South Africa: Cloud in Healthcare Services

• Key regulators in this industry include the Health Professions Council of South Africa,¹⁹ relevant provincial Departments of Health and the Council for Medical Schemes.²⁰
• There are also many other regulators regulating other practitioners and healthcare industry role-players.²¹

The use of cloud services is not expressly addressed in any specific healthcare legislation. There may however be laws applicable to the healthcare industry which may need to be taken into account, including the obligation on relevant role-players to keep confidential and not to disclose certain information.

There is presently no uniform regulation of cloud services in South Africa. Role-players within the healthcare sector would, however, need to be mindful of the following regulatory provisions in moving to the cloud:

• Certain general and specific requirements relating to security and protection of the confidentiality of patient and medical scheme beneficiary personal medical information, which preclude disclosure save in specified circumstances, such as with consent of the patient or by court order.²²
• Health establishments: the person in charge of a health establishment which is in possession of a person's health records must set up control measures to prevent unauthorised access to those records and to the storage facility in which, or system by which, records are kept.²³
• Medical schemes:
  • where managed health care is undertaken by the medical scheme itself or by a third party managed health care organization, the scheme must ensure that a written protocol is in place that deals with confidentiality of clinical and proprietary information.²⁴
  • a scheme is entitled to access any treatment record held by a managed health care organization or health care provider or other information pertaining to the diagnosis, treatment and health status of a scheme's beneficiary, but the information may not be disclosed to any other person without consent.²⁵
• Pharmacies:
  • the minimum standards for record keeping procedures provide that patient medication records must be kept in the pharmacy, except in institutional pharmacies²⁶ where the pharmacist has access to the necessary information in the patient’s medical/clinical records kept in the health facility.²⁷
  • a prescription book or other permanent record must be kept in respect of certain medicines, in hard copy or electronically on all premises where such medicines are sold or dispensed. A prescription book or other permanent record must be kept for a period of at least five years after the date of the last entry.²⁹

The above rules would not preclude simultaneous cloud storage.

Given the sensitive nature of health information, it goes without saying that the chosen cloud solution must be secure, and help customers ensure compliance with their data privacy obligations.

Once the relevant provisions of the Protection of Personal Information Act, 2013 (POPIA) are in force, information regarding health or sex life will be treated as special personal information, and its processing²⁹ will be subject to specific requirements.³⁰ However, this will not preclude processing with consent of the data subject³¹ nor processing by, amongst others:

• medical professionals, healthcare institutions or facilities, or social services, if such processing is necessary for the proper treatment and care of the person, or for the administration of the institution or professional practice concerned³²
• medical schemes, medical scheme administrators and managed healthcare organisations, if such processing is necessary for (i) assessing the risk to be covered by the medical scheme and the person has not objected to the processing, (ii) the performance of a medical scheme agreement; or (iii) the enforcement of any contractual rights and obligations.³³

No, there are no laws requiring approval from healthcare regulatory authorities for use of cloud services. Regard must however be had to the above considerations given that stringent obligations are placed on the sector's role-players to maintain the privacy of patients and the confidentiality of patient information, as well as the safekeeping of records.

To the extent that health information is to be transferred outside of South Africa without compliance with the data transfer requirements set out below, the responsible party will require prior authorization from the Information Regulator.³⁴

Healthcare regulatory authorities possess fairly broad inspection powers which include the power to enter the relevant premises (at a reasonable time) and to access relevant information. For example, a health officer may require the person in charge of a health establishment to produce for inspection or for purposes of making copies or extracts any document including any health record that the establishment is required to maintain.³⁵ Similarly, the Registrar of medical schemes may order an inspection into a medical scheme (and/or its administrator) for purposes of routine monitoring of compliance with the MSA. These inspections usually entail the inspectors attending at the scheme's premises and requesting copies of any information considered necessary for the inspection.

Under POPIA, personal information may be transferred out of South Africa as long as the requirements of POPIA are met. POPIA permits the transfer of personal information to a third party who is in a foreign country in specific circumstances, including if the recipient is subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection as contemplated in POPIA, or with the person's consent.³⁶ If not, prior authorization will be required from the Information Regulator (as noted earlier).³⁷

Microsoft holds itself accountable and subject to the laws of regions in which it maintains data centres, and has binding agreements, which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.