Nigeria: Cloud in Healthcare Services

1. Key regulators in this industry include the Federal Ministry of Health¹⁴, State Ministry of Health¹⁵, Ministry of Health in every state in Nigeria¹⁶, Community Health Practitioners Registration Board of Nigeria¹⁷, the Medical and Dental Council of Nigeria ¹⁸,and the National Health Insurance Scheme (NHIS)¹⁹.
2. There are also many other regulators regulating other practitioners and healthcare industry role-players²⁰.

The use of cloud services is not expressly addressed in any specific healthcare legislation. There may however be laws applicable to the healthcare industry which may need to be considered, relating to, amongst other things, the obligation on relevant role players to keep confidential and not to disclose certain information.

There is presently no specific or uniform regulation of cloud services for healthcare in Nigeria. A move to cloud services would require consideration of a number of regulatory regimes in various sectors that may impact the adoption of cloud services by the public sector. Role-players within the healthcare sector would, however, need to be mindful of the following regulatory provisions in moving to the cloud:

• Certain general and specific requirements relating to security and protection of the confidentiality of patient and medical scheme beneficiary personal medical information, and precluding disclosure save in specified circumstances, such as with consent of the patient or by court order.²¹
• Health establishments: the person in charge of the health establishment which is in possession of a person's health records must set up control measures to prevent unauthorised access to those records and to the storage facility in which, or system by which, records are kept.²²
• Food and Drugs Administration: disclosure of information regarding certain substances is prohibited under the Food and Drugs Act except (i) with the written consent of the person who supplied the information; or (ii) in accordance with the directions of the Minister of Health; or (iii) for the purposes of any proceedings under the Food and Drugs Act.²³
• Medical schemes: All NHIS accredited health care facilities are required to put in place a functional medical records unit/department as a prerequisite to their accreditation. The unit is required to coordinate the information technology of the facility.²⁴
• Pharmaceutical Laboratories: All pharmaceutical laboratories are to establish and maintain procedures for the identification, collection, indexing, retrieval, storage, maintenance, and disposal of and access to all quality and technical/scientific records. Laboratories are to ensure that (i) data processing equipment is verified as being suitable to use; (ii) procedures are established and implemented for protecting the integrity of data and for making, documenting and controlling changes to information stores in computerised systems²⁵; and (iii) electronic data should be backed up at appropriate regular intervals to prevent loss.²⁶ Manufacturers, Importers, Wholesalers, and Retailers of drugs, Poisons and devices are also mandated to keep appropriate records of the receipt and disposal of drugs.²⁷

Given the sensitive nature of health information, it goes without saying that the chosen cloud solution must be secure, and help customers ensure compliance with their data privacy obligations.²⁸

No, there are no specific laws requiring approval from healthcare regulatory authorities for use of cloud services. However, certain processes may need to be followed and certain requirements, waivers or authorisations may need to be met prior to migrating to cloud services. Regard must also be given to the above considerations given that stringent obligations are placed on the sector's role players to maintain the privacy of patients and the confidentiality of patient information, as well as the safekeeping of records.

The role-players in the healthcare sector which are organs of state (such as a public healthcare establishment) will also need to follow specific processes (which may necessitate certain approvals) required by the applicable public procurement laws in procuring cloud services. They might also, in certain circumstances, need to engage with the National Information Technology Development Agency (“NITDA”).

The Regulatory Authorities possess broad inspection powers which include the power to enter the relevant premises (at a reasonable time) and to access relevant information. For example, a health officer may undertake inspection of imported food, drugs, cosmetics, medical devices, bottled water, and chemicals and establish relevant quality assurance systems, including certification of the production sites and of the regulated products.²⁹ Similarly, the auditors appointed under the National Health Insurance Scheme Act are entitled at all reasonable times to require to be produced to them accounts and other records kept by a Zonal Office and to inquire from any member, agent, or employee of the Zonal Office such information and explanations as in the opinion of the auditors are necessary for the purpose of their audit.³⁰ Other regulations also allow authorized personnel access to inspect documents which may contain relevant information on certain conditions.³¹

Also, health workers or health care providers that have access to the health records of a user may disclose such health records to any other person, health care provider, or health establishment as is necessary for any legitimate purpose within the ordinary course and scope of their duties where such access or disclosure is in the interest of the user.³²

Various data protection provisions may be applicable. Under the draft NITDA Guidelines on Data Protection (the "Draft Guidelines"), personal information may be transferred out of Nigeria provided the requirements of the Draft Guidelines are met. The Draft Guidelines will permit the transfer of personal information outside Nigeria where adequate provisions are in place for its protection. This could take the form of legislation or contractual provisions which ensure adequate protection of personal information or could be sanctioned by consent of the data subject.

Microsoft holds itself accountable to and subject to laws of general application applicable to information technology service providers, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO/IEC 27018 Privacy Standard. Microsoft is also committed to ensuring compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.