Privacy & personal information

When you or your child are under the care of this practice, we hold personal and clinical information so that we can treat you safely and run the rooms properly. South Africa’s Protection of Personal Information Act (POPIA) sets out how that information must be handled. This page explains, in plain language, what we collect, why we use it, who we share it with, how we keep it safe (including electronic devices and paper files), how long we keep it, and the rights you have.

This notice applies only to the neurosurgery practice of Professor Jason John Labuschagne. Other healthcare providers involved in your care — for example hospitals, anaesthetists, laboratories, radiology practices and medical aids — are separate responsible parties and handle information under their own arrangements.

Introduction

As a specialist neurosurgical practice we are both a collator and a custodian of sensitive information. That includes identity and contact details, clinical history, imaging and reports, and administrative and billing records. We regard the fair, lawful and secure handling of that information as both a legal duty and a professional obligation.

In particular, we aim to:

• obtain and process information fairly and for clear, lawful purposes related to your care and the running of the practice;
• use information only in ways that are compatible with those purposes;
• keep information accurate, up to date where necessary, confidential and secure;
• retain information no longer than is needed for clinical, professional, legal or accounting reasons; and
• provide you, on request and subject to POPIA, with information about what we hold and with copies where the Act allows.

POPIA strengthens the constitutional right to privacy. Personal information must be processed lawfully and in a manner that does not unreasonably infringe the privacy of the person to whom it relates (the data subject).

Key definitions

For the purposes of this notice (aligned with section 1 of POPIA):

• Data subject — the person to whom the personal information relates. For a child patient, that includes the child and, where relevant, the parent or caregiver whose details we hold.
• Responsible party — the person or practice that determines the purpose of, and means for, processing personal information. For information held by these rooms, that is this practice.
• Operator — a person who processes personal information for a responsible party in terms of a contract or mandate, without coming under the direct authority of that party (for example a billing bureau or IT support provider, if used).
• Personal information — information relating to an identifiable living person. It is a broad concept and can include, among other things: race, gender, sex, pregnancy, marital status, nationality, ethnic or social origin, sexual orientation, age; physical or mental health, disability, medical history, blood type and biometric information; religion, belief, culture and language; education, medical, financial, criminal or employment history; identity number, email address, physical address and telephone number; personal opinions or preferences; and private or confidential correspondence.
• Special personal information — categories that POPIA treats with particular care, including health or sex life, biometric information, religious or philosophical beliefs, race or ethnic origin, trade-union membership, and criminal behaviour (in certain contexts).
• Process / processing — any operation concerning personal information, including collection, receipt, recording, organisation, collation, storage, updating, modification, retrieval, alteration, consultation, use, dissemination, distribution, merging, linking, restriction, erasure or destruction.

Who is responsible · Information Officer

The responsible party for personal information held by this practice is:

• Professor Jason John Labuschagne
  HPCSA registration: MP 0530077
  Practice number (BHF): 0264156
  Room 403, Netcare Unitas Hospital, 866 Clifton Avenue, Lyttelton Manor, Centurion
  Also consulting and operating at Nelson Mandela Children’s Hospital, Parktown, Johannesburg

POPIA requires a responsible party to appoint an Information Officer (and, where appropriate, a Deputy). The Information Officer’s duties include encouraging compliance within the practice, dealing with requests under the Act, working with the Information Regulator when needed, and ensuring that the practice’s overall approach to POPIA is followed.

Information Officer: Professor Jason John Labuschagne
Deputy Information Officer: Mrs S P E Labuschagne
Email for privacy / access requests: reception.jjlab@gmail.com

Why we process information

We process personal information only for purposes that are necessary for your care, for the safe administration of the practice, or for a legal or professional duty. Those purposes include:

• identifying you (or your child) and opening and maintaining a clinical record;
• providing neurosurgical assessment, treatment, surgery and follow-up;
• communicating with you about appointments, results, admissions and aftercare;
• sharing relevant clinical information with other healthcare providers who are involved in the same episode of care;
• obtaining authorisations and submitting accounts to medical schemes, and managing practice billing and accounting;
• meeting obligations under HPCSA ethical rules, hospital policies, professional guidelines and applicable law (including record-keeping requirements);
• defending or establishing legal claims where necessary; and
• improving the quality and safety of care (for example morbidity review), using information in a way that does not identify you where that is practicable.

We do not sell personal information. We do not use it for marketing that is unrelated to your care, and we do not pass it to third parties for their own marketing.

Categories of information we hold

Depending on the care we provide, the practice may hold:

• Identity and contact details — name, date of birth, identity or passport number, address, telephone numbers, email address; for children, the same for parents or legal caregivers, and the relationship to the child.
• Clinical information — history, examination findings, diagnoses, operation notes, prescriptions, nursing and therapy notes that form part of our record, correspondence with other clinicians, and copies of imaging reports and pathology results that we receive or generate.
• Images and investigations — MRI, CT and other imaging (or references to them), neurophysiology and laboratory results relevant to your care.
• Consent and discussion records — signed consent forms, records of discussions about risks, benefits and alternatives, and related correspondence.
• Administrative and billing information — medical scheme membership numbers, authorisation references, invoices, payments, and related account correspondence.
• Referral information — referral letters and supporting documents from other doctors.
• Website technical data — limited technical information generated when you use this website (see This website and cookies).

We ask only for information that is reasonably necessary for these purposes. You may choose not to provide certain details; where that information is needed for safe care or for billing, we will explain the consequences.

Special personal information, health and children

Much of what a neurosurgical practice holds is special personal information under POPIA — in particular health information, and sometimes biometric or genetic information derived from investigations. We process that information because it is necessary for medical treatment, with appropriate consent where the Act requires it, and in line with our professional duties of confidentiality.

We also treat information about children with particular care. Where the patient is a minor, we usually collect information from a parent or caregiver who has the legal capacity to consent to treatment and to the related processing of information. We limit children’s information to what is needed for care and administration, and we do not publish identifiable information about child patients on this website.

We do not routinely collect information about religious belief, political affiliation or similar categories unless you volunteer it and it is relevant to your care (for example a belief that affects blood transfusion decisions). Where such information is recorded, it is handled as special personal information.

Consent and other lawful grounds

POPIA allows personal information to be processed on several grounds. In this practice, processing typically rests on one or more of the following:

• Consent — for example when you (or a parent/caregiver) complete registration forms, sign a consent for a procedure, or agree to a particular disclosure.
• Contract / mandate — processing that is necessary to provide the care you have asked us to provide, and to manage the related account.
• Legal obligation — for example keeping clinical records for the periods required by professