesssolutions.com