Why healthcare practices should treat every data incident as a governance issue, not just an embarrassment.
The message from enforcement
The Information Regulator has made it increasingly clear that personal-information breaches will not be treated as trivial administrative slip-ups. Public reporting and enforcement activity have shown a firm focus on accountability, especially where sensitive personal information is circulated without lawful justification.
A useful reminder from the SAPS matter
In 2022, the Information Regulator publicly addressed the release of personal information relating to victims in the Krugersdorp case and took formal steps against SAPS after inadequate responses to its requests. The broader lesson was unmistakable: once a responsible party is under scrutiny, the quality, speed and completeness of its response matter greatly.
Why this matters even more in healthcare
Healthcare practices process highly sensitive information every day. Patient names, contact details, ID numbers, diagnoses, images, test results, billing details and treatment histories are not ordinary data. A single careless WhatsApp message, misdirected email or poorly controlled shared drive can trigger legal, ethical and reputational consequences.
WhatsApp is not a safe excuse
One of the most persistent myths in practice management is that a message sent in a clinical WhatsApp group is harmless because it was well-intended or because the app is encrypted. That is not enough. The real questions are whether the disclosure was authorised, necessary, proportionate and properly controlled. Only the minimum amount of information necessary for the purpose should be shared. If not, a problem may already have been created.
What should practices do now?
Practices should have a POPIA compliance framework, role clarity, operator agreements, access controls, device policies, staff training and an incident-response plan. They should also understand that an investigation triggered by one complaint may expose broader weaknesses in information governance. A bad habit in one corner of the practice often points to larger systemic risk.
When an incident occurs
Act promptly. Preserve the evidence. Contain the breach. Assess who was affected and what information was involved. If there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person, the responsible party is required to notify the Information Regulator and affected data subjects as soon as reasonably possible. Record the steps taken. Informal deletion, denial or internal blame-shifting rarely solves anything.
Final thought
POPIA compliance is no longer a box to tick for the website footer. It is a live operational duty. In healthcare, where confidentiality lies at the heart of trust, information governance should be treated with the same seriousness as any other patient-safety and risk-management function.
