Consent in healthcare is not only about treatment. It is also about the lawful and secure handling of personal information.
Start with the correction
POPIA is the Protection of Personal Information Act 4 of 2013, not 2014. That distinction matters in publication because legal precision builds credibility. In practice, the Act regulates how personal information is collected, used, stored, shared and secured by both public and private bodies, including healthcare practices and institutions.
Why POPIA matters in healthcare
Health information is among the most sensitive forms of personal information a practice will ever process. A practitioner may collect names, contact details, ID numbers, clinical histories, imaging, test results, invoices, biometric data and information about children, families and third parties. Once that information is collected, the practice takes on serious legal responsibilities.
Treatment consent and information processing are related, but not identical
A patient may consent to treatment without understanding how widely their information will be processed. Good forms and good systems should therefore address both. Patients should know why information is being collected, how it will be used, who may have access to it, how long it may be retained, and when it may be shared for clinical, administrative, payment or legal purposes.
In many healthcare contexts, the processing of personal information is lawful not only because of patient consent, but because it is necessary for treatment, compliance with legal obligations, or the legitimate interests of the patient.
What counts as processing?
Processing is defined broadly. It includes collecting, receiving, recording, organising, storing, updating, retrieving, using, sharing, transmitting, restricting, deleting and destroying personal information. In other words, POPIA is not only about major data breaches. It is about the everyday life cycle of patient information.
Who are the key players?
The patient is the data subject. The practice or practitioner will often be the responsible party because it determines why and how the information is processed. External service providers such as software hosts, cloud-storage providers, billing companies, IT vendors and security companies may operate as operators. Each relationship should be properly managed and documented.
The eight conditions in practical terms
POPIA’s eight conditions for lawful processing can be translated into practical questions. Is someone accountable internally? Are you collecting only what you need? Is the purpose clear? Is further use compatible with that purpose? Is the information accurate and up to date? Have you been open with the patient? Are your security safeguards adequate? Can patients exercise their access and correction rights?
Records retention still matters
POPIA does not replace sector-specific record obligations. HPCSA guidance on health records, together with other applicable laws, still informs retention periods and access practices. In many cases, adult patient records must be retained for at least six years, with longer periods applying to minors and in certain clinical or legal contexts.
Security is not optional
Practices should implement reasonable technical and organisational measures to protect patient information from loss, unauthorised access, misuse and disclosure. Password discipline, controlled access, secure backups, device policies, staff training, operator agreements and a clear incident-response process are all part of compliant practice management. POPIA requires “appropriate, reasonable technical and organisational measures.”
When a breach happens
If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party is required to notify the Information Regulator and affected data subjects as soon as reasonably possible.
Final thought
A good consent form is only one part of POPIA compliance. The real test is whether the practice’s daily habits match what the form promises. Lawful processing, secure systems and accurate record management are now part of core clinical governance, not optional administration.
