What does POPIA ask of a South African practice's patient records?

POPIA lets a practice process health information for proper treatment and care under section 32, and asks it to secure that information under section 19 and to notify the Information Regulator and the patient of any unauthorised access under section 22. The practice registers an Information Officer with the Information Regulator, and the National Health Act keeps every record confidential.

What the law asks

Health information is special personal information, and section 32 allows medical professionals and healthcare facilities to process it when necessary for proper treatment and care, under a duty of confidentiality.¹ Section 19 asks the practice to identify foreseeable risks, set safeguards, verify them regularly and update them, and section 22 asks it to notify the Regulator and the patient as soon as reasonably possible after a compromise.¹ Section 14 of the National Health Act makes all information about a user confidential, disclosed only with written consent, a court order or law, or to avert a serious threat to public health.³

How to put it in place

1. Register the Information Officer. The head of the practice registers the Information Officer, and any deputies, on the Information Regulator's eServices portal.
2. Map the risks. List where patient information sits, who can reach it and what could go wrong, as section 19 asks.
3. Control access. Named accounts, roles and passwords, and a log of who opened which record, as section 17 of the National Health Act asks.
4. Plan for a breach. Who decides, who tells the Regulator and the patient, and how the scope is established.
5. Check third party releases. Signed consent from the patient before a record goes to a third party, as the OHSC records procedure asks.

1. Information Officer ______ Registered on ______
2. Where patient information is kept ______
3. Who can access it, by role ______
4. Risks identified ______ Safeguard ______ Checked on ______
5. Breach contact ______ Regulator notified on ______ Patients notified on ______
6. Next review ______

Copy template

How the OHSC sees it, and what is proposed

Regulation 6(2)(c) asks every health establishment to secure health records with security controls in the storage area and the clinical area in accordance with POPIA.⁴ The Information Regulator says organisations must register their Information Officers, and where none is designated the head of the organisation is held liable.² In September 2025 the Regulator invited comment, by 10 October 2025, on draft regulations for processing health information under section 112(2)(c), which are not in force.⁵ For how long to keep each record, see the guide to Booklet 9.⁶

Questions

Can a practice process health information without consent?

For proper treatment and care, yes, under section 32 of POPIA, by people bound by confidentiality. Disclosure to others still needs written consent, a court order or law, or a serious public health threat.

Who registers the Information Officer?

The head of the organisation, on the Information Regulator's eServices portal, and the Information Officer takes up the duties only after registration.

Are the draft health information regulations in force?

No. The Information Regulator published them for comment in September 2025, with comments due by 10 October 2025.

Sources

1. 1South African Government, 2013Protection of Personal Information Act 4 of 2013, Government Gazette 37067, 26 November 2013Read source
2. 2Information Regulator, 2025Protection of Personal Information, registration of Information Officers under section 55Read source
3. 3South African Government, 2004National Health Act 61 of 2003, Government Gazette 26595, 23 July 2004Read source
4. 4Office of Health Standards Compliance, 2018Norms and Standards Regulations applicable to different categories of health establishments, GNR 67, Government Gazette 41419, 2 February 2018Read source
5. 5Information Regulator, 2025Invitation for public comments, draft regulations on processing health or sex life information under section 112(2)(c) of POPIARead source
6. 6Health Professions Council of South Africa, 2022Booklet 9, Guidelines on the keeping of patient health records, revised September 2022 (published as a review draft)Read source

Written by the wai team from Health Professions Council of South Africa and Office of Health Standards Compliance guidance, checked on 16 October 2026. This is guidance, not legal advice. Neither the OHSC nor the HPCSA endorses wai or any software.