Security Center

Canadian hosted

Patient data is stored in Canada.

Encrypted

Protected when stored and when sent.

Access recorded

Views in the app and every change are logged.

Ministry validated

Passed Ontario Ministry of Health conformance.

Layers of protection

Independent safeguards. No single failure exposes patient information.

Canadian hosted

Patient data is stored in Canada.

The database and file storage are in Canada
Encryption keys are held in Canada
Database backups are configured to stay in Montréal
Service providers and where they operate are listed on the Service providers tab

Encrypted everywhere

Data is unreadable without the correct encryption keys.

TLS encryption between the browser and MDPay
AES-256 encryption for all stored data
Encryption keys rotate automatically every 90 days
The database rejects any unencrypted connection

Strict access control

Access requires strong identity checks. Each practice's data is isolated.

Sign-in by one-time code, not a reusable password
Authenticator app required on every account
Automatic sign-out after one hour of inactivity
Practice data is separated inside the database, not only the app
MDPay staff use a separate console, limited to an approved list of staff, and their sign-in requires a second factor

Access and changes recorded

Activity involving patient data leaves a record of who and when.

Patient information viewed in the MDPay app is logged with the person and the time
Changes are logged with the person and the time
Downloads and exports of patient data are logged before the file is released
The audit trail is encrypted and stored in Canada
System logs are filtered to remove known patient fields before they are written

Backed up and recoverable

Data can be restored after an incident.

Encrypted database backups every day
Restore to a specific point in time, not only the last backup
Safeguards against accidental database deletion
Replaced files can be recovered for a period after they change

Isolated network

Core systems are closed to the public internet.

The database has no public internet address
The website accepts secure HTTPS connections only
Uploaded claim files, onboarding sample files and documents sent to the Ministry are virus-scanned inside MDPay's own environment, and a file that fails the scan is never imported or sent

Secure engineering

Changes go through a controlled release process.

Changes reach production only through a pull request
Automated tests, including tests that one practice cannot see another's data, are part of the release process
Passwords and keys are kept in Google Secret Manager in Canada, not in the code
Each service runs under its own service identity

Commitments

Standing commitments to every physician and group.

Patient information is handled only as the physician's or group's agent under PHIPA, under a written agreement
Patient information is never sold, and identifiable patient information is never used to train AI models
Service providers that process patient information are listed on this page and bound by written terms
A privacy breach is reported to the physician or group at the first reasonable opportunity
When an agreement ends, patient information is deleted on the timeline it sets, with written confirmation on request
Priority support from the MDPay team

Standards and laws

The frameworks that govern how MDPay handles health information.

PHIPA

Ontario's Personal Health Information Protection Act. MDPay acts as the custodian's agent. Patient information is handled only on the custodian's behalf.

Ontario Ministry of Health conformance

The claims (MC EDT) and health card validation connections passed Ministry conformance testing. Production access was granted on that result.

ISO/IEC 27001, 27017, 27018 and SOC 2

MDPay runs on Google Cloud, which is independently audited against these standards. The certifications belong to Google Cloud.

AES-256 and TLS encryption

Industry-standard encryption. AES-256 protects stored data. TLS protects data sent across the internet.

Information and Privacy Commissioner of Ontario

The Commissioner oversees PHIPA. Patients with an unresolved privacy concern can contact the Commissioner directly.

Shared responsibility

Keep sign-in codes and authenticator apps private
Remove access for staff as soon as they leave
Never share a GO Secure password, including with MDPay
Report anything unusual to MDPay right away

Questions or concerns?

Report a concern, or request more detail on any safeguard listed here.

hello@mdpay.ca

Privacy Officer

Privacy questions, requests and complaints go to MDPay's Privacy Officer.

privacy@mdpay.ca

MDPay Data Vault

Designed for security and privacy from the ground up. Patient, physician and group data stays private, by default.

How data stays separated

Three rules, enforced by the database on every request.

Billing Stamping
Every piece of data is stamped with the group and physician it belongs to. Only users with a verified key can access it.
Checked on every request
The database matches the stamp to the user's verified key before returning anything.
Nothing crosses the line
Data without a matching stamp is never returned. Not even if the app asks for it.

Separation is enforced by the database itself, not only the app
Each group's data is isolated from every other group
Physician data stays with the physician it belongs to
Automated tests of the separation are part of the release process

An innovation in Canadian healthcare

Each physician sees their share

A group remittance advice (RA) is one file covering every physician in the group. MDPay Data Vault shares each physician only their section, securely.

Group viewThe complete remittance advice.

Physician A

Physician B

Physician A

Physician C

Physician B

Physician A

Physician C

Physician A viewOnly Physician A's lines.

Physician A

Private

Physician A

Private

Physician A

Private

Each payment line is matched to the physician who billed it
A physician receives only the sections holding their own claims
Other physicians' lines are never returned to them
The group keeps the complete file

Made possible by MDPay Data Vault.

