POPIA & Patient Privacy Policy

1. Policy Purpose

This policy outlines how patient personal information is collected, processed, stored, and shared in compliance with:

• Protection of Personal Information Act, 2013 (POPIA)
• National Health Act, 2003
• HPCSA Ethical Guidelines on Confidentiality

This policy supports patient privacy and ensures lawful handling of health information.

2. Scope

This policy applies to all staff, practitioners, contractors, and service providers involved in handling patient information at this practice. This policy also applies to service providers processing information on behalf of the Practice.

3. Definitions

Data Subject: The person to whom personal information relates.

Personal Information: Information relating to an identifiable patient.

Special Personal Information: Includes health records and medical data, requiring higher protection.

Processing: Collection, storage, use, sharing, and deletion of personal data.

4. Legal and Regulatory Framework

• POPIA – governs lawful processing of personal information
• HPCSA Booklet 5 – confidentiality and disclosure rules
• National Health Act – patient rights and consent
• PAIA – access to information where legally allowed

5. Collection of Patient Information

We collect personal information:

• Directly from patients (consultations, forms)
• From third parties (laboratories, specialists, medical schemes)
• Information submitted through the Practice website, online forms, or electronic communications.

Only information necessary for diagnosis, treatment, and administration is collected.

6. Lawful Processing (POPIA Principle)

Personal information is processed only when:

• The patient has given informed consent
• It is necessary for medical treatment
• Required by law
• Necessary for healthcare administration and related operational purposes permitted by law.

7. Purpose of Use

Personal information is used only for the following designated activities:

• Diagnosis and treatment of patients
• Medical administration and billing
• Communication with healthcare providers
• Legal and regulatory compliance

8. Confidentiality (HPCSA Compliance)

All patient information is strictly confidential. Staff and practitioners must:

• Protect patient privacy at all times
• Only access information necessary for their role
• Not disclose information without lawful authority

9. Disclosure of Information

Patient information may only be shared:

• With other healthcare professionals involved in treatment
• With medical schemes for payment purposes
• When required by law or court order

Patient information will only be shared where permitted or required by law, where necessary for healthcare services, or with patient consent.

10. Information Security

To ensure appropriate protection of patient information, we implement the following security measures:

• Password-protected electronic systems
• Access control based on roles
• Encryption and secure backups
• Regular system monitoring and access control reviews
• Secure backup and disaster recovery procedures

11. Data Retention and Destruction

We ensure that health records are managed responsibly through their lifecycle:

• Records are retained in accordance with applicable legal requirements and HPCSA guidelines.
• Information is securely destroyed or de-identified when no longer needed

12. Patient Rights

Patients have the right to:

• Access their personal information
• Request correction of inaccurate information
• Object to processing of their personal information
• Withdraw consent where applicable
• Lodge a complaint with the Information Regulator

These rights are exercised in accordance with POPIA and applicable laws. Requests relating to personal information may be directed to the Information Officer.

13. Data Breach Management

Any loss, unauthorised access, or disclosure of personal information will be:

• Investigated immediately
• Contained and mitigated
• Reported to the Information Regulator where required
• Communicated to affected patients where applicable

14. Contact Information & Inquiries

For any POPIA-related questions, access requests under PAIA, or patient record queries, please contact our administrative desk:

• Information Officer: Dr. Jade Cabula, GP
• Email: info@thevinegp.co.za
• Contact Number: 061 4883004