Confidentiality is not simply a promise to keep quiet. It is a legal and professional system governing why patient information is collected, who may access it, when it may be shared and how it must be protected throughout its life cycle.
Approximate article length: 1,502 words
Why confidentiality is clinically necessary
Patients disclose information because they believe it will be used to provide care and protected from unnecessary exposure. If that expectation is weak, patients may withhold facts about symptoms, medication, mental health, sexual health, substance use, family circumstances or finances. Confidentiality therefore supports diagnosis, treatment and public confidence; it is not merely an administrative requirement.
In South Africa, confidentiality is supported by several overlapping sources. Section 14 of the Constitution protects privacy. Sections 14 to 17 of the National Health Act regulate the confidentiality, access and protection of health information. The Protection of Personal Information Act, or POPIA, treats health information as special personal information and imposes conditions for lawful processing and security. The HPCSA Ethical Rules and Booklet 5 add profession-specific standards for practitioners registered with the Council.
These sources should be read together. Consent may provide a lawful basis for a disclosure, but the practice must still limit the information to the purpose, communicate securely and avoid misleading the patient about who will receive it. Likewise, the fact that information is useful does not automatically make its disclosure lawful.
Confidentiality, privacy and data protection
The concepts overlap but are not identical. Privacy concerns the person’s ability to control intrusion into private life, body and information. Confidentiality arises from the professional relationship and the expectation that information entrusted to the practitioner will not be disclosed improperly. Data protection regulates the broader processing life cycle, including collection, storage, use, sharing, retention, correction and destruction.
A practice can breach confidentiality without publishing a full medical record. Discussing a patient in a lift, leaving a referral letter on a reception desk, using an identifiable case in a teaching chat group, sending results to the wrong email address or allowing a family member to overhear a telephone consultation can all expose information. Good controls therefore address people, physical space and technology.
The starting point is purpose limitation. Staff should collect information that is reasonably necessary for care, administration or another lawful purpose. Access should be role-based. A receptionist may need demographic and appointment information but ordinarily does not require unrestricted access to every clinical note. Audit logs, unique user accounts and regular access reviews help make accountability real.
Consent and the minimum-necessary principle
Where disclosure is not otherwise authorised or required, the practitioner should seek the patient’s informed consent. The patient should understand what information will be disclosed, to whom, for what purpose and, where relevant, what risks are associated with the method of communication. Consent should be specific enough to be meaningful and should be recorded.
Even with consent, the disclosure should be limited to what is necessary. An employer asking whether an employee is fit for work may not need the full diagnosis and consultation history. An insurer may require information relevant to a claim, but a broad request for an entire lifetime record should be tested against the consent, purpose and proportionality of the request. A family member who pays the account is not automatically entitled to clinical information.
Anonymisation can reduce risk where identifiable information is not required. True anonymisation must make re-identification not reasonably possible; simply removing a name may be insufficient where age, occupation, location, dates, images or an unusual condition reveal the patient. Pseudonymised data remains personal information if the person can be re-identified through a key or other data.
Sharing within the healthcare team
Relevant information may need to be shared among practitioners and staff involved in the patient’s care. The patient should ordinarily be made aware that this occurs and why. Team sharing is not a blank cheque: the recipient should have a legitimate care-related role, receive only relevant information and understand that the information remains confidential.
Referrals should contain enough information to support safe care without including irrelevant sensitive detail. Handover conversations should occur in private. Multidisciplinary meetings should be limited to participants with a legitimate role, and minutes should be stored securely. Where an external service provider processes information – for example a cloud host, billing bureau or transcription service – the practice remains responsible for selecting a suitable operator and establishing written security and confidentiality obligations.
Patient portals are generally safer than ordinary email or messaging for routine exchange of sensitive documents, provided that authentication, access control and audit functions are properly configured. Convenience is not a defence for sending information through an uncontrolled channel.
When disclosure may occur without consent
Confidentiality is strong but not absolute. Information may be disclosed where legislation authorises or requires it, where a court lawfully orders disclosure, or in other narrowly defined circumstances recognised by law and professional guidance. Some conditions are notifiable under public-health law. Certain statutory processes may require reports. Each disclosure should be based on an identifiable authority rather than a vague belief that disclosure is ‘in the public interest’.
