EXCLUSIVE: National Health Lab Services is sharing patient records

Eyewitness News understands that the details are contained in a legal opinion obtained by the National Health Laboratory Services' legal services manager in July last year, but the sharing of records with NGOs has not stopped.

Picture: Pexels

JOHANNESBURG - The National Health Laboratory Services (NHLS) has been sharing patient medical records with third parties without the patients’ consent – and has opened itself up to legal claims from the affected patients.

The allegation is supported by a legal opinion obtained by the lab’s legal services manager in July last year.

But the National Department of Health denied there was an unlawful and unethical breach of patient confidentially – saying it had obtained a further legal opinion from senior counsel, which found the practice to be above board.

The department has not provided Eyewitness News with a copy of this latest legal opinion despite several requests for it to do so.

The NHLS is the public health service that provides laboratory and related public health services to national and provincial healthcare departments. The labs service 80% of the population through a national network. Its specialised institutes include the National Institute for Communicable Diseases (NICD), the National Institute for Occupational Health (NIOH), and the South African Vaccine Producers (SAVP), as its subsidiary.

A source who spoke to EWN on condition of anonymity said the labs had a database containing millions of current and historic patient records. Many of the records are for patients with HIV and Aids, and who are receiving treatment at state hospitals and clinics. The source said it was these records that were shared with non-governmental organisations (NGOs), which were appointed to ensure patients stick to their treatment regimes. He said this was done unlawfully and against a legal opinion obtained last year.

EWN obtained the Hogan Lovells legal opinion, which set out its mandate: “Our opinion is sought on an extremely urgent basis on whether the NHLS is permitted in law to share patients’ personal information ('data') with third parties without their consent in pursuance and/or fulfilment or realisation of the right to access to healthcare services enshrined in the Constitution.”

It stated in the opinion that it was “common cause that patients' data shared by the NHLS with the NGOs is done without the prior consent of the concerned patients. It is contended this is done in the interests of patients and in furtherance of the right to access to healthcare services… Simply put, NHLS contends that the patent breach of patients' right to privacy is a reasonable and justifiable limitation in open and democratic society having regard to the right to access to health care services.”

The NHLS source said the data sharing prompted the legal services manager to seek an outside opinion. Hogan Lovells said “patient confidentiality was one of the cornerstones of the medical profession. Therefore the relationship between a patient and a pathologist was akin to the relationship of a doctor or patient.

“It is unlawful to release or disclose personal information of a patient without prior written consent. However, it is permissible in terms of section 15(1) of the National Health Laboratory to disclose personal information of a patient provided the requirements stipulated therein are met or complied with. Based on the information at hand, it is evident that the NHLS has failed to satisfy these requirements to enable it to disclose patients' data to third parties under the current arrangement, contractual or otherwise.”

The legal opinion concluded that “the inescapable conclusion is that the sharing of patients' data by the
NHLS with the NGOs is in inconsistent with the Constitution and thus, unlawful and unethical. This infringement of the right to privacy and confidentiality of patients is of epic proportion and is akin or comparable to a data breach punishable both in private (delictual or constitutional damages or striking off of medical professionals) and criminal law (fine or imprisonment).”

The Health Department’s spokesperson Popo Maja said he was aware of this legal opinion – but said it was not the only one obtained by the NHLS.

“The department agreed with the NHLS's decision to question the accuracy and completeness of the initial opinion. The department agrees with the final opinion which was obtained after Hogan Lovells brought in a senior counsel who is also a medical doctor who reviewed the initial agreement,” he said.

Maja was asked to provide EWN with this latest legal opinion, but it is yet to be received.

The NHLS source disputed the department’s claim, saying there was no additional opinion that contradicted the initial findings.

Maja said the patient data was being shared lawfully and was done so in terms of the National Health Act.

“The NGOs being given data are part of the treatment network of the patients. They all operate with the approval of Provincial Departments of Health, as part of the patient's treatment networks. No third-party NGO is given data.

“The Department will always act in the best interest of the patient and of public health all the time. This is provided for within the National Health Act within this public interest, patients’ confidentiality is still patient sacrosanct,” he said.

One of the organisations that received the data was public health consultancy Strategic Evaluation Advisory (SEAD), whose founder and chief executive is Dr Tim Tucker, who is also an NHLS board member.

EWN asked Tucker whether this constituted a conflict of interest.

“There is no conflict of interest. SEAD has made full disclosure of its work to the NHLS board and the board has determined that no conflict exists. SEAD’s relationship with the NHLS has been reviewed by an outside ethics committee that deemed that there was no conflict of interest,” he said.

Tucker explained that SEAD was part of multiple donor-funded consortia that support HIV patient care in various districts in the country. He said SEAD’s role was to capacitate clinical facilities and support the Department of Health to achieve the “90-90-90” HIV targets.

He confirmed that the work was done according to a contract and was providing the services for more than a decade, but had only been receiving the patient data since about 2017.

“SEAD works on multiple three- to five-year grant cycles, working within consortia to support direct patient care. Budgets are determined on a yearly basis by donors,” he said. But Tucker insisted:, “There is no financial transaction to obtain data. SEAD does not have any privileged access to this data. Many organisations within SA receive data from the NHLS, as part of the DOH ‘treatment network’ supporting patient care.”

(Edited by Shimoney Regter)