Data Protection Commission targets clinics over patient record security

The Data Protection Commission (DPC) has shifted its strategy from advisory persuasion to strict enforcement within the health sector after identifying widespread compliance failures at several medical facilities. Recent inspections revealed significant lapses in data protection protocols, including a lack of mandatory privacy assessments and inadequate safeguards for sensitive medical records. The regulator’s move signals a new phase of accountability as it seeks to ensure that health providers adhere strictly to the Data Protection Act to safeguard patient rights.

A primary concern raised by the commission involves the security and accessibility of historical patient data during the transition to the Ghana Health Information Management System (GHIMS). While GHIMS is designed to centralize and streamline medical record-keeping across the country, some clinics were found to be storing sensitive information on systems that had not been properly assessed for risk. These compliance gaps leave patient information vulnerable to unauthorized access and potential data breaches during the migration from legacy systems.

The enforcement drive also addresses complexities surrounding the transition from a previous vendor, Lightwave. The DPC has noted that disputes with former service providers must not compromise the integrity or availability of patient data. The commission is emphasizing that the adoption of new management software requires rigorous internal audits and proactive measures to prevent the loss of records or the exposure of private medical histories to external threats.

Moving forward, the Data Protection Commission has urged all health facilities to prioritize compliance to avoid legal penalties and reputational damage. As the Ghanaian health sector continues its digital transformation, the regulator maintains that the protection of patient confidentiality remains a non-negotiable legal requirement. The DPC plans to sustain its monitoring and enforcement activities to ensure that all healthcare providers establish robust systems for processing and storing medical data.