Find all the answers
Q: What are the Protection of Personal Information (POPI) Act compliance requirements for health practices?
Example: “I am a surgeon, working as a solo practitioner, my practice is not a busy practice. I have three employees that have been working for me for the past eleven years, none of my employees are health professionals. Do I also have to comply with POPI Act requirements?”
Healthcare practices operating as sole practitioner practices, incorporated practices and group practices are all required to comply with the POPI Act. The Act is meant to protect personal information. Justification for POPI Act is because personal information is a personal asset. Health practices process sensitive personal information irrespective of the size of the practice. POPI Act is there to ensure confidentiality of personal information, security of personal information and to discourage unwarranted sharing and/or destruction of the information. There is another law that promotes access to information and that is Promotion of Access to Information Act (PAIA). POPI Act and PAIA are two sides of the same coin. These two laws are governed by the Information Regulator whose mandate is to enforce compliance to these laws.
For more information please click here.
Q: What to do when a patient requests personal information to be destroyed?
Example: “A patient has requested that I destroy her personal information related to a medical condition she was treated three years ago. The reason for her request is that she feels embarrassed about the condition and wants it to ‘disappear from the face of the earth.’ The patient further stated that POPIA grants her the right to make the request. How do I respond to this request? ”
We suggest that the response to such a request should consider both the patient anxiety and the legal requirements regarding the retention of personal information. The patient has a genuine concern regarding her personal medical information that she feels embarrassed about. Firstly, you need to understand what are the patient’s anxieties, why is she embarrassed? Give the patient reassurance regarding the ethical principle of confidentiality.
The second part to the conversation must involve discussing the similarities and differences between personal information, that makes up a health record, as defined by the HPCSA, and personal information as defined by POPIA. The discussion is then followed by the reasons for keeping health records and under what conditions can health records be destroyed.
HPCSA and POPIA definitions
A health record is defined as any relevant record made by a healthcare practitioner at the time of or after a consultation and/or examination. A health record contains the information about the health of an identifiable individual recorded by a healthcare professional. A health record includes, handwritten notes, notes taken by previous practitioners, referral letters, laboratory, radiology, medicolegal, insurance reports, etc.
General personal information is defined as information relating to an identifiable, living, natural person and where applicable, an identifiable, existing, juristic person. Personal information includes, full contact details, identity number, medical aid number, tax number, bank account details.
Special personal information includes health or sex life or any other biometric information, race, ethnicity, religious beliefs, etc.
POPIA categorises patient health records under ‘special personal information’ this implies that all health records are personal information. Health practices process both general and special personal information for their operational needs.
When a patient requests deletion of his/her personal information from the practice, health practitioners need to first determine which type of information was processed and which does the patient want deleted.
If the request includes destroying information that is also deemed a health record, HPCSA guidelines should be taken into consideration.
Collection and retention of personal information:
- To further the diagnosis or for ongoing clinical management of the patient.
- As direct evidence in litigation or for occupational disease or injury compensation purposes.
- To make case reviews possible.
- To promote good clinical and laboratory practices.
- To promote teaching and research.
- For a specific, explicitly defined and lawful purpose related to a function or activity of the collecting party.
- Retention must not be longer than is necessary for achieving the purpose for which the information was collected.
POPIA’s reasons for collecting and retaining personal information are context specific, whereas HPCSA reasons are prescribed.
Health practices collect patient personal information for specific purposes. It is therefore imperative that health practices inform patients of the reasons why they are collecting their personal information and inform them of the conditions under which the information can be destroyed.
In the era of POPIA, it is advisable that practices must implement a POPIA informed consent form, which outlines the reasons for collecting personal information, how the information will be used, stored and the limitations for destroying the collected information.
Duration for retention of personal information/health records
- Must be retained for a period of not less than six years from the date they became dormant.
- Obstetric records must be retained until the child is 21 years the same applies to records for minors.
- Occupational Health and Safety records must be retained for a period of 20 years after treatment has ended.
- Some records may need to be kept for longer periods depending on the patient condition, for example, occupational lung diseases such as, asbestosis may take longer to manifest and therefore such records may need to be kept for a longer period.
– Retention must not be longer than is necessary for achieving the purpose for which the information was collected.
– Personal information can be retained for longer if:
- retention is required or authorised by law
- retention is required by a contract between the parties
- the information is required for lawful purposes related to the activities of the party that has processed the personal information.
A patient requesting her medical information to be destroyed, using a POPIA reasoning will have to be informed about the HPCSA and Occupation Health and Safety Act legal requirements and if these requirements are also met, then the information can be destroyed.
