Patient records that help you deliver care.
Records management and information governance for South African private hospitals, medical schemes, group practices, and NHI-affected entities. Lifetime patient records, NHI-ready format, sensitive personal information properly handled, clinician-fast retrieval.
Book Free Assessment →Patient records outlive the patient.
- i.
The retention horizon is a lifetime, sometimes longer.
HPCSA expects clinical records held for at least six years after the last consultation, and for paediatric records, until the patient turns 21 — whichever is later. Some specialties hold records for decades. The right answer to “when can we destroy this” is almost never “next year.”
- ii.
Personal information that POPIA treats as special.
Health data falls under section 27 of POPIA — a stricter protection regime than ordinary personal information. The processing has to be lawful, the safeguards have to be specifically appropriate, and the breach consequences are larger if it isn't.
- iii.
Records that have to move at clinical speed.
A patient in front of a clinician doesn't want to hear that their file is being retrieved from offsite storage. Patient records are also operational records — if the system is slow, care suffers. The records architecture has to match the clinical workflow, not the other way around.
What we map your records against.
- HPCSA — the Health Professions Council's booklets on the keeping of patient records and the related ethical rules.
- POPIA section 27 — special personal information, including health data, with stricter processing conditions.
- Medical Schemes Act — member, claim, and clinical-decision records for schemes and administrators.
- National Health Act — patient records, consent, and confidentiality requirements.
- NHI readiness — records architecture compatible with the National Health Insurance information flows as they roll out.
- HASA, NAPHISA — sector codes of conduct in development under POPIA.
Six things, care-tuned.
- i.
Lifetime patient records, retrievable in seconds.
A unified clinical record that follows the patient from intake to long after discharge. Locally hosted, POPIA-compliant, and searchable in the way clinicians actually search.
- ii.
Special-information handling under POPIA s27.
Processing maps, lawful-basis documentation, consent records, access controls, and the safeguards POPIA expects when the data is health data. So the protection isn't generic; it's specifically appropriate.
- iii.
NHI-ready records architecture.
Records held in formats that move cleanly into the NHI information flows as they roll out, with interoperability and provenance baked in — not retrofitted in a panic.
- iv.
Records destruction with clinical oversight.
When a record reaches end-of-life, the destruction decision goes through the right clinical and compliance sign-off, with certificates and an audit trail. No record gets shredded by accident.
- v.
Subject-access and complaints response.
Patients asking for their own records. Estates asking for a deceased patient's file. Regulators asking on behalf of a complainant. We handle the intake, the redaction, and the production within the timeframes POPIA and HPCSA expect.
- vi.
Information Officer-as-a-Service for healthcare.
Named senior IO with sector experience, sitting between the practice or scheme and the Information Regulator, the Council for Medical Schemes, or HPCSA when something goes wrong.
Right-sized for the practice or the group.
Solo and small group practices typically sit in Foundation. Mid-size practices, multidisciplinary groups and growing schemes sit in Professional. Hospital groups, large schemes and administrators sit in Enterprise. The shared instinct across all of them: the records have to serve patient care first and compliance second — or compliance fails anyway.
Sector close but not exactly this?
We've worked across most of the South African healthcare landscape — hospitals, schemes, administrators, group practices, specialist clinics, allied health, occupational health, and the supporting infrastructure. If your slice of healthcare isn't quite what we've described, tell us what you do and we'll show you what's relevant.
— T.