Ghana's Health Data Crisis: Clinic Stored Patient Records Without Safeguards, Triggering Regulator Crackdown

Ghana's Data Protection Commission has shifted from education to enforcement, with a recent inspection uncovering alarming gaps in how one clinic—and potentially many others—handles sensitive patient medical records. The discovery raises urgent questions about the security of health information across the country's healthcare system, at a time when Ghana's digital health infrastructure is already facing significant challenges.

On 12 October, Commission inspectors visited a clinic and found it operating without fundamental data protection safeguards. The clinic had not appointed a Data Protection Supervisor, had unpaid registration fees dating back to January 2025, and critically, had never conducted a privacy impact assessment of the electronic system storing patient records. The organisation's technical and administrative measures to protect personal information were deemed inadequate, prompting a referral to police. Two hospitals were also found with expired data protection certificates, while a microfinance company was referred to the Criminal Investigations Department over lapsed registration.

Why this matters for Ghana

These findings expose a troubling gap between legal requirements and reality on the ground. Under the Data Protection Act 2012 (Act 843), any organisation that collects and stores personal data—including hospitals, clinics, laboratories, and CHPS compounds—must register with the Commission before processing data and renew registration every two years. Hospitals and clinics are defined as data controllers precisely because they decide what patient information to collect and how to use it.

The clinic's violation was not isolated negligence. It reveals a systemic problem: nobody appears to have been checking whether these fundamental protections existed. The Commission has recorded 2,575 data controller registrations in 2026, but registration is only a starting point—actual compliance is another matter entirely. Without regular inspections and enforcement, registration becomes meaningless paperwork.

For Ghanaians, this means the sensitive health information submitted during clinic visits—test results, diagnoses, medication histories, even HIV status—may be stored on unvetted systems with inadequate locks, managed by staff with no formal data protection training, and potentially accessible to anyone with database access. Patients are rarely informed where their data travels after leaving the clinic or who can see it.

A Year of Disruption in Ghana's Health Systems

This enforcement action arrives amid Ghana's worst year for health information systems disruption. The Lightwave Health Information Management System (LHIMS), introduced nationally in 2017, was meant to modernise healthcare data management. The government signed a US$100 million contract in 2019 to connect 950 health facilities across the country. However, the Minister of Health revealed in October 2025 that by contract expiry in December 2024, only 450 facilities had been connected—less than half the target. Over US$77 million had been spent, representing more than 70 per cent of the contract value.

This backdrop makes the clinic inspection more significant. While the government invested heavily in connecting facilities to a national system, fundamental data protection compliance in healthcare organisations remained unmonitored. A facility could be using LHIMS but still lack a Data Protection Supervisor or have never assessed the privacy risks of its systems.

Enforcement Over Persuasion

Dr Arnold Kavaarpuo, the Commission's Executive Director, has acknowledged that 14 years after Act 843 passed, education and persuasion have failed to achieve compliance. The Commission is now moving toward active enforcement, with inspections set to continue into 2027 and expand to religious institutions and media organisations.

Violations carry real penalties: processing personal data without required registration can result in fines of up to 250 penalty units, imprisonment of up to two years, or both. Yet many organisations remain unaware of these requirements or have delayed compliance indefinitely.

For Ghana's health sector, the message is clear: maintaining patient records without proper data protection safeguards is no longer simply bad practice—it is now subject to regulatory enforcement and potential criminal liability.