How accounts are validated

A multi-part check with the Ministry of Health. Every group and physician authenticates before seeing the data they are entitled to.

1. Verified sign-in
Every account signs in with a one-time code and an authenticator app.
2. Ministry designation
The group or physician designates MDPay in OPS BPS Secure, the Ministry's own portal.
3. Designation accepted
A person at MDPay confirms the account holder by name, then accepts the designation in the Ministry's portal.
4. Permissions granted
The account holder grants each Ministry service in OPS BPS Secure. No one else can grant them.
5. Ministry confirmation
MDPay asks the Ministry what was granted. Access is set from that answer, never by hand.

Accounts go live only after the Ministry confirms the permissions
The Ministry's confirmation must be less than 24 hours old
Every transmission re-checks the Ministry permission
Permissions can be revoked in OPS BPS Secure at any time

Connecting a group

A group shares its Ministry data with MDPay once. Access stays under the group's control.

Step 1
Designate MDPay
The group adds MDPay as a designee on its Ministry MC EDT account.
Step 2
Files arrive in the vault
Claims, remittance advice and error reports arrive over the Ministry's secure connection.
Step 3
The group grants access
The group decides which physicians and staff can see its data.

Step-by-step instructions: Connect your OHIP billing to MDPay

When a physician bills through MDPay

Physicians use MDPay to bill for the care they provide. The same safeguards protect every patient record.

Protected by Ontario law

The Personal Health Information Protection Act (PHIPA) applies.

The physician remains the custodian of the health record
MDPay acts as the physician's agent under PHIPA
Information is handled only on the physician's behalf
Privacy breaches are reported to the physician

Canadian hosted, encrypted

Patient information is stored in Canada and unreadable without the right keys.

The database and file storage are in Canada
Encrypted when stored and when sent
Encrypted backups every day

Access is limited and logged

Only authorized people can see patient information, and activity leaves a record.

Visible to the physician's practice and the staff it authorizes
MDPay staff see it only as needed to provide the service, through an approved account
Views in the MDPay app and every change are logged with the person and the time

Used for billing care

Patient information is used to bill the Ontario Ministry of Health for care received.

Health card numbers are checked directly with the Ministry
Claims travel to the Ministry over its validated, encrypted connection
Never sold, and never used to train AI models in identifiable form

Seeing or correcting a record

The physician's office holds the health record. Requests to see or correct it go there first.

Unresolved privacy concerns can go to the Information and Privacy Commissioner of Ontario.

Privacy questions

Questions about how MDPay protects patient information go to MDPay's Privacy Officer.

privacy@mdpay.ca

Service providers

The companies that handle customer data on MDPay's behalf, what each one does, and where.

Google Cloud

Processes patient information

Hosting for the MDPay service: application servers, database, file storage, encryption keys, background processing, virus scanning and AI features (Vertex AI).

Data handled: Patient and billing information processed through the service
Location: Canada (Montréal)

Resend

No patient information

Delivery of account emails: sign-in codes, invitations, setup notices and copies of signed agreements.

Data handled: Names and email addresses of physicians and staff. No patient information.
Location: United States

Google Workspace

No patient information

MDPay's own email, and calendar invitations for onboarding calls.

Data handled: Names and email addresses of physicians and staff. No patient information.
Location: Google data centres (not region-restricted)

The Ontario Ministry of Health receives claims and health card checks as the payer, at the physician's or group's direction. It is not an MDPay service provider.

Changes to this list

Customers get at least 30 days' notice, in the app or by email, before a new provider begins processing patient information. Urgent security or continuity changes are notified as soon as reasonably practicable. Every change is recorded here.

September 30, 2026. Service provider list first published.

Questions about a provider?

Ask for more detail about any provider, or the terms it is bound by.

hello@mdpay.ca

Layers of protection

Canadian hosted

Encrypted everywhere

Strict access control

Access and changes recorded

Backed up and recoverable

Isolated network

Secure engineering

Commitments

Standards and laws

PHIPA

Ontario Ministry of Health conformance

ISO/IEC 27001, 27017, 27018 and SOC 2

AES-256 and TLS encryption

Information and Privacy Commissioner of Ontario

Shared responsibility

Questions or concerns?

Privacy Officer

MDPay Data Vault

How data stays separated

Billing Stamping

Checked on every request

Nothing crosses the line

Each physician sees their share

How accounts are validated

1. Verified sign-in

2. Ministry designation

3. Designation accepted

4. Permissions granted

5. Ministry confirmation

Connecting a group

Designate MDPay

Files arrive in the vault

The group grants access

When a physician bills through MDPay

Protected by Ontario law

Canadian hosted, encrypted

Access is limited and logged

Used for billing care

Seeing or correcting a record

Privacy questions

Service providers

Google Cloud

Resend

Google Workspace

Changes to this list

Questions about a provider?