- It is advisable that health practices must develop and implement a POPIA patient consent form that provides details for processing personal information, including access, retention, and disposal of records.
Practices need to maintain a balance between the right to access to information and the right to privacy of information by ensuring compliance with the statutory requirements of POPIA and HPCSA’s ethical guidelines.
Q: Can I consult patients remotely during the COVID-19 pandemic?
Example: “I am a paediatrician with a special interest in developmental paediatrics. I have patients with developmental disorders on chronic treatment that I see on a regular basis. In the context of COVID-19 can I consult these patients remotely?”
Considering patient and personal safety in the face of the evolving COVID-19 pandemic, many practitioners are considering virtual consultations as an avenue for the provision of their professional services. To assist practitioners in their decision whether and how to implement, the following points may be helpful:
What qualifies as a remote consultation?
The HPCSA classifies remote consultations as telemedicine, which is defined as “the practice of medicine using electronic communications, information technology or other electronic means between a healthcare practitioner in one location and a healthcare practitioner in another location for the purpose of facilitating, improving and enhancing clinical, educational and scientific healthcare and research”. Technologies that can be used in remote consultations include telephones, emails, text messaging and video conferencing amongst others.
Is there guidance from the HPCSA on remote patient-doctor consultations?
In view of the national state of disaster and the need for social distancing and self-isolation, the HPCSA has recently released a telemedicine guideline that is applicable during the COVID-19 pandemic and where telemedicine has been replaced with telehealth which includes amongst others, telemedicine, telepsychology, telepsychiatry and telerehabilitation. It states as follows:
- Telehealth should preferably be practiced in circumstances where there is already an established practitioner-patient relationship. Where such relationship does not exist, practitioners may still consult using telehealth provided that such consultations are done in the best clinical interest of patients.
- Although practitioners may charge fees for consultations undertaken through telehealth platforms, the Council strongly cautions against practices that may amount to over-servicing, perverse incentives and supersession.
- Where practitioners are in doubt whether a telehealth consultation will be in the best interest of the patient, they are encouraged to advise patients to present themselves for a face-to-face consultation to seek assistance at a health care facility closest to them.
Do Constantia’s professional indemnity policies provide cover for remote consultations?
There are no exclusions in our policies that would limit our obligations to defend and protect you in relation to potential liabilities that may arise from remote consultations. If you are insured with us, you are covered within your benefit limits.
What do our medico-legal advisors say?
Our medico-legal team proposes that practitioners consider the following in terms of remote consultations during the COVID-19 pandemic:
- Define your reasons for conducting remote consultations within your specific practice and structure your approach around these. For example, you may want to focus on keeping chronic patients who are vulnerable in terms of increased morbidity and mortality should they become infected at home; or you may wish to triage every patient prior to deciding whether a physical examination is required.
- Adhere as closely as possible to all other HPCSA ethical principles during remote consultations like the need for privacy, confidentiality, informed consent and record keeping and the requirements relating to these.
- It is advisable that before consulting patients remotely, the patient’s identity is verified. Where relevant,
- the patient must be informed of the reasons for remote consults;
- the patient must be advised of the associated risks and limitations of such consultations;
- the information provided should include your billing policies in this regard;
- the patient must at a minimum give verbal consent that is documented.
- Record the technology used over and above the clinical records that must be kept. Unless you are consulting patients well-known to you for purposes of routine follow-up, technologies where you can see the patient should be used.
- If you are contacted by a patient, assess the patient’s history and weigh up whether you can assess the patient adequately remotely. Always be aware of the limits of what you can achieve via the phone or video link if you are unable, for example, to check a patient’s blood pressure or temperature (and they cannot reliably do this remotely). Where you have doubts, advise the patient of the most appropriate route to seek further medical assistance.
- If you are in self-isolation, you also need to be mindful of the limitations of the advice you can provide without immediate access to the patient’s medical records. You will need to consider whether a physical examination is necessary and have a plan in place for referral of the patient. This may be to a colleague in your practice if they are available to see the patient, the local hospital if appropriate or to another practice in the area if your practice is closed or the doctors cannot see additional patients.
- Use appropriate government prescribed referral pathways to refer patients that may call you and are exhibiting COVID-19 symptoms.
- HPCSA guidelines have recently been expanded to make provision for remote consultations between patients and doctors during the COVID-pandemic. We have summarized these changes in this document for your convenience so that you can readily familiarize yourself with the regulator’s position.
- Irrespective of the approach doctors choose in terms of remote consultations during the pandemic to assist patients in South Africa, our professional indemnity policies will respond to defend the practitioner’s actions in the event of a future complaint.
