Protection of Personal Information Policy Statement

Dr Nicholas Goncalves / Professor Darlene Lubbe are sole proprietors conducting business as a Specialist ENT and Skull Base Surgeon at A118 Cape Town Mediclinic, 21 Hof Street, Gardens, Cape Town.

Dr Nicholas Goncalves / Professor Darlene Lubbe recognise the constitutional rights to privacy and the protection of personal information of his patients as envisaged in the Protection of Personal Information Act 4 of 2013 (hereinafter referred to as “POPI”).

Dr Nicholas Goncalves / Professor Darlene Lubbe endeavour to

  • respect the rights of his patients to have their personal information processed in a manner that gives effect to their right to
    privacy subject to limitations.
  • be open and honest with his patients whose personal information his practice processes.
  • provide training and support to all employees who handle personal information so that they can act confidently and
    consistently.

OBJECTIVES

Dr Nicholas Goncalves / Professor Darlene Lubbe guarantee their commitment to protecting the personal information of his patients and to ensure that their personal information is used appropriately, transparently, securely and in accordance with the applicable laws.

The objective of this policy is to set out the manner in which Dr Nicholas Goncalves / Professor Darlene Lubbe deals with their patients’ personal information as well as stipulates the purpose for which the information is used and is made available to all patients at his offices, A118 Cape Town Mediclinic, 21 Hof Street, Gardens, Cape Town.

DEFINITIONS

  • “Consent” – means any voluntary, specific and informed expression of will in terms of which permission is given for the processing of personal information.
  • “Data Subject” means the natural or juristic person to whom Personal Information relates.
  • “Personal Information” – means information relating to an identifiable, living, natural person, and where it is applicable, an identifiable, existing juristic person, including, but not limited to information relating to the race, gender, sex, pregnancy, marital status, national, ethnic or social origin, colour, sexual orientation, age, physical or mental health, well-being, disability, religion, conscience, belief, culture, language and birth of the person; information relating to the education or the medical, financial, criminal or employment history or of the person; any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person; biometric information of the person; the personal opinions, views or preferences of the person; correspondence sent by the person that is implicitly or explicitly of a private or confidential nature or further correspondence that would reveal the contents of the original correspondence; the views or opinions of another individual about the person; and the name of the person if it appears with other personal information relating to the person or if the disclosure of the name itself would reveal information about the person.
  • “Processing” – means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including— the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;  dissemination by means of transmission, distribution or making available in any other form; or merging, linking, as well as restriction, degradation, erasure or destruction of information.
  • “Privacy Legislation” – means any laws that protect Personal Information and privacy of Data Subjects and which apply in the Republic of South Africa or any other territory in which Dr Nicholas Goncalves / Professor Darlene Lubbe practices or operates.
  • “Regulator” – means the Information Regulator to be established in terms of the Protection of Personal Information Act.

SCOPE

The policy applies to all employees of Dr Nicholas Goncalves / Professor Darlene Lubbe as well as external service providers and affiliated companies and medical professionals. It shall further be made available to all employees and training shall be scheduled to ensure that the policy is enforced throughout the practice.

INFORMATION OFFICER

Dr Nicholas Goncalves is the appointed Information Officer of Dr Nicholas Goncalves Medical Practice. Professor Darlene Lubbe is the appointed Information Officer of the Professor Darlene Lubbe Medical Practice.

It shall be the duty of the Information Officer to:

  • Develop and maintain this policy.
  • Ensure that this policy is supported by appropriate documentation.
  • Ensuring that documentation is relevant and kept up to date.
  • Ensuring that this policy and subsequent updates are communicated to relevant staff where applicable.

The Information Officer may appoint Deputy Information Officers to assist in discharging the relevant duties.

Details of the information officers are as follows:

Name: Dr Nicholas Goncalves / Professor Darlene Lubbe
Tel: 021 180 3662
Email: admin@sinussurgeons.co.za

PROCESSING OF PERSONAL INFORMATION

Dr Nicholas Goncalves / Professor Darlene Lubbe subscribe to the principles of lawful processing of personal information as per the provisions of the POPI Act.

These principles are as follows:

1. Accountability

In order to comply with the provisions of the POPI Act, an information officer has been formally appointed and registered with the information Regulator and will be responsible for compliance with the act in a whole.

