For private practices, clinics and hospitals in South Africa, HPCSA and the Office of Health Standards Compliance
OHSC and HPCSA readiness software, built to help you achieve an OHSC grading of Excellent.
The OHSC inspects every health establishment against the Norms and Standards Regulations, now private general practices included, and the HPCSA holds each practitioner to its rules and booklets on records, consent and AI. wai runs booking, notes, patient messaging and payments for practices, groups and hospitals, and keeps each as the evidence an inspector audits, built to help you achieve an OHSC grading of Excellent.
What do the OHSC and the HPCSA hold a practice to in 2026?
Five areas from the Norms and Standards Regulations the OHSC inspects, and the HPCSA rules each practitioner answers to.
Five areas of the Norms and Standards Regulations the OHSC inspects, and the HPCSA rules each practitioner answers to. Open one for the regulations under it.1
01User rightsThe establishment tells users what services it offers, how to reach them, what they cost and how to complain, triages users by the severity of their condition and keeps a copy of every referral in the record.5 regulations
Regulation 4(1), adequate information about services and access
Regulation 4(2)(a)(iv), a complaints, compliments and suggestions system
Regulation 4(2)(b), information on fees before care where practical
Regulation 5(2)(a), a system of triage
Regulation 5(4)(b), a copy of the referral kept in the health record
02User health records and consentThe establishment protects, manages and keeps health records confidential under sections 13, 14 and 17 of the National Health Act, records the user's details and every examination and intervention, and follows a formal process for informed consent.5 requirements
Regulation 6(1), records protected, managed and kept confidential
Regulation 6(2)(a), filing, archiving, disposing, storage and retrieval
Regulation 6(4), biographical data and the examination and interventions recorded
Regulation 6(5), a formal process for informed consent
HPCSA Booklet 9, records contemporaneous, attributable and kept six years from dormancy
03Clinical governance and support servicesClinical management systems that give effect to national guidelines, infection prevention and control, safe waste handling, medicines under the Pharmacy Act and the Medicines Act, and medical equipment that is available and functional.5 regulations
Regulation 7, clinical management systems and clinical risk
Regulation 8, infection prevention and control programmes
04Governance and human resourcesA functional governance structure with written terms of reference, a human resource plan and performance management, a system to check every practitioner's professional registration each year, and occupational health and safety.4 requirements
Regulation 18, a functional governance structure with written terms of reference
Regulation 19(2)(c), professional registration monitored annually
Regulation 20, the Occupational Health and Safety Act
Standard operating procedures signed, dated and reviewed at most every 5 years
05Adverse events and waiting timesA system to monitor and report all adverse events, with a register and reporting to a structure or responsible authority that monitors them, and waiting times monitored against the National Core Standards.4 regulations
Regulation 21(1), a system to monitor and report all adverse events
Regulation 21(2)(a), a register for all adverse events
Regulation 21(2)(b), reporting to a structure or responsible authority
06HPCSA ethical rules and bookletsEvery registered practitioner acts in the patient's best interests, keeps accurate records, obtains informed consent, protects confidentiality, signs documents with a printed name, and stays accountable for any AI tool used.6 rules and booklets
Rule 27A, main responsibilities of health practitioners
Rule 13, professional confidentiality
Rule 15, signing of official documents
Booklet 4, seeking patients' informed consent
Booklet 10, good practice in telehealth
Booklet 20, ethical use of artificial intelligence
Over one full day for a general practice, scoring each measure 1 or 0 against the inspection tool.2
01
Notice of inspection
At least seven working days before, or unannounced where notice could put user safety at risk.
02
Document review
Signed, dated standard operating procedures, registers and training records from the past twelve months.
03
Patient record audit
Three records per measure, checked for identity, date, time, assessment, plan, results and a signature on each entry.
04
Observation
Records secured, confidentiality kept, the emergency trolley stocked, oxygen ready.
05
Interviews
Three users asked whether they were told their diagnosis, and staff asked how the practice works.
06
Reports
A preliminary report within 20 working days, 20 working days to respond, then a final report.
How does the OHSC grade and certify a practice?
