Patient information is central to healthcare, but it also creates a serious governance responsibility. Medical practices should be able to explain what information they collect, why they use it, who can access it, where it travels and how it is protected.
The Information Regulator explains that section 19 of POPIA requires a responsible party to use reasonable technical and organisational measures to protect the integrity and confidentiality of personal information. This includes identifying foreseeable risks, maintaining safeguards, checking that they work and updating them when needed.
A practical POPIA security checklist
- Map the information. Identify patient, employee and supplier information across clinical software, email, messaging, paper files, cloud services, backups, devices and third parties.
- Confirm purpose and access. Collect and use information for a legitimate, defined purpose and give access only to people who need it for their work.
- Control user accounts. Use individual logins, strong authentication, prompt removal of former users and periodic access reviews.
- Protect devices and premises. Secure computers, phones, portable media, filing areas, reception screens and unattended workstations.
- Manage service providers. Understand where practice data is stored, what the provider can access, how incidents are reported and what happens when the service ends.
- Secure communication. Match the communication method to the sensitivity and urgency of the information. Check recipients before sending and avoid unnecessary clinical detail.
- Prepare for a breach. Staff should know how to report a lost device, misdirected email, unauthorised access or suspected compromise immediately.
- Retain and dispose safely. Keep information only as long as required or justified, and use secure deletion or destruction when disposal is lawful.
- Train and verify. Confidentiality forms alone are not enough. Use practical training, spot checks and documented follow-up.
What are organisational safeguards?
They include governance, roles, policies, risk assessments, staff training, access procedures, service-provider management, incident response and regular review. Technical tools are important, but they do not replace clear responsibility and consistent practice.
What should happen after a suspected security compromise?
Contain the immediate risk, preserve relevant evidence, establish what information and people may be affected, escalate to the information officer or responsible person and obtain appropriate legal or technical advice. Notification duties are fact-specific and should be assessed promptly against current POPIA requirements and regulator guidance.
How does this connect to OHS and practice compliance?
The same management disciplines recur: identify risk, assign responsibility, use controls, train staff, record evidence, respond to incidents and review effectiveness. A practice compliance manual should connect these systems without confusing clinical, employment and privacy records.
The Complete Occupational Health and Safety Compliance Handbook by Dr Bianca Crook includes a dedicated information-governance and breach-response chapter within the wider medical-practice compliance system.
Official source
General educational information only. It does not replace legal, cybersecurity or professional advice. Reviewed 2 September 2026.