- The more considered a doctor is in the implementation of virtual consultations during this national state of disaster, the more likely future HPCSA and other complaints may be defended successfully, should these arise. We trust that doctors will proceed responsibly and with wisdom in this regard.
Q: Will I be indemnified if I assist during the COVID-19 pandemic, even if I step outside of my usual scope of practice or insurance category?
Examples: “I am a paediatric surgeon. Due to the influx of Covid-19 patients and shortage of doctors, my hospital may call on me when all the physicians and anaesthetists are overwhelmed, to assist with the physical work of intubating, ventilating, proning, putting in lines, getting bloods done, watching for deterioration and general ICU care. I am worried that because I will be looking after sick adult patients, I may not be covered by my professional indemnity insurance policy.”
“I am a gynaecologist and not insured for purposes of providing care to pregnant women after 24 weeks gestation. Given the pandemic, what is your position should my obstetric colleagues become ill and patients need to be delivered – would I be able to step up, given the extraordinary circumstances?”
“It may become necessary for me to assist with the care of State patients in my hospital. Am I covered for this?”
To answer the question, there are some important considerations:
- What does the HPCSA state about scope of practice limitations?
In terms of the HPCSA Ethical Guidelines, your obligation to only act within your registered scope of practice falls away during an emergency. This means that the usual ‘scope of practice’ restrictions do not apply where you render emergency services during the COVID-19 pandemic.
- What does your policy state?
Your indemnity policy makes provision for indemnity cover where you step out of your usual scope of practice to assist in an emergency in the context of a Good Samaritan Act, where emergency care is provided voluntarily and without reasonable expectation of compensation or reward.
- What additional factors should be considered?
Whilst many practitioners will be performing Good Samaritan Acts during South Africa’s National State of Disaster due to the COVID-19 pandemic, there may also be scenarios where those in private practice may bill for some of the services rendered outside of their usual scope of work and/or insurance category. This would not typically qualify for benefits. Furthermore, essential services are not synonymous with emergencies, and as such would not typically qualify for cover if provided out-of-scope of practice and/or insurance category.
- Is EthiQal extending cover relating to emergencies and essential services during the pandemic?
To support the continuation of emergency care and essential services that cannot be delayed, and ensure that our practitioners are protected, we have extended our indemnity cover relating to these services during the COVID-19 pandemic until further notice. Where doctors with an EthiQal policy provide emergency care and essential services in private facilities, they are eligible for cover, even where such work falls outside of their usual scope of practice and/or insurance category, and irrespective of whether they bill for the work performed, as long as the need to step outside of their usual scope of practice is mandated by the circumstances of the COVID-19 pandemic and the urgency of the clinical situation.
- Is EthiQal extending cover for treating State patients in private facilities?
Due to the high number of hospitalisations for coronavirus infections in South Africa, the government has been seeking assistance from private facilities and practitioners with the care of State COVID-19 patients in private facilities. Should you enter into any such agreement with the State, we have extended our indemnity cover for the care of State COVID-19 patients in private facilities, subject to you first informing us and sharing the State contract. This will help us to understand our exposure in terms of these contracts and help mitigate your and our risk exposure. You can do so via your broker or client relationship consultant, or submit a copy of the contract directly to email@example.com. Our medico-legal advisors are also available to assist with any queries you may have.
- What is the cover for treating State patients in State facilities?
For work performed in State facilities, cover remains limited to services provided in the true sense of a Good Samaritan Act, as well as the support with disciplinary proceedings by the HPCSA, criminal prosecutions and inquest proceedings.
- Good Samaritans Acts are covered by your policy, subject to benefit limits and irrespective of your scope of practice or insurance category.
- Whereas urgent essential services, which are different to emergencies, are typically excluded from cover if performed outside of a practitioner’s usual scope of practice, we have made special provision for these to also be eligible for policy cover during the COVID-19 pandemic until further notice, for patients cared for in the private sector and where the need for a practitioner to step outside of his or her usual scope of practice is as a result of the COVID-19 pandemic.
- Cover is furthermore extended to emergency care and essential services that cannot be delayed, under conditions stipulated above, where a doctor bills for these.
- Where you are a private practitioner and expect to render any form of care to public sector patients treated in government facilities, you are urged to request written confirmation of indemnity cover from the relevant State authorities to ensure full indemnity cover in the event of a claim. Where you plan to enter into contracts with government for the treatment of State patients in private facilities, make sure to share such contracts with the insurer.
- Whether you can and should assist in urgent situations depends on your own skills and safety, and the impact on other patients under your care. Do not provide services outside of your usual scope of practice where you feel insecure about your skillset or capacity to the extent that potential harms may outweigh any benefits. When in doubt regarding your ethical obligations in such situations, consult the HPCSA’s Ethical and Professional Rules Booklet (Booklet 2), reading Rule 21 in conjunction with Rule 27A in this context. HPCSA guidelines limit out-of-scope practice to emergencies.
