Definition
The TGV attests that a given version of a technology product or service complies with the requirements of Quebec's health and social services network regarding security, protection of personal information, performance and technology. It contains 382 assessable criteria.
Verification is carried out by the Bureau de certification et d'homologation (BCH) together with specialised cybersecurity and privacy partners. The TGV certificate is valid for five years.
What the TGV is not
The TGV is not an ISO-style certifiable standard, not a law, and not an auditor's attestation. It is a market-access questionnaire, completed with evidence.
Unusually broad scope
| Family | Criteria |
|---|---|
| Security | 112 |
| Personal information | 108 |
| Artificial intelligence | 69 |
| Interoperability | 58 |
| Technical | 26 |
| Performance | 7 |
| Governance | 2 |
ISO 27001 covers security. GDPR covers privacy. ISO 42001 covers AI. SOC 2 covers service trust. The TGV covers all four at once, plus interoperability, which none of the others require. That makes it demanding, but also an efficient foundation for later certifications.
Official source
Certification — Trousse globale de vérification (TGV), Ministère de la Santé et des Services sociaux du Québec, publication 24-715-38W, ISBN 978-2-550-97589-2.