POPIA Compliance for Medical Practices

The Protection of Personal Information Act, usually called POPIA, governs how personal information is collected, used, stored, shared, and deleted in South Africa. Medical practices handle some of the most sensitive information a person can provide: identity details, contact information, diagnoses, treatment history, medical-aid membership, financial information, and communication records. POPIA compliance is therefore not only a legal project for a practice manager. It is part of everyday clinical, administrative, billing, and technology decisions.

POPIA is built around conditions for lawful processing. A practice should collect information for a specific and legitimate purpose, process only what it reasonably needs, keep it accurate, protect it against loss or unauthorised access, and avoid retaining it longer than necessary. The practice should also be transparent with patients about what is collected, why it is needed, who may receive it, and how a patient can exercise their rights.

Health information is regarded as special personal information and deserves a higher level of care. Billing does not give a practice permission to copy a patient's entire clinical history into a payment reminder. A statement should contain enough information for the patient to understand the account, but a WhatsApp message or email subject line should not disclose sensitive details unnecessarily.

The Responsible Party decides why and how personal information is processed. In many cases, the medical practice is the Responsible Party because it decides how patient records, appointments, claims, and billing are managed. An Operator processes information on behalf of the Responsible Party, such as a software provider that stores or handles records according to the practice's instructions. The exact relationship depends on the service and contractual arrangement, so practices should document responsibilities instead of assuming that a vendor automatically takes over compliance.

Consent is one possible basis for processing, but it is not the only one. Healthcare and billing activities may also rely on a legal obligation, a contract, protecting a legitimate interest, or another lawful basis that applies to the situation. When consent is required, it should be informed, specific, voluntary, and recorded. A patient should not be forced to consent to unrelated marketing in order to receive necessary care. Separate permission may be appropriate for promotional messages, while account statements and payment reminders may be part of the service relationship.

There is no single retention period that answers every medical-record question. Practices should consider healthcare legislation, professional rules, tax and accounting requirements, contractual obligations, claims timeframes, and their own documented retention schedule. Keep records for as long as a valid purpose exists, restrict access during that period, and securely delete or anonymise them when the purpose ends. A retention schedule should distinguish clinical records, invoices, communications, consent records, and audit information rather than putting everything into one indefinite archive.

Start with a data map: list what the practice collects, where it is stored, who can access it, why it is needed, and how long it should remain available. Use unique accounts, strong passwords, role-based access, secure devices, encrypted connections, backups, and a process for responding to incidents. Train staff not to send patient information to personal inboxes or unapproved messaging groups. Review vendors and agreements regularly, and document decisions so compliance is a living process.