Every measure is rated non-negotiable, vital or essential, and the grade is the lower of the vital and essential scores.3
ExcellentVital measures at 80% or more and essential at 70% or more
GoodVital 70 to 79%, essential 60 to 69%
SatisfactoryVital 60 to 69%, essential 50 to 59%
UnsatisfactoryVital below 60% or essential below 50%, found non-compliant
812
routine OHSC inspections in 2024/25, with 733 establishments found compliant.4
58%
cumulative compliance rate across 3,368 inspections from 2020/21 to 2024/25.4
100%
of non-negotiable measures must be met for a certificate, whatever the grade.4
Compliance needs a grade of Satisfactory or better and a 100% score on non-negotiable measures.
A certificate of compliance is valid for four years, and recertification comes through a routine inspection.
A non-compliant establishment receives a compliance notice, then a re-inspection.
Enforcement runs from a warning to a fine or referral to the National Prosecuting Authority, and a certificate can be revoked.
What has changed for South African practices?
Three things a practice should know in October 2026, each marked as in force or proposed.
In force. The OHSC started inspecting private general practices in the third quarter of 2025/26, with its Regulatory General Practice Inspection Tool v1.1.
In force. HPCSA Booklet 20 of September 2025 sets ethical guidelines for practitioners who use artificial intelligence.5
Proposed. Draft 1 of revised Norms and Standards Regulations went to stakeholder consultation in October 2026, with chapters on digital health, artificial intelligence and telemedicine, and nothing in it is in force.
Who answers to which body
The HPCSA registers the practitioner. The OHSC inspects the establishment, and the Information Regulator oversees personal information.
Three things a practice will hear about, stated as they stand on 16 October 2026.
Draft 1 of revised Norms and Standards Regulations is a working draft for consultation, and the regulations take effect only once published in the Government Gazette.5
The NHI Act makes OHSC certification a condition of accreditation by the NHI Fund under section 39(2)(b), and on 24 February 2026 the Presidency agreed to delay proclaiming any section of it until the Constitutional Court rules on challenges set down for 5 to 7 May 2026.
The Information Regulator invited comment, by 10 October 2025, on draft regulations for processing health information under section 112(2)(c) of POPIA.
What should practice software in South Africa actually run?
Each module runs part of the practice and records the evidence for the regulations beside it.
01
Appointments and booking
Online booking from your own website, every clinician's diary read from their calendar, reminders, rebooking after a missed visit and waitlist offers when a slot opens.
Online booking at any hour, with a reminder before the visit.
For the business
Fewer missed appointments, and cancelled slots offered to the waitlist.
On the record
Every booking, reminder and change, with a time and a name.
02
Billing and payments
Card payments into your own Stripe account, the cancellation policy shown at booking, invoices, statements and reconciliation, with an export for your accountant.
A clear price and policy before they commit, and an invoice in their app.
For the business
Payments reconciled against visits, with an export for your accountant.
On the record
What was charged, when, against which visit, and the policy the patient saw.
03
AI scribe and clinical notes
The note, letters and referrals written from the consultation, cited to published clinical guidelines, with the transcript beside the note, for the clinician to read, edit and sign.
The clinician's attention stays on them during the consultation.
For the business
Less time spent writing notes after clinic.
On the record
A contemporaneous note, signed, with the time, the signature and the source it cites.
04
Follow-ups and patient messaging
WhatsApp, email and calls in one thread per patient, replies drafted in the patient's own language for your team to approve, a response clock on every new enquiry, and recalls a clinician approves.
A reply in the language they wrote in, approved by your team.
For the business
More enquiries answered within the hour, when they are most likely to book.
On the record
The whole conversation on one record, with response times.
05
Referrals, consent and audit trails
Recording consent taken at booking, referrals written from the visit, patient flags for controlled drugs and safeguarding notes, and every read of a record logged against a named account.
How does wai evidence each area the OHSC and the HPCSA check?
For each area, the records wai keeps, how you produce them, and what changes for patients and the business.
User rights
Every user told, triaged and answered, on the record.
The cancellation policy and price shown at booking, with what the patient saw
Every message in one thread per patient, with response times
Referrals written from the visit and kept in the record
Replies drafted in the patient's own language, approved by your team
On request. Open the complaints register and three resolved complaints, with the answer each complainant received.
For patients
A clear price, a quick answer and a referral they understand.
For the business
A complaint handled before it becomes an escalation.
