Best Practice Guidelines: Medical | Dental | Allieds

All processed information should be categorised per ground for processing before processing starts. This means that the practice must review the information collected and document which information falls into which ground for the processing.

There are six lawful grounds for processing personal information:

1. Is it necessary for the conclusion or performance of a contract?
   
2. Is it necessary for compliance with legislation?
3. Are you protecting a legitimate interest of the DS? (They can object.)
4. Are you pursuing a legitimate interest for your practice or a third party? (They can object.)
5. Do you have the consent of the DS / CP? (You should consider this as a last resort.)
6. Are you a public body performing a public law duty? (They can object.)

1. Contract

The RP can process PI if the processing is necessary to carry out actions to conclude or perform a contract to which the DS is a party.

Examples:

1. Processing PI of a patient who contracts the practitioner for healthcare services.
2. Sharing PI of a patient with the medical aid to settle the account.
3. Processing PI of an employee.
4. Processing PI of a parent/guardian/another party who takes responsibility for settlement of the account on behalf of a patient, be it a minor patient or not.
5. Processing PI of a bureau.

2. Legislation

The RP can process PI if the processing complies with an obligation imposed by law on the responsible party.

Examples:

1. Processing PI of a patient in terms of the obligations imposed by the HPCSA regarding minimum information to be kept for medical records.
2. Processing PI of employees to comply with the SARS tax provisions.
3. Processing PI of patients to co-operate with Healthcare Inspectors.

3. Legitimate interests of the DS

The RP can process PI if the processing protects a legitimate interest of the data subject.

Examples:

1. Processing PI to save the life of the unconscious emergency patient (without the patient's co-operation, there can be no contract).
2. Obtaining next of kin information from an employee, the next of kin being another DS, to contact the next of kin in case of an emergency.
3. Sending a patient's PI to the medical aid to pre-authorise a procedure.

4. Legitimate interests of the RP / 3rd party

The RP can process PI if the processing is necessary for pursuing the legitimate interests of the RP or of a third party to whom the information is supplied.

Take note: A LIA must be completed if the practice is to rely on this ground for processing PI so that it is reportable.

Examples:

1. The practice hands the patient over to a debt collecting company. This is to pursue the interest of the practice. No patient will give consent for this! ;-)
2. The practice shares information with the patient's employer in an injury on duty claim to pursue the legitimate interest of the third party, the patient employer.

Legitimate interest is the most flexible lawful ground for processing, but you cannot assume it will always be the most appropriate. It is likely to be most appropriate where you use people’s PI in ways they would reasonably expect and have a minimal privacy impact or where there is a compelling justification for the processing. If you choose to rely on legitimate interests, you are taking on extra responsibility for considering and protecting people’s rights and interests.

There are three elements to the legitimate interests ground. It helps to think of this as a three-part test. You need to:

1. The purpose test (identify the legitimate interest);
2. The necessity test (consider if the processing is necessary); and
3. The balancing test (consider the individual’s interests).

Purpose test

The legitimate interests can be your interests or the interests of third parties. They can include commercial interests, individual interests or broader societal benefits.

Necessity test

The processing must be necessary. If you can reasonably achieve the same result in another less intrusive way, legitimate interests will not apply.

Balancing test

You must balance your interests against the DS. If they would not reasonably expect the processing, or if it would cause unjustified harm, their interests are likely to override your legitimate interests.

For more detailed information, see the chapter on the LIA in our POPIA introduction book.

5. Consent

The RP can process PI if the DS or a CP, where the DS is a child, consents to the processing.

As per the definition of consent, there are three elements of consent that need to be present for an RP party to rely on the consent of the DS as a legal ground for processing PI:

1. It must be voluntary;
2. It must be specific;
3. It must be informed so that a DS can genuinely consent to the processing.

From the above, it is evident that consent should be the last resort for processing PI, as there are numerous problems with the application of consent:

Example: A person is employed by the practice and included in the practice's employment contract is a consent form in terms of which the employee gives consent that the practice may have access and the right to read the work emails received and sent by the employee using the practice's business email allocated to the employee.

Let's look at the pitfalls of consent as a lawful ground for processing:

1. Voluntary: In some European countries, the courts now find that those consents are not voluntary, as the employee is not on the same bargaining level as the employer. Should it be found by a court that any processing based on consent lacks the voluntary element, processing will be deemed illegal.
2. Specific: Consent can never be open-ended. The processing and processing purpose must be clearly defined. General consent is not good enough to fulfil the requirement of specific consent. Consent needs to deal with the what, why, how, where and in each instance, whether the information will be given to anyone else.
3. Informed: The RP must prove that the DS understood how their PI would be processed.
4. The burden of proof: The RP bears the burden of proof that the DS consented to the processing of PI, and if it is not in writing, it can be a serious problem.
5. Withdrawal of consent: The DS can withdraw their consent at any time, whereafter the RP will not be able to process the PI anymore. This can lead to unworkable situations.

6. How to choose your lawful ground?

• This depends on your specific purposes and the context of the processing. You should consider why you want to process the PI and consider which lawful ground best fits the circumstances.
• You might consider that more than one ground applies, in which case you should identify and document all of them from the start.
• You must not adopt a one-size-fits-all approach. No one ground should be seen as always better, safer or more important than the others, and there is no hierarchy in the order of the list in the POPIA.
• Several lawful grounds relate to a particular specified purpose – a legal obligation, performing a contract with the individual or protecting someone’s legitimate interests. If you are processing for these purposes, the appropriate lawful ground may well be obvious, so it is helpful to consider these first.
• In other cases, you are likely to have a choice between using legitimate interests or consent. You need to consider the broader context, including:
• Who does the processing benefit?
• Would individuals expect this processing to take place?
• What is your relationship with the individual?
• Are you in a position of power over them?
• What is the impact of the processing on the individual?
• Are they vulnerable?
• Are some of the individuals concerned likely to object?
• Are you able to stop the processing at any time on request?
• You may prefer to consider legitimate interests as your lawful ground if you wish to keep control over the processing and take responsibility for demonstrating that it is in line with people’s reasonable expectations and wouldn’t have an unwarranted impact on them.
• On the other hand, if you prefer to give individuals complete control over and responsibility for their data (including the ability to change their minds about whether it can continue to be processed), you may want to consider relying on an individual's consent.