Ghanaian clinic stored patient records on an unassessed system before regulator intervened
I spend part of my week in a laboratory and part of it behind a news desk. On the laboratory side, I sign out results. A full blood count. A fasting glucose. A hepatitis B surface antigen that will change how a patient is treated for the rest of their life. The moment I release that result, it stops being a piece of paper. It becomes a row in a database. It travels. It is stored somewhere, by…
Ghana's Data Protection Commission has shifted from merely persuading to enforcing data protection regulations. During an inspection, the Commission found that a clinic had not appointed a Data Protection Supervisor, owed unpaid fees, and lacked adequate measures to protect personal information. Moreover, the clinic had never conducted a privacy impact assessment of the electronic system where it stored patients' records.
The clinic was ordered to provide a statement to the police, while two hospitals with expired data protection certificates were also visited. A microfinance company was referred to CID headquarters for lapsed registration and incomplete compliance. Data Protection Commission's Executive Director, Dr Arnold Kavaarpuo, stated that education and persuasion alone can no longer be relied upon, as the aim is now compliance rather than punishment.
A total of 2,575 data controller registrations were recorded in 2026, but these do not guarantee compliance. Inspections will continue into 2027, including religious institutions and the media, as one inspection cannot fully determine the extent of the problem.
Written by urgent.news from MyJoyOnline Ghana's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