User health records and consent
A record that passes a three file audit.
Notes, letters and referrals written from the consultation for the clinician to sign
Recording consent taken at booking, and the consent discussion in the signed note
Every read and change of a record logged against a named account
The patient's own record exportable on request
On request. Pull three records seen this month and show the date, time, assessment, plan, signature and consent in each.
For patients
Their history, allergies and plan in one place at every visit.
For the business
A patient record audit scored on the day, with nothing to rebuild.
Clinical governance and support services
Clinical work written down as it is done.
Patient flags for controlled drugs and safeguarding notes at the point of care
The note cited to published clinical guidelines, signed by the clinician
Results, follow-up and the patient informed, on the same record
Reports for any period, produced the day they are asked for
On request. Show three records where results were reviewed by the doctor and the patient was told.
For patients
Results acted on and explained, with nothing lost between visits.
For the business
Clinical risk managed from the record the team already uses.
Governance and human resources
Every action under a named, registered person.
Named accounts for every person, with role-based access
Who holds which role, and every action taken under it
Reports for leaders on response times, the front desk and takings
AI drafts, and a named person signs or approves every output
On request. Show who holds which role, and the registration check for every practitioner on the account list.
For patients
Care from people whose registration and role are checked.
For the business
Accountability that holds as the practice adds doctors and sites.
Adverse events and waiting times
The timeline of an event, rebuilt from the record.
Who saw what, who changed what, and when, to the minute
The signed, timed note and the transcript beside it
Every message to and from the patient, with times
Booking and response reports that show how long patients wait
On request. Rebuild an adverse event from the audit trail for the register and the report to the responsible structure.
For patients
An honest account of what happened, from a record nobody rewrote.
For the business
Incident reviews that start from facts, with times and names.
HPCSA ethical rules and booklets
The clinician decides, signs and stays accountable.
AI drafts the note and the reply, and the clinician reads, edits and signs
The transcript beside the note, so the source of every line is visible
Recording consent taken at booking, with the notice the patient saw
Every read of a record logged against a named account
On request. Show where AI is used, who signed each output, and how the patient was told.
For patients
A clinician who listens, and is open about the tools in the room.
For the business
A practitioner's HPCSA duties met by the system that writes the record.
What do patients and the business gain?
Published research on response times, ambient scribes and appointment reminders.
7x
An enquiry answered within the hour is nearly seven times as likely to become a real conversation.6
30%
Clinicians using an ambient scribe did 30% less work after hours.7
23%
Patients sent a notification before their visit were 23% more likely to attend.8
How does wai surface OHSC evidence on request?
What an inspector may ask for, where it is kept in wai, and how it is produced.
Asked forWhere it livesHow it is produced
Three patient recordsThe patient record, beside the transcriptOpen each consultation to see the date, time, assessment, plan, signature and consent together.
Informed consentThe booking and the noteThe recording notice the patient saw at booking, and the consent discussion in the signed note.
Complaints registerThe patient's threadEvery message, in English, Afrikaans, isiZulu or any language, with response times and the answer sent.
Adverse eventEvery recordWho read or changed it, under which account, to the minute, for the register and the report.
ConfidentialityAccounts and rolesWho holds which role, and every read logged against a named account.
Fees before carePaymentsWhat was charged, when, against which visit, and the policy the patient saw.
Waiting and response timesReportingBooking, front desk and response reports for any period.
Access to the recordReportingThe patient's own record exported on request.
How do you prepare for an OHSC inspection?
A readiness checklist in four parts.
01Procedures and registers
Standard operating procedures for complaints, triage, records, consent and adverse events, signed, dated and reviewed within 5 years.
A complaints register with entries from the past twelve months, or zero reporting documented.
An adverse events register, with reporting to the structure that monitors it.
Training and orientation records with an attendance register.
02The patient record
Three recent records an inspector could audit cold, each entry dated, timed and signed.
Name, unique number, ID or date of birth, address, contacts and next of kin recorded.
Results in the record, reviewed by the doctor and told to the patient.
Retention set to at least six years from dormancy, longer for minors.
03Consent and confidentiality
A formal informed consent procedure, including emergencies and legal standing.
Written consent for complex or high risk procedures, and the discussion in the record.
