TGV MSSS: certification for RSSS suppliers
The Global Verification Toolkit (TGV) attests that a version of a technology product or service meets Quebec health and social services network (RSSS) requirements for security, personal information protection, performance and technology.
What is the TGV?
The TGV is administered by the Certification and Approval Bureau (BCH) of Quebec's Ministère de la Santé et des Services sociaux (MSSS). It is not aimed at clinicians: it concerns technology suppliers who want to do business with the RSSS.
Why it matters to your business
If your company provides a technology product or service to a Quebec healthcare organization, TGV certification becomes a contractual requirement, not a choice. It is the concrete buying trigger RSSS clients will demand before signing.
An RFP, contract renewal or supplier due diligence: without a current TGV attestation, your proposal may be rejected even if your solution works well elsewhere. This is not compliance for compliance's sake: it is a condition of access to Quebec's public health market.
Official procedure to get certified
For your company, the MSSS procedure breaks down into six steps. The official details are published by the ministry.
Technology product and service certification (MSSS)
-
Check whether your product is in scope
A technology product or service (PST) is generally subject to certification if it collects, stores, uses, modifies, discloses or destroys health or social services information (RSSS); if it connects or plans to connect to a common-interest information asset that handles such information; or if it will be deployed in more than one Quebec health establishment with web access to deliver health or social services.
-
Contact the Certification Bureau
You, the supplier, contact the MSSS Certification Bureau, which is responsible for the TGV process, at certification@sante.quebec.
-
TGV preparation with the Bureau
The Bureau supports you in completing the Global Verification Toolkit: several meetings, process explanation, criteria grid adjustments, over a period of 1 to 6 weeks depending on product maturity and your organization.
-
Verification by an external firm
An audit firm, supervised by the Bureau but independent, reviews the TGV grid, requests evidence, conducts an online audit and produces a verification report. This cycle is planned over about 30 business days, with document back-and-forth between you and the auditor.
-
Certification decision
The Certification Bureau issues a decision (certified or not) based on the verification report and deliverables. Certification is valid for 5 years, with annual follow-up via a self-declaration form and follow-up when major changes occur.
-
Post-certification follow-up
Once certified, your product must continue to evolve while meeting TGV commitments, with a recurring follow-up process (annually or before a major change).
How Certi360 can support you
Certi360 helps SMBs and IT suppliers structure preparation before TGV verification: requirements mapping, gap prioritization and documentation ready for the BCH and external firm. Our compliance and certification support covers this type of contractual journey in executive language, without unnecessary jargon.
See our Compliance & certification page to learn how we translate requirements into a concrete action plan.
Is the TGV mandatory to sell to the RSSS?
For technology products and services covered by the MSSS program, TGV certification is the attestation expected by the network. If you sell or want to sell to the RSSS, anticipate this requirement in your contracts and commercial timeline.
How long does TGV certification take?
Allow 1 to 6 weeks of preparation with the Certification Bureau, then about 30 business days for external verification. Once granted, certification is valid for 5 years, with annual follow-up. See the procedure above for step-by-step detail.
How does the TGV differ from CyberSecure Canada or ISO certification?
The TGV is specific to Quebec's RSSS and covers security, personal information protection, performance and technology for a precise version of your product. CyberSecure Canada is a voluntary federal program for SMBs. ISO certifications (such as ISO 27001) are distinct international frameworks. These efforts can complement each other but do not replace the TGV for Quebec's health market.
Who administers the TGV?
The MSSS Certification Bureau administers the program (certification@sante.quebec). Verification is performed by a specialized external firm, supervised by the Bureau but independent in its work.