Security and Reliability

Your Trusted Partner in Secure, Reliable Healthcare Technology

Trust Accuro to be your partner

When you choose an EMR, you’re choosing a partner who will safeguard your most critical information. At Accuro, we build trust into everything we do so you can be confident your business and patient data are protected. From our Canadian-based cloud infrastructure to our privacy oversight, we deliver reliability, security, and privacy without compromise.

This page provides a summary of Accuro’s privacy, security, and reliability measures. For a more detailed description of our policies and practices, please see our Overview of Operational, Security, Privacy, and Compliance Frameworks open_in_new .

Our commitment to reliability, security, and privacy has our people behind it.

30+

staff dedicated to reliability and performance.

50+

staff working on product quality, security, and privacy.

A dedicated Data Privacy team that ensures patient data is kept private.

90+

live Client Services staff, so you have help when you need it.

Reliability you can see

Accuro EMR runs on a robust, Canadian-based cloud infrastructure designed for performance and uptime. By maintaining our own data centres, we ensure your data stays in Canada under strict privacy standards while allowing us to respond quickly and effectively to any operational needs. You can learn more about our Cloud EMR hosting here.

System Availability and Maintenance Windows: We ensure 99.9% availability for our Accuro, Accuro Engage, and Medeo services (excluding planned maintenance windows). Any exceptional maintenance that occurs outside of our regular maintenance windows is always communicated well in advance so customers can prepare. We continuously monitor system performance and provide live, transparent reporting on uptime and service status through our public Accuro Status Page open_in_new .

Disaster Recovery: Our infrastructure includes resilience and recovery capabilities designed to minimize downtime and support faster restoration during unexpected events.

Product Quality Management - ISO 13485:2016: Accuro is built using a mature software development process that includes certification to ISO 13485:2016, a quality management standard for medical devices that requires rigorous controls and risk management. This means every stage, from design and coding to testing and maintenance, is carefully planned, documented, and reviewed to ensure reliability and safety.

By adhering to these practices, we deliver software that meets strict regulatory requirements and provides consistent, secure performance for healthcare environments. Learn more about our Cloud EMR here.

Security you can trust

When it comes to protecting sensitive healthcare data, promises are good but proven safeguards are better. We put the following measures in place to keep your information secure.

SOC 2 Type 2 Compliance

SOC 2 provides independent validation that we have implemented robust controls to protect client data. The SOC 2 audit evaluates the controls we have in place to protect the security and availability of our customer's data. We undergo an annual audit conducted by a qualified third-party auditor, to maintain SOC 2 Type 2 compliance for Accuro EMR, Accuro Engage, and Medeo for the Trust Services Criteria Security and Availability.

We are able to share our SOC 2 reports with clients once a Non-Disclosure Agreement is signed to protect the confidentiality contained within.

A Service Organization Control 2 (SOC 2) report evaluates how well a company protects customer data, based on the Trust Services Criteria (TSC) established by the American Institute of Certified Public Accountants. It provides assurance to customers and stakeholders that effective controls are in place to safeguard data and ensure reliable system operations.

Trust Services Criteria (TSC)
The report evaluates controls against one or more of these five principles:

Security – Protection of systems and data from unauthorized access.
Availability – Systems are available for operation and use as committed.
Processing Integrity – System processing is complete, accurate, and authorized.
Confidentiality – Information designated as confidential is protected.
Privacy – Personal information is collected, used, and retained appropriately.

Type 2:

Tests the operating effectiveness of controls over a defined audit period.
Demonstrates how a company’s control environment operated throughout the audit window (for Accuro and Accuro Engage, this period is 12 months).

NIST Cyber Security Framework 2.0 Compliance

We conduct an annual security maturity assessment aligned with NIST to evaluate and strengthen our cybersecurity posture. The assessment is performed by an independent, third-party entity. These measures mean our processes and infrastructure meet globally recognized benchmarks for protecting sensitive healthcare data.

NIST CSF 2.0 refers to the National Institute of Standards and Technology (NIST) Cybersecurity Framework version 2.0, and it is designed to help organizations assess and improve their ability to prevent, detect, and respond to cybersecurity risks.

NIST CSF 2.0 has 6 core functions:

Govern – establishes organizational context, roles, and risk management strategies.
Identify – understand and manage cybersecurity risks to systems, assets, data, and capabilities.
Protect – implement safeguards to limit or contain potential cybersecurity events.
Detect – identify the occurrence of a cybersecurity event.
Respond – take action regarding a detected event.
Recover – maintain plans for resilience and restore capabilities impaired by a cybersecurity event.