2. Processing Limitations

Personal information will be processed in a manner that is both lawful and reasonable and does not infringe on the privacy of Dr Nicholas Goncalves’ / Professor Darlene Lubbe’s patients.

3. Purpose Specification

Dr Nicholas Goncalves / Professor Darlene Lubbe will take all reasonable steps to ensure that patients are aware of the purpose of processing their personal information collected and where possible, obtain the necessary consent.

4. Further Processing Limitation

Personal information will not be processed in any manner which is not compatible with the original purpose for which it was collected.

5. Information Quality

Dr Nicholas Goncalves / Professor Darlene Lubbe aims to process personal information that is relevant, accurate and up to date with respect to the purpose for which it will be processed.

6. Openness

Dr Nicholas Goncalves / Professor Darlene Lubbe will endeavour to ensure that patients are notified of the personal information collected, the purpose for which the information was collected and their right to have access to, object to and/or rectify the information collected.

7. Security Safeguards

Dr Nicholas Goncalves / Professor Darlene Lubbe ensures that personal information is protected by reasonable security safeguards against risks such as the loss or unauthorised access,  destruction, use, modification or disclosure of personal information.

8. Participation

Dr Nicholas Goncalves / Professor Darlene Lubbe Medical practice, at the request of patients, will confirm, free of charge, whether or not it holds personal information of that patient and also update/correct this information where necessary.

COLLECTING PERSONAL INFORMATION

Personal information collected by Dr Nicholas Goncalves / Professor Darlene Lubbe or any employees and/or affiliated medical practitioners and staff will only be processed if, given the purpose for which it is processed, it is adequate, relevant and not excessive.

As a Medical Practitioner Dr Nicholas Goncalves / Professor Darlene Lubbe collects personal information of his patients to enable him to provide specific medical services and treatment to such patients.

Such information may be, but is not limited to the following:

  • Personal (identifying) particulars of the patient.
  • The bio-chemistry history of the patient, including allergies and idiosyncrasies.
  • The time, date and place of every consultation.
  • The assessment of the patient’s condition.
  • The proposed clinical management of the patient.
  • The medication and dosage prescribed.
  • Details of referrals to specialists, if any.
  • The patient’s reaction to treatment or medication, including adverse effects.
  • Test results.
  • Correspondence from or to a patient.
  • Imaging investigation results.
  • Information on the times that the patient was booked off from work and the relevant reasons.
  • Written proof of informed consent, where applicable, in respect of medical treatment/s.
  • Hand-written contemporaneous notes taken by the health care practitioner.
  • Notes taken by previous practitioners attending health care of other health care practitioners including a typed patient discharge summary of summaries.
  • Referral letters to and from other health care practitioners.
  • Laboratory reports and other laboratory evidence such as histology sections, cytology slides, and print outs from automated analysers, x-ray files, reports ECG traces and so on.
  • Audio-visual records such as photographs, videos and tape-recordings.
  • Clinical research forms and clinical trial data.
  • Other forms completed during the health interaction such as insurance forms, disability assessments and documentation of injury on duty.
  • Death certificates and autopsy reports.

The above records may be archived on microfilm, microfiche or magnetic data files.

Important to note in respect of health care records in terms of the HPCSA

  • No information may be removed from a health care record.
  • An error or incorrect entry discovered in the record may be corrected by placing a line through it with ink and correcting it.
  • The date of change must be entered; and the correction must be signed in full. The original record must remain intact and fully legible.
  • Additional entries added at a later date must be dated and signed in full.
  • The reason for an amendment or error should also be specified on the record.

Dr Nicholas Goncalves / Professor Darlene Lubbe further collects patient’s personal information for purposes of communication, invoicing and billing, referral, historical data, medical history and marketing purposes in order to ensure that his products and services remain relevant to his patients and their needs and to fulfil obligations conferred on him by the HPCSA Rules and Regulations.

UTILISATION OF PERSONAL INFORMATION

Personal information of patients will only be used for the specific purpose for which it was collected which was communicated to the patient.

The purpose for which information is collected could include but not be limited to the following:

  • Furthering the diagnosis or ongoing clinical management of the patient.
  • Conducting clinical audits.
  • Promoting teaching and research.
  • Being used for administrative or other purposes.
  • Being kept as direct evidence in litigation or for occupational disease or injury compensation purposes.
  • Being used as research data.
  • Being kept for historical purposes.
  • Promoting good clinical and laboratory practices.
  • Making case reviews possible.
  • Serving as the basis for accreditation.
  • Protecting further legitimate interests of the patient.
  • Justification for the possession of personal information in respect of minors are where the minor patients are patients who have required medical assistance and who have had the consent of their parents as competent persons as required by law. Alternatively, these minor patients are legally competent to make their own health care decisions in terms of the Child Care Act (Act No.74 of 1983).

