Healthcare Professionals and their obligation to the POPI Act
Healthcare Professionals and their obligation to the POPI Act
The main purpose of the Protection of Personal Information Act 4 of 2013 (POPI Act) is to regulate the processing and distribution of personal information by public and private bodies.
Although balancing the right to privacy and the right to access is tricky, medical professionals, healthcare institutions and related sectors have a strict obligation to maintain confidentiality by virtue of their profession. They should understand that the POPI Act treats any information about health, well-being and sex lives of individuals as sensitive information, meaning Healthcare professionals are subject to a considerable risk of unlawful disclosure, which places on them a greater responsibility to assess their practices and policies for processing of health-related information.
When will Healthcare Professionals be liable?
The Health Professions Council of South Africa (HPCSA) sets out basic guidelines on protecting personal information and indicated that personal information is to a large extent disclosed in the following ways:
- Personal information was obtained without specific consent;
- Personal information was accessed unlawfully and the healthcare professional failed to report the breach to patient and information regulator;
- The healthcare professional failed to take reasonable steps to prevent unlawful disclosure of personal information;
- Reasonable harm or distress was caused to the patient.
Examples of unlawful processing of information are as follows:
- Taking a photograph with a private mobile device without the patient’s consent;
- Storing personal information of a patient on any data-storage device or cloud without restricted access;
- Storing personal information (hard copy or electronically) for more than 5 (five) years without it having any legal, research, historic or administrative value;
- Deleting metadata that related to electronic information.
This places an onus on the Healthcare professional to ensure that personal information is protected and that the role players are educated on the lawful processing of personal information in order to prevent severe penalties, including monetary compensation of up to R10 million or imprisonment for up to 10 (ten) years.
POPI Act compliance recommendations for Healthcare Professionals
- Healthcare professionals should ensure that information is obtained with written consent and used for a specific purpose and that all information is kept confidential.
- Any disclosure of personal information should be minimised, and anonymity should always take preference. The HPCSA and POPI Act emphasise that clerks and receptionists should be trained in patient confidentiality, retention and disclosure.
- When publishing personal information, Healthcare professionals should de-identify personal information.
- Healthcare professionals should not discuss patients or leave patient information in a vulnerable area where unlawful disclosure will be a risk.
- Personal information sent and stored in electronic format may be intercepted; therefore, special precautions should be taken to ensure security of information. Appropriate professional assistance is advised, and should be recorded, to protect personal information before connecting to any network.
- These recommendations should be addressed in a policy and distributed throughout the workplace to everyone who has access to patient files. This is one of the reasonable measures required by the POPI Act.
Conclusion
Healthcare professionals will be obliged to balance the right to access and the right to privacy of information. Using the guidelines set out in the HPCSA and POPI Act will be a difficult and ongoing process. The responsibility lies with the Healthcare professional to consider their information processes and policies to prevent any unlawful disclosure of personal information.
SERR Synergy assists businesses in determining their obligation to comply with the POPI Act. Once the obligation has been identified, SERR Synergy compiles a Data and Information Protection Report, which includes recommendations for compliance with the POPI Act in order to minimise any liability of Healthcare Professionals.
About the Author: Retha van Zyl completed her BCom Hons (Economics and Risk Management) studies at the North West University. She joined our team in January 2016 and currently holds the title ‘Information Compliance Advisor’. She specialises in POPI and PAIA compliance, which includes compiling and submitting PAIA manuals to the Human Rights Commission. She also compiles and implements the Information Security Management System (ISMS) to identify risks associated with information security in each department within an organisation.
Sources:
https://www.serr.co.za/popi-act-handling-medical-information/
https://www.medicalprotection.org/southafrica/casebook/casebook-may-2013/understanding-popi
South African Medical Journal; November 2017; Vol 107, No.11; (M. Buys)
