Travelling overseas and want to access your patient’s records?

If you (the doctor) or your practice manager are planning to access your patient database, whether for the purpose of doing month end billing, or in order to look up patient records for the purpose of providing continuity of care while you are out the country, you need to notify CGM at least a week in advance so that CGM will be able to prepare to grant you access from abroad.

Before you do access your patient database from abroad consider the following factors: In terms of POPIA, special personal information (which includes a person’s health information) should not be transported outside the borders of South Africa without their express, informed, prior consent, unless there are exceptional circumstances, due to the risk of their data being intercepted by bad actors.

The country you are travelling to might not have as strict privacy protections as South Africa. Also, depending on where you will be accessing the database (in an airport lounge/public café/Airbnb/guesthouse/hotel/relative’s home) there may be different levels of threat from using available free wi-fi.

If you are going to be in one location for a while, the best option is to set up a secure Virtual Personal Network (VPN). Next best in safety would be an ordinary domestic address (of a relative or friend). At the bottom end of the safety scale is moving between different guesthouses (for example, whilst island hopping in Greece), where you might encounter one of the criminals that make their living from hacking into the computers of fellow guests. You will need to provide CGM with your name, practice number, your travel dates and destinations, and then if you are going to move location during your trip, CGM will need to open access for you at each new location.

Please consider whether it is absolutely necessary for you to access the database during your trip, taking the degree of risk into consideration. CGM will ask you to sign an indemnity form before it opens access for you. In the indemnity you acknowledge that you understand the danger of accessing your patient database from abroad, you take responsibility for informing your patients if you transfer their information out of South Africa, and indemnify CGM from responsibility in the event that any data breach occurs as a result of your action.

The best option of all is to rather have a proper holiday, and only access your patient database when you come back.