DIAGNOS Unveils CARA’s New Cybersecurity Milestone with COCD Certification

At a glance:

• DIAGNOS gets a positive security assessment: Quebec’s government cyber defense centre (COCD) gave CARA a positive security posture assessment after penetration testing.
• Strengthened security protocol: Vulnerabilities found in the tests were fixed and confirmed in regression tests in early March 2025.
• AI diagnostics: CARA uses AI to help detect eye-health problems from retinal images.
• Industry implications: Quebec health institutions are now authorized to integrate CARA into their projects.

CARA clears Quebec’s security review

DIAGNOS, a Canadian company that uses artificial intelligence for early detection of eye-health problems, announced on April 16, 2025 that its CARA (Computer Assisted Retina Analysis) system received a positive assessment of its security posture from the Cyber Defense Operations Center (COCD). The COCD is the Quebec government’s cybersecurity operations centre, the Centre opérationnel de cybersécurité gouvernemental.

Penetration tests and fixes

CARA went through a series of penetration tests under the Quebec Ministry of Health’s cybersecurity requirements. The vulnerabilities found were fixed quickly, and regression tests in early March 2025 confirmed the fixes. That led to the COCD’s positive assessment. An official notice then went to Quebec health institutions, including the CISSS and CIUSSS networks and CHUM, authorizing them to integrate CARA into their projects.

The road to ISO 27001

The testing is part of DIAGNOS’s ongoing push for ISO 27001 certification. Audit dates with the certification body Intertek have been set, and the company said it would publish an update over the summer. CEO André Larente said the completed intrusion test “is indisputable proof of the high level of security of our CARA application” and called it “a key step in our drive to obtain ISO 27001 certification.”

What it means for health tech vendors

Health systems hold valuable patient data and are frequent ransomware targets. Vendors that sell AI tools into hospitals now face penetration testing and formal reviews before they are allowed in. DIAGNOS’s experience shows the path in Quebec: independent testing, fast fixes and government sign-off.

Next step: the ISO audit

For DIAGNOS, the COCD result opens the door to Quebec’s public health network. The ISO 27001 audit is the next milestone. Other health tech vendors selling into government systems can expect similar testing, and should plan for it before a contract depends on it.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.