Records secured, electronic records behind passwords or other controls.
An Information Officer registered with the Information Regulator.
04People and premises
Every practitioner's HPCSA registration checked for the current year.
Basic life support training current for health care providers.
The emergency trolley stocked, checked and in date, oxygen ready.
An occupational health and safety risk assessment, with mitigation plans.
What will an OHSC inspector ask you?
Questions to expect, what to show, and where wai holds the answer.
01May I see three records of patients seen this month?
What to show
Complete records with identity, date, time, assessment, plan, results and a signature on every entry.
Where wai has it ready
The note, consent, letters and messages sit on one record, signed and timed by a named clinician.
02Show me your complaints register and how complainants were answered.
What to show
Entries from the past twelve months and three resolved complaints with the reply sent.
Where wai has it ready
Every message sits in one thread with response times, and the answer is on the record.
03How do you obtain and record informed consent?
What to show
The consent procedure and records where the discussion and the patient's agreement are written down.
Where wai has it ready
Consent is recorded at booking, and the consent discussion sits in the signed note.
04How do you monitor and report adverse events?
What to show
The adverse events register, the reporting route and what changed after each event.
Where wai has it ready
The audit trail and the signed note give each event its timeline, to the minute.
05Who can open a patient record, and how is that controlled?
What to show
Roles, access controls, an access log and where records are hosted.
Where wai has it ready
Role-based access enforced in the database, every read logged, records hosted in the clinic's own country.
06Where do you use AI, and who checks it?
What to show
Where it is used, how patients are told, and who signs each output, as Booklet 20 asks.
Where wai has it ready
AI drafts the note and the reply. The clinician signs the note, and a person approves every message.
What is at stake when the OHSC inspects?
Certification decides a practice's standing for four years, and the NHI Act, not yet proclaimed, makes it a condition of accreditation by the NHI Fund.
210
private general practices planned for routine OHSC inspection in 2025/26, the first year of the GP tool.9
4 years
is how long a certificate of compliance stays valid before recertification.4
20 days
to answer the preliminary report, and record audits and interviews accept no new evidence after the inspection.4
What is the best software for OHSC and HPCSA compliance?
The best OHSC and HPCSA compliance software is the system your practice already runs on, so the evidence is a by-product of the care. Look for one record behind booking, notes, patient messaging, payments and access, a full audit trail, AI output that a clinician signs, and records hosted under your country's rules. wai is built that way, to help you achieve an OHSC grading of Excellent.
Is there OHSC approved software?
The Office of Health Standards Compliance inspects and certifies health establishments against the Norms and Standards Regulations. It does not approve, certify or endorse software, wai included, and software cannot earn a certificate of compliance on a provider's behalf. wai keeps the records your team uses to show the OHSC how care is delivered, and the OHSC decides the certificate of compliance.
Does the HPCSA approve AI tools?
No. Booklet 20 says the HPCSA does not regulate or approve new technologies or medical devices, and that the practitioner always makes the final decision on patient care and stays accountable for the AI tools they use.
Will the OHSC inspect a private general practice?
Yes. The OHSC started inspecting general practices in the third quarter of 2025/26, with a target of 210 routine GP inspections across the nine provinces, using the Regulatory General Practice Inspection Tool v1.1.
How long must a South African practice keep a patient record?
HPCSA Booklet 9 asks for at least six years from the date the record became dormant, until the 21st birthday for a patient treated as a minor, for life for a mentally incapacitated patient, and 20 years after treatment for records under the Occupational Health and Safety Act.
What happens if a practice is found non-compliant?
It receives a compliance notice setting out what to fix, and a re-inspection follows. If it is still non-compliant, the OHSC takes incremental enforcement action, from a warning to a fine or referral to the National Prosecuting Authority.
Does wai work in Afrikaans and isiZulu?
Yes. wai drafts replies in the language the patient writes in, English, Afrikaans, isiZulu or any other, for your team to approve.
Where does wai keep our records?
In its own country, under that country's rules, encrypted, with a full audit log. We set this up with you before go-live.
Fifteen minutes on video, opening three patient records the way an OHSC inspector would. Built to help you achieve an OHSC grading of Excellent. wai hosts each clinic's records in its own country, under that country's rules. We set this up with you before go-live.
