Trust

Privacy built for practices worldwide

MedCrest PMS is designed for optometry and dental practices across North America, Oceania, and Latin America — with privacy and security aligned to the laws that protect patient and personal information in each market.

Regional frameworks

HIPAA-class obligations, mapped by country

No single global “HIPAA” exists. MedCrest aligns product controls and customer agreements to the primary privacy and health-information frameworks below.

Canada

PIPEDA

Personal Information Protection and Electronic Documents Act - Canada’s federal private-sector privacy law for how organizations collect, use, and disclose personal information in commercial activities.

  • Collect only what is needed to run the practice and the product
  • Be clear about purpose of use for patient and staff data
  • Safeguard personal information with appropriate controls
  • Support access and correction requests via the practice as data steward
  • Respect provincial health privacy laws (for example PHIPA in Ontario)
United States

HIPAA

Health Insurance Portability and Accountability Act - protects Protected Health Information (PHI) for covered entities and their business associates.

  • Supports Privacy, Security, and Breach Notification Rule expectations
  • Access controls, authentication, and audit-friendly logging
  • Encryption in transit and at rest for clinical and patient data
  • Business Associate Agreement (BAA) when MedCrest processes PHI
  • Breach notification processes aligned with customer requirements
Australia

Privacy Act & APPs

Privacy Act 1988 and the Australian Privacy Principles (APPs) - health information is treated as sensitive information, with stricter collection, use, disclosure, and security rules. Enforced by the OAIC.

  • Handle health information as sensitive under the APPs
  • APP 8 accountability for overseas disclosures of personal information
  • Security safeguards appropriate to the sensitivity of the data
  • My Health Records Act obligations when connecting to My Health Record
  • State and territory health privacy laws may also apply
New Zealand

Health Information Privacy Code

Privacy Act 2020 plus the Health Information Privacy Code 2020 - 13 health-specific rules for health agencies. This is New Zealand’s closest HIPAA analogue. Enforced by the Office of the Privacy Commissioner.

  • Apply the Code’s 13 rules to health information held by health agencies
  • Limit collection, use, and disclosure to authorized health purposes
  • Security and storage safeguards for health records
  • Rule 12: restrict overseas transfers unless comparable safeguards apply
  • Support individual access and correction pathways
Mexico

LFPDPPP

Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) - Mexico has no standalone HIPAA-style health statute. Health data is sensitive personal data under general privacy law (public bodies follow LGPDPPSO).

  • Treat health data as sensitive personal data with heightened protections
  • Privacy notice and, where required, express consent for sensitive data
  • ARCO rights: access, rectification, cancellation, and opposition
  • Security measures and controlled domestic / international transfers
  • COFEPRIS rules may also apply if software is regulated as a medical device
At a glance

How the frameworks compare

Use this map when planning multi-country deployments, hosting regions, and customer agreements.

Country Primary framework HIPAA parallel Watch also
Canada PIPEDA Federal privacy + provincial health laws PHIPA (Ontario) and other provincial statutes
United States HIPAA Privacy, Security, Breach Notification Rules BAA; state privacy / breach laws
Australia Privacy Act 1988 + APPs Health = sensitive information under APPs My Health Record; state/territory laws; APP 8 transfers
New Zealand Privacy Act 2020 + Health Information Privacy Code 13 health-specific Code rules Rule 12 cross-border limits
Mexico LFPDPPP (private) / LGPDPPSO (public) Health data as sensitive personal data Express consent; ARCO rights; COFEPRIS if SaMD
Shared controls

One platform. Multiple regulatory realities.

Whether you operate in one country or several, MedCrest provides product controls that help practices meet local obligations as custodians of patient information.

Role-based access

Limit who can see charts, billing, and messaging - so staff only get the data their job requires.

Encryption & secure hosting

Protect personal and health information with modern encryption and hardened infrastructure - Cloud, Local, or Hybrid.

Audit visibility

Activity trails help practices investigate access, support compliance reviews, and respond to incidents.

Consent-aware outreach

Patient communication tools are designed to respect consent and communication preferences in your market.

Cross-border transfer awareness

Hosting and vendor flows consider APP 8 (Australia), Rule 12 (New Zealand), LFPDPPP transfer rules (Mexico), and similar accountability duties.

Customer agreements

DPAs, privacy commitments, and U.S. BAAs are documented as MedCrest processes practice data for each region.

Staff keycard at a modern clinic door
Important note

Compliance is shared

These laws set the rules for how personal and health information must be handled. MedCrest provides product and contractual controls to help practices meet those obligations. Your practice still owns policies, staff training, and day-to-day use of patient data. This page is informational and not legal advice.

Markets

Supported compliance map

Primary frameworks MedCrest aligns to in each country we support.

  • Canada, PIPEDA PIPEDA + provincial health privacy
  • United States, HIPAA HIPAA + Business Associate Agreement
  • Australia, Australian Privacy Principles Privacy Act 1988 + Australian Privacy Principles
  • New Zealand, Health Information Privacy Code Health Information Privacy Code 2020
  • Mexico, LFPDPPP LFPDPPP (sensitive health data)
Read Privacy Policy Ask about agreements hello@medcrestpms.com

Need details for your compliance team?

We can walk through regional controls, hosting options, and agreement language for Canada, the U.S., Australia, New Zealand, and Mexico.

Book a Demo Contact Us