Your practice
If you run a private practice you almost certainly have confidential records on a consumer laptop, a personal phone, and a cloud service you chose for convenience. That is a worse position than a large clinic, not a better one, because there is no IT department behind you. We are not going to tell you this is illegal, because for most practitioners it is not. What is real is narrower and more awkward: your college can ask you, without warning, where and how patient records are stored and what safeguards are in place, and you are expected to have that written down. Most people do not.
Check whether disk encryption is actually on. This changed recently and old advice is wrong: Windows 11 has encrypted by default since version 24H2 on clean installs, including Home, and macOS 26 enables FileVault during setup. But upgrades from older Windows are often still unencrypted, and a PC set up with a local account only can be encrypted with no recovery key saved anywhere, which is its own problem. Backups are the part still commonly unprotected — an iPhone backup through Finder is not encrypted unless you tick the box, and iCloud Backup is only end-to-end encrypted if Advanced Data Protection is switched on. Then write one page saying where records live, who can reach them, and what protects them. That page is the thing you will be asked for.
If you are unsure whether what you have written down would survive being asked for, this is worth an hour with someone who does privacy work for small practices. Your college may also point you at guidance.
A · Verified
Checked 4 Sep 2026 · Review by Mar 2027
CCHPBC Record-Keeping Standard in force 1 April 2026, BC PIPA s.34, Alberta Health Information Regulation AR 106/2026, Alberta OIPC Order HIA2026-01, Microsoft BitLocker documentation, Apple macOS 26 enterprise release notes.
Grading explained on the home page. Every correction we have made is published.