- If you are unsure about the extent of your cover, or your potential compliance with HPCSA Ethical Guidelines, our team is on standby to assist. You can contact us at firstname.lastname@example.org or phone us on (011) 686 4370.
Q: What is occurrence-based vs Claims-Made professional indemnity cover?
With occurrence-based cover, you are protected for claims that result from any incident that occurs whilst being a policyholder, irrespective of when the claim is made and includes the time after a policy has been cancelled.
This contrasts with claims-made cover where protection is only offered for incidents reported to the insurer whilst premiums are being paid (i.e. it provides protection for incidents that both occur and are reported during the policy period, regardless of when a claim is received). Depending on the retroactive date of the policy in force, it may also include claims that relate to adverse incidents that occurred prior to the claims-made policy being issued and of which the doctor was unaware at the time of taking out the policy.
Q: What happens to past incidents and claims when i switch to Ethiqal?
If you currently have occurrence-based cover, your previous insurer or protection society will continue to indemnify you for claims resulting from adverse incidents that occurred during the period of your insurance or membership, in line with the benefits associated with your cover.
If you currently have claims-made cover, all matters notified to your previous insurer or protection society during the period of your insurance or membership will still be covered by them irrespective of when a claim is made, in line with the benefits associated with your cover.
It is important that you consult your broker to ensure that there is no gap in protection when you switch your indemnity cover.
Q: How will Ethiqal support me when i am confronted with a legal threat?
As a first line of defence, EthiQal, through its own in-house team of medical and legal professionals, will work closely with you to assess your situation and provide you with appropriate assistance and support. In addition, EthiQal will employ the services of specialist lawyers who are best equipped to deal with your claim or circumstance.
EthiQal has contracts with several legal firms that have specialist medical law practices devoted to the defence of medical cases. In the category of dispute resolution, all are recognised leaders. Each has its own established track record of excellence in the field of medical litigation, having successfully defended healthcare professionals, hospitals and other medical services providers in civil actions for damages.
Q: Does VAT apply to my premium?
EthiQal’s premiums are inclusive of VAT. If you are a registered VAT vendor, the input VAT can be claimed from SARS. Your certificate of insurance serves as a tax certificate in this regard. It is important that your financial advisor includes details relating to VAT implications in any professional indemnity product comparisons that are presented to you.
Q: How do we know that Ethiqal will be around in the future?
EthiQal is a Division of Constantia Insurance Company Limited, part of Constantia Risk and Insurance Holdings (Pty) Ltd, which is more than 65-year-old insurer licensed as a Financial Services Provider. Constantia is a company that is proud of its heritage and the contribution it has made to the South African insurance market over the past six decades. Our 100% shareholder is Conduit Capital, who is listed on the JSE and has significant financial backing to ensure our sustainability.
As a Division of Constantia, EthiQal operates in a highly regulated market under the jurisdiction of the Financial Sector Conduct Authority. Prescribed amounts of premium are allocated towards building substantial insurance reserves for defending future claims and a mandatory solvency report is submitted for review by the Regulator on a monthly basis. This is similar to the medical aid industry where the Council for Medical Schemes monitors the reserves of medical aid schemes and implements corrective actions in the event of a scheme’s solvency being threatened. All these measures are in place to ensure the financial sustainability of EthiQal so that you, as a policyholder, are protected, now and in the future.
Q: What is the difference between a short-term insurer and a Mutual organisation that provides professional indemnity cover?
Short-term insurers and mutual organisation are not mutually exclusive
A short-term insurer is a company licensed to do business in terms of the Company’s Act 2008 and registered as a financial services provider (FSP) in terms of the FAIS Act, 37 of 2002, its Codes of Conduct and Board Notices. The short-term insurer underwrites policies in a manner that is compliant with the Short-Term Insurance Act, 53 of 1998. In doing so, the short-term insurer complies with market conduct and policyholder protection requirements implemented to protect the rights of you, the policyholder. Should you, for any reason, be unhappy with the service we have provided, you have recourse via the Ombudsman for Short-Term Insurance. The OSTI provide the insuring public and the short-term industry with a free, efficient and fair dispute resolution mechanism through an alternative dispute resolution process, applying the law and principles of fairness and equity.
A mutual is an organisation that is owned collectively by its members who are also its customers. For policyholders to enjoy the same legal protection as above, the mutual must be registered as a FSP.
It is thus important that policyholders obtain proof of FSP registration when purchasing professional indemnity cover.