POPIA for medical practices

Your practice's POPIA checklist

1. Register your Information Officer with the Information Regulator. By default this is the head of the practice.
2. Publish a PAIA manual that explains what records you hold and how patients can request access.
3. Tell patients what you collect and why, at registration, in plain language: the purpose, who you share it with (medical aids, labs, referrals) and their rights.
4. Collect only what you need. Review intake forms and remove questions you don't use.
5. Secure the record. Unique logins for every staff member, access limited by role, encrypted storage and backups, and an audit log of who viewed or changed what.
6. Sign operator agreements with every supplier that processes patient data for you: your practice software, billing bureau, IT support and cloud storage.
7. Get consent for marketing. Electronic direct marketing (SMS, email, WhatsApp) to patients needs their consent. Appointment reminders for their own care are not direct marketing.
8. Have a breach plan. Know who decides, how you notify the Regulator and patients, and how you contain the incident.
9. Set retention periods in line with HPCSA guidance, and destroy or anonymise records securely when they expire.
10. Check cross-border transfers. If patient data is stored outside South Africa, the destination must offer adequate protection or the patient must consent.

Health information is special personal information

POPIA generally prohibits processing special personal information, which includes health information, but makes an exception for medical professionals, healthcare institutions and facilities when the processing is necessary for proper treatment and care, or for administering the practice. Everyone who handles it must be bound by confidentiality, which for clinicians also flows from the National Health Act and HPCSA ethical rules.

Your software is your operator

When you store records in practice software, the provider is your operator under POPIA. You remain responsible, so you need a written agreement that requires the provider to keep the information secure and confidential and to tell you about any breach. Practiq's POPIA notice and Data Processing Addendum set out exactly what we do as your operator.

How Practiq helps

• Each practice's data is isolated from every other practice's.
• An audit log of access and changes on every record.
• Role-based access for practitioners, reception and billing staff.
• Patient data export, and client deletion with anonymisation after the retention period.

Read our security overview, or see how Practiq works as EMR software.

This guide is general information, not legal advice. Speak to a POPIA specialist about your practice's circumstances.

Questions