Health experts warn of risks in AI adoption across Ghanaian hospitals

Data Protection Commission begins enforcement against clinics over data lapses

The Data Protection Commission (DPC) has transitioned from a strategy of persuasion to active enforcement within Ghana’s healthcare sector after recent inspections uncovered significant compliance failures. The regulator’s move follows the discovery of critical lapses in how clinics manage and store sensitive medical information, with many facilities failing to implement mandatory privacy assessments. By shifting to enforcement, the Commission aims to hold healthcare providers accountable for protecting patient rights under existing data protection laws. During its recent monitoring exercises, the Commission found that several clinics were using unassessed electronic systems to store patient records, leaving personal health data vulnerable to unauthorized access. These findings have raised alarms about the adequacy of safeguards currently in place across the private and public health landscape. The DPC’s intervention is particularly timely as the country undergoes a major digital transition to the Ghana Health Information Management System (GHIMS), a centralized platform designed to manage medical records nationwide. The transition to GHIMS has been complicated by an ongoing dispute with Lightwave, a previous service provider, which has created uncertainty regarding the security and accessibility of historical patient data. The Commission noted that the reliance on unverified systems during such transitions poses a significant risk to data integrity. Health officials are being urged to ensure that all digital tools used for record-keeping are fully vetted and compliant with national regulatory standards to prevent data breaches during the migration process. As the enforcement phase continues, the DPC is calling on all medical facilities to prioritize data protection audits and formal registration with the regulator. The Commission emphasizes that compliance is not merely a bureaucratic requirement but a fundamental necessity to maintain public trust in the healthcare system. Moving forward, health providers found in violation of the Data Protection Act may face stricter sanctions as the DPC seeks to standardize privacy protocols across all levels of medical care in Ghana.