We also comply with the following industry-leading measures:

Vulnerability Management
A proactive process designed to identify, assess, prioritize, and remediate security weaknesses across our systems, applications, networks, and cloud environments to reduce organizational risk and protect against cyber threats. In addition to our vulnerability management program, we conduct regular patching and automated scans of the security of our infrastructure.

Alerting and Monitoring
Accuro’s environment is monitored 24x7x365 to track network activity, system logs, and user behaviour to identify anomalies, unauthorized access, or malicious actions. Alerts are triggered when predefined thresholds or suspicious patterns are detected, enabling rapid incident response. The logs from our environment are stored in Canada and retained for up to 10 years. Network devices, including firewall and other boundary devices, are in place to control and monitor communications at the external boundary of the network and at key internal boundaries within the network.

Defense in Depth
Accuro makes use of overlapping and redundant security measures so that if one measure is overcome, other measures will still provide protection to detect, delay, or block an attack. We use multiple key vendors and partners to ensure comprehensive security against online threats.

Penetration Testing
Regular third-party testing designed to simulate real-world cyberattacks on our IT infrastructure so we can identify and address vulnerabilities before malicious actors can exploit them. Penetration testing is carried out before every major version or new application is released.

Multi-Factor Authentication (MFA)
All user logins include 2-factor authentication to ensure an added layer of protection for Accuro user accounts.

Encryption
Data is encrypted both at rest and in transit.

Privacy without compromise

Your patients’ privacy is non-negotiable, and we commit to protecting it in the following ways:

Accuro’s Data Privacy Officer and privacy team members ensure that data privacy is built into our products and processes. All Accuro employees receive mandatory privacy training.
We work continuously to comply with the evolving Canadian federal and provincial requirements for privacy in the six provinces where we operate, and we have formal policies and procedures for handling privacy events.
Our License and Services Agreement requires that both we and our clients will promptly notify each other of any breach of confidentiality or misuse of confidential information belonging to either party. We will also report any incidents to the regulatory authorities when required.

Data residency

We believe that you, as custodians of your patients’ information, always retain ownership of it. When we interact with your data, it is stored only long enough to complete the transaction it was collected for. Any Personal Health Information we handle, including backups of that information, is stored only in Canada in professionally managed data centres.

Our Privacy Policy describes in more detail how we collect, use, disclose, and protect your personal information when you use or interact with our sites or services.

Provincial regulation compliance

In addition to federal privacy regulations, Accuro also holds certification with the following provincial programs:

Ontario

OntarioMD EMR Certification Program open_in_new , which ensures EMR vendors meet defined technical, functional, and regulatory requirements for operation in Ontario.
Ontario Health’s Virtual Visits Program open_in_new , which verifies and validates video and secure messaging solutions to ensure they meet all mandatory requirements for privacy, security, technology, accessibility, and functionality.

As part of our compliance with the two programs above, Accuro undergoes both a full Threat Risk Assessment and a full Privacy Impact Assessment for each program every two years.

Accuro EMR for Ontario Providers

Saskatchewan

Recognized by the Saskatchewan Medical Association EMR Program open_in_new which outlines requirements for EMR use in physician practices, and which supports participation in provincial EMR adoption and funding initiatives.
Integrated with eHealth Saskatchewan open_in_new provincial systems, which enables secure connectivity to key provincial digital health services, helping clinicians access and exchange information.

Accuro EMR for Saskatchewan Providers

Nova Scotia

Nova Scotia’s e-Health Electronic Medical Records Certification open_in_new , which ensures an EMR meets functional, technical, privacy, interoperability, and quality indicators, as well as data migration and reporting requirements.

Accuro EMR for Nova Scotia Providers

Manitoba

Manitoba eHealth’s EMR Certification Program open_in_new , which outlines the fundamental clinical and administrative features and data elements required in an EMR to support clinic operations and provincial initiatives, and to reliably and securely integrate with Manitoba’s provincial services.

Accuro EMR for Manitoba Providers

Alberta

Accuro is integrated with Alberta Health Services billing, electronic delivery of labs and diagnostic imaging, and provincial systems like Netcare and CII/CPAR. Accuro supports healthcare providers and clinics across Alberta.

Accuro EMR for Alberta Providers

British Columbia

Accuro provides EMR connections to MSP billing, labs and imaging results, BC CareConnect and other provincial systems. Accuro’s head office is located in Kelowna, British Columbia, and we have been supporting BC healthcare providers for over 20 years.

Accuro EMR for BC Providers

Ready to learn how Accuro can support your clinic?

Explore our solutions or reach out to our team. We’re here to help you deliver care with confidence.

Book a demo

Not ready for a demo?

Keep in touch open_in_new