M&A due diligence · Clinical care providers
M&A Privacy & Security Due Diligence for Physiotherapy & Chiropractic Clinics
Privacy due diligence for a physiotherapy or chiropractic clinic acquisition checks what happens to patient charts, insurer files and inherited user accounts before the deal closes, not after, since consolidator-scale roll-ups make chart-custody questions routine rather than exceptional. We review the target's custodian status, retention practices under the applicable College standard, and outstanding access requests or complaints that could surface as the buyer's problem. Work usually starts once a letter of intent is signed, whether the buyer is a Lifemark-scale national group or a single clinic acquiring a neighbouring practice.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
What the review has to check before closing
A clinic acquisition transfers more than a lease and equipment; it transfers custodian responsibility for a live patient population.
Custodian status and how it transfers
The review confirms who currently holds custodian responsibility for the target's charts and how that responsibility is structured to pass to the buyer at closing.
Insurer and WSIB files
Open and historical OCF forms, WSIB claim files and adjuster correspondence held by the target need their own transfer and retention treatment, separate from the clinical chart itself.
Retention compliance to date
Whether the target has actually met its College's retention floor, physiotherapy's ten years or chiropractic's seven, matters because gaps become the buyer's liability the moment the deal closes.
User accounts and vendor contracts
The target's EMR accounts, payment terminal contracts and any legacy systems need review so the buyer knows what it's inheriting and what needs to be closed out.
Outstanding access requests or complaints
Any pending patient access request, fee dispute or College or IPC complaint against the target needs to surface before closing, not after the buyer owns it.
Regulatory map
The obligations that follow a clinic through a sale
Custodian duties and College retention rules don't reset when ownership changes.
PHIPA custodian continuity
Custodian obligations for existing records generally continue through a change in ownership, meaning the buyer inherits responsibility for the historical chart, not just the patients treated going forward.
College retention rules apply regardless of who owns the clinic
Physiotherapy's ten-year retention floor and chiropractic's seven-year floor under CCO Standard S-002 attach to the record, so a buyer inherits whatever retention gap the seller left behind.
Breach history and March 1 reporting continuity
A buyer needs to understand the target's breach history and whether prior-year statistics were reported to the IPC accurately, since gaps there can surface as the new owner's problem to explain.
PIPEDA where the transaction itself involves personal information
The business-transaction provisions in federal and provincial privacy law generally permit sharing personal information for due diligence purposes under specific safeguards, which the review confirms are in place.
What goes wrong
Where clinic acquisitions actually go wrong on privacy
These are the specific risks consolidation surfaces in this niche, not generic M&A concerns.
Inherited accounts nobody reviews
Acquired clinics routinely bring forward legacy user accounts, shared logins and forgotten vendor access that the buyer only discovers well after closing, the pattern that comes with Lifemark-scale roll-ups.
An undisclosed access-request dispute
A pending or recent dispute in the pattern of PHIPA Decision 185 or Decision 55, unresolved at the time of sale, becomes the buyer's problem to finish handling.
A retention gap discovered post-close
Finding out after closing that the seller destroyed records before the College's retention floor was met creates a compliance gap the new owner now has to answer for.
Insurer files that don't transfer cleanly
OCF and WSIB files tied to claims still in progress need a clear transfer path, or the buyer risks gaps in active claims that patients and adjusters both notice quickly.
Our m&a due diligence for physiotherapy & chiropractic clinics
What our due diligence review covers
The M&A privacy due diligence deliverable, re-cut for a clinic transaction.
Risk assessment of the target's practices
Review of data handling, access controls and general privacy practices at the target clinic to surface issues before they complicate the deal.
Compliance review against custodian and College obligations
Evaluation of how well the target's policies, retention practices and record-keeping align with PHIPA and the applicable College standard.
Chart and file transfer plan
Guidance on how patient charts, insurer files and vendor accounts move to the buyer, including what needs closing out versus what transfers directly.
Post-close integration support
Support merging privacy policies, clarifying custodian responsibilities and aligning standards so the acquired clinic operates without a compliance gap from day one.
How the engagement runs
How the due diligence review runs
Step 1
Request and review documentation
We request the target's privacy policy, retention records, breach history and any outstanding complaints, alongside a list of systems and vendor accounts.
Step 2
Assess custodian and retention status
We confirm custodian responsibility, check retention practices against the applicable College standard, and flag any gaps that would transfer to the buyer.
Step 3
Report findings before closing
A prioritized findings report goes to the buyer ahead of closing, distinguishing deal-breaking issues from items that can be fixed post-close.
Step 4
Support the transfer and integration
After closing, we support the chart and file transfer, account closeout and policy alignment so the acquired clinic operates under one consistent program.
What it costs
What determines due diligence cost for a clinic acquisition
Cost depends on the target's size, how many practitioner types and retention rules are involved, and how much documentation the seller can readily produce for the review.
A single-clinic acquisition typically scopes faster than a multi-location roll-up with its own history of prior acquisitions. Share the transaction details and we will scope a tailored quote.
Physiotherapy & Chiropractic Clinics: M&A due diligence questions, answered
Confirm current custodian status and how it's structured to transfer, review whether retention practices have actually met the applicable College's floor, and check for any outstanding access requests, fee disputes or complaints against the target. Also review the target's EMR accounts and vendor contracts, since inherited logins and unreviewed vendor relationships are a common post-close surprise.
Custodian responsibility for the historical chart generally transfers to the buyer along with the practice, and patients don't need to be individually asked for permission for that continuity as long as the use of their records doesn't change. The due diligence process confirms the transfer mechanism is documented properly and that patients are notified of the change in ownership as required.
Yes, and they need their own transfer plan. OCF forms, WSIB claim files and adjuster correspondence tied to a patient's treatment are part of the record the buyer inherits, including files connected to claims still active at the time of sale, which need a clear handoff so ongoing claims aren't disrupted.
It changes the scope significantly. A single-clinic acquisition typically has one EMR and one set of accounts to review, while acquiring a location that's part of an existing multi-site group may mean untangling shared systems, group-level vendor contracts and accounts the seller doesn't fully control at the location level.
It becomes a negotiating point rather than an automatic deal-breaker, depending on severity. Buyers typically use the finding to adjust price, require the seller to remediate before closing, or build specific indemnities into the purchase agreement covering that gap.
More for physiotherapy & chiropractic clinics
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.