DISCLOSURE OF PERSONAL INFORMATION

Dr Nicholas Goncalves / Professor Darlene Lubbe may disclose a patient’s personal information to any of his affiliated Medical Practitioners, hospitals, laboratories, companies and/or external service providers who provide services to patients under the scope of care of Dr Nicholas Goncalves / Professor Darlene Lubbe provided such affiliate takes the same level of care with regards to the protection of the patient’s personal information and has incorporated the provisions of the POPI Act to ensure compliance therewith.

All of Dr Nicholas Goncalves’ / Professor Darlene Lubbe’s affiliated medical practitioners, hospitals, laboratories, companies and service providers have incorporated the provisions of the POPI Act to ensure compliance therewith as well the privacy and confidentiality of personal information.

Personal information of patients may also be shared with third parties in and during medical treatment insofar as such personal information is relevant to the particular medical treatment.

Dr Nicholas Goncalves / Professor Darlene Lubbe may also disclose a patient’s personal information where it has a duty or right to disclose such information in terms of applicable legislation, the law, a court order or where it may be deemed necessary by the HPCSA or Information Regulator.

CONSENT TO PROCESS

In order to process personal information Dr Nicholas Goncalves / Professor Darlene Lubbe must ensure that he obtains the patients express and informed permission to do so. It is therefore imperative that this consent is obtained from the patient at the time of his/her initial consultation or introduction to Dr Nicholas Goncalves / Professor Darlene Lubbe.

SAFEGUARDING PERSONAL INFORMATION

Dr Nicholas Goncalves / Professor Darlene Lubbe is required by the POPI Act to put measures in place to adequately protect personal information of his patients. These safety measures will be reviewed continuously to ensure that all security and controls are updated to protect personal information.

The following procedures are in place in order to protect personal information:

  • The information officer, responsible for compliance with the provisions of the POPI Act, contact details will be made available for all Dr Nicholas Goncalves’ / Professor Darlene Lubbe’s employees and patients.
  • Dr Nicholas Goncalves / Professor Darlene Lubbe will conduct training with all employees to enable seamless integration of this policy.
  • Each employee currently employed by Dr Nicholas Goncalves / Professor Darlene Lubbe or new employees will be required to sign an addendum to their employment contract which incorporates relevant provisions of the compliance with the POPI Act, specifically related to the lawful processing and confidentiality of personal information.
  • Access to personal information stored by Dr Nicholas Goncalves / Professor Darlene Lubbe is limited to authorised personnel only.
  • All external service providers who process personal information of Dr Nicholas Goncalves’ / Professor Darlene Lubbe’s patients will be required to sign Service Level Agreements wherein they guarantee their commitment to the protection of personal information as envisaged in the POPI Act.
  • Electronic files and data which contain personal information of patients are stored and backed up by Dr Nicholas Goncalves’ / Professor Darlene Lubbe’s external service provider who is responsible for the maintaining of a security system which ensures that the personal information is protected from any physical threat and unauthorised access.

ACCESS TO AND CORRECTION OF PERSONAL INFORMATION

Dr Nicholas Goncalves’ / Professor Darlene Lubbe’s patients have the right to access personal information held by the company about them. Patients have the right to request Dr Nicholas Goncalves / Professor Darlene Lubbe to update, correct or delete personal information on reasonable grounds. Should it not be legal in respect of the HPCSA Regulations to destroy such information the personal information should be stored securely and not further processed in any way without renewed consent from the patient

Should the patient object to the processing of their personal information Dr Nicholas Goncalves / Professor Darlene Lubbe may not process the said information. Dr Nicholas Goncalves / Professor Darlene Lubbe will further take all reasonable steps to confirm its patient’s identity before providing any details of their personal information or making changes to their personal information.

IMPLEMENTATION

This is policy is implemented by Dr Nicholas Goncalves / Professor Darlene Lubbe and will be adhered to by management and all staff who are tasked with collecting and processing personal information. Non-compliance with this policy may result in disciplinary action and possible termination of employment.