Public-interest disclosure requires careful balancing. The practitioner should consider the seriousness and likelihood of harm, whether an identifiable person or group is at risk, whether consent can safely be sought, whether a less intrusive option exists and how much information is necessary. Where the position is uncertain, urgent professional or legal advice should be obtained.
A subpoena, request from an attorney or demand from an employer is not automatically equivalent to a final court order or statutory obligation. The practitioner should verify the document, clarify the legal basis, consider whether the patient should be notified and disclose only what is required. Informal pressure should not replace due process.
After a patient’s death, confidentiality continues. Requests from family members, executors, insurers or researchers must be assessed under the applicable legal and ethical framework. Relationship to the deceased does not create unlimited access to the record.
Children and other patients with impaired decision-making
Confidentiality involving children requires attention to age, maturity, the type of healthcare service, parental responsibilities and the child’s best interests. South African law recognises circumstances in which a child aged 12 or older may consent to medical treatment if sufficiently mature and able to understand the benefits, risks and social implications. That does not mean that every confidentiality question is resolved by age alone.
Practitioners should avoid making automatic assumptions that a parent must always receive all information, or that a child can always exclude a parent. The proper approach is to identify who lawfully consented to the service, assess the child’s capacity and best interests, consider safety risks and apply the specific rules governing the treatment or information requested. Complex cases should be escalated.
For adults who lack decision-making capacity, information may need to be shared with a legally authorised representative or person involved in care. The disclosure should remain limited to the purpose and should respect the patient’s dignity and previously expressed wishes as far as possible.
Electronic communication, cloud systems and AI
POPIA requires appropriate technical and organisational safeguards to protect the integrity and confidentiality of personal information. A practice should conduct information-security risk assessments, maintain access controls, use encryption where appropriate, patch systems, back up data, test restoration, manage devices and train staff against phishing and social engineering.
Shared passwords, unattended screens, unencrypted portable drives and personal messaging accounts are obvious weaknesses. Less obvious risks include automatic cloud backups to personal accounts, recordings retained by video platforms, metadata embedded in images and staff using patient data in public artificial-intelligence tools. Patient information should not be entered into an AI system unless the practice has assessed the lawful basis, contractual protections, data location, retention, secondary use, security and human oversight.
A confidentiality incident should trigger a documented response: contain the exposure, preserve evidence, assess what information and patients are affected, determine legal notification duties, reduce ongoing harm and correct the control failure. POPIA may require notification to the Information Regulator and affected data subjects where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, subject to the Act’s requirements.
A practical confidentiality standard
Every practice should maintain a privacy notice, access matrix, confidentiality agreements, secure communication policy, record-release procedure, operator contracts, breach-response plan and retention schedule. Training should include realistic scenarios, not only signed undertakings. Staff should know how to verify identity, handle family requests, transfer records, respond to subpoenas and report a misdirected message immediately.
The safest operational question is: does this person need this information, for this purpose, through this channel, at this time? If any part of the answer is unclear, stop and verify before disclosing.
Confidentiality failures are often described as accidents, but repeated accidents usually reveal poor systems. A well-designed practice makes the correct recipient easy to verify, restricts unnecessary access and creates a culture in which staff report errors quickly. Trust is protected not by promising perfection, but by building controls that prevent avoidable disclosures and respond honestly when an incident occurs.
Disclaimer: While every reasonable effort has been made to ensure the accuracy, completeness and currency of the information contained in this document, Genoa Underwriting Managers (Pty) Ltd makes no representations or warranties, whether express or implied, regarding the correctness, reliability or suitability of such information. The contents of this document are provided for general informational purposes only and do not constitute legal, medical, financial, insurance or professional advice. Readers should seek appropriate professional advice specific to their circumstances before acting on any information contained herein. To the fullest extent permitted by law, Genoa Underwriting Managers (Pty) Ltd, its employees, representatives and affiliates shall not be liable for any loss, damage, liability or expense arising directly or indirectly from reliance on or use of the information contained in this document.
