Patient records do not become ownerless simply because a practice closes, is sold, or a practitioner dies.
Why this issue matters
Patient records are among the most sensitive assets in any healthcare practice. When a practitioner dies, retires, sells a practice or closes it down, those records still carry legal, ethical and practical obligations. The duty to protect confidentiality does not vanish when the consulting room doors close.
The responsible party may change, but duties continue
Under POPIA, the responsible party is the person or entity that determines the purpose and means of processing personal information. When a practice changes hands, that role may shift. Reasonable steps should be taken to inform patients who will hold their records going forward, for what purpose, and what choices they have about transfer and access.
What happens if a practitioner dies?
HPCSA guidance contemplates that the practitioner’s estate, acting through the executor, may temporarily control the records for purposes of securing, managing and lawfully transferring the records. If the practice is taken over by another healthcare practitioner, the records may be transferred to that practitioner, but patients should be informed of the change and of their right to request transfer to another practitioner of their choice where appropriate.
What if the practice is not taken over?
If no new practitioner takes over the practice, patients should be notified that the practice has closed, told who will hold the records for safekeeping, and informed how they may request transfer or access. Confidentiality must still be preserved throughout. Records should never simply be abandoned, casually disposed of, or handed to an unauthorised person.
What about a sale of practice?
A sale agreement should deal expressly with record custody, confidentiality obligations, storage, access processes, operator relationships, retention periods and patient notification. A purchaser should not assume that possession alone is enough. The legal basis for ongoing processing and the practical communication to patients both matter. The new responsible party assumes responsibility for ongoing compliance, including lawful retention, access management and security of the records.
Why notification is so important
Patients should not discover by accident that someone new now controls their records. Reasonable steps should be taken to inform them of the change, the identity of the new responsible party or custodian, and the options available to them. This is good practice under POPIA and good professional practice generally.
Practical safeguards
Use a proper handover inventory. Secure physical and electronic files. Ensure operator agreements remain fit for purpose. Confirm backup arrangements. Maintain an access request process. Keep an audit trail of transfers. Decide who will respond to medico-legal requests and complaints. In short, treat the transition as a governance event, not merely an administrative one.
Final thought
Patient records outlive the career, ownership or even the life of the practitioner who created them. Any closure, death or sale should therefore be managed with the same care given to the records during active practice: lawfully, securely and with clear communication to the patients whose information is affected.
