The primary information we provide psychologists comes from the document on the Use of Technology by Psychologists. I presume you have seen this document, but here it is just in case.
https://www.ns-rp.ca/downloads/use_of_technology_by_psychologists.pdf
The NSRP does not proscribe methods for storage provided one can ensure that have followed appropriate and reasonable steps based on the standards of practice. One of the recommendations of the NSRP is for the custodian to consult with an IT professional in cases that more involve the specific technological setup. A lawyer knowledgeable in privacy matters can also be a valuable asset, if one would like to have legal consultation.
I realize that you have consulted an IT firm who is offering to provide a secure cloud solution to fit your needs. They are providing an opinion that they see this as the most efficient and a modern approach for your setting. I recognize he is likely looking at this from the perspective that if you were to maintain the files in your office, you maintain control of where the data is stored, and you could choose to have a copy of the data backed up to an external drive that would not have to be connected to the internet.
Clearly both approaches have merit but you are concerned with meeting the appropriate expectations. One nice way to look at this could be through the lens of the HIPAA legislation in the US. In order to be compliant with HIPAA, the only backup source could not be stored in the cloud / on a backup that is connected to the internet. While one could use a cloud service, there should also be a backup that is not connected to the internet. The idea being that a form of malware/virus could propagate through the internet to the cloud backup servers. The firm no doubt has provisions in place to address such concerns but that would be one point of consideration. You could ask them whether there would be a second backup of your data that would not be connected to the internet?With his setup you could backup all computers to an external drive and then make one backup of the external drive to another external drive. This second external drive would not have to remain connected to the internet. To my knowledge, PHIA and FOIPOP legislation do not restrict a cloud backup service, but it seems to make good sense for a practice to make sure they also have a backup copy that is not connected to the internet. As I said, the cloud company might have something they suggest or you could arrange a second onsite process with a local firm.
As far as PIDPA, any documentation that your practice received that originated from within a public body in Nova Scotia could not be stored outside of Canada. You might enquire whether you can specify the servers for Google Office be in Canada or find a similar solution that allows your data to remain in Canada.
I wish you the best as you navigate this process. This is a substantial investment but it is worthwhile making sure the appropriate provisions are in place before something might happen.
