A Licensee is responsible for the security of its information systems and networks and should act in a timely and co-operative manner to prevent, detect and respond to security incidents. A Licensee is further required review and assess the security of information systems and networks and make appropriate modifications to security policies, practices, measure and procedures on a regular basis. Any security incidents must be disclosed to the CPU on a periodic basis.

A Licensee that holds Patient Health Information must maintain the security of the Patient Health Information, ensuring it is stored in a way that can be readily retrieved and easy removed or shared, as well as protecting the accuracy of the information. A Licensee if further responsible for ensuring reasonable safeguards are put in place to protect the Patient Health Information from loss, destruction, potential fire / water damage, tampering, theft, unauthorized access, use, modification, or disclosure (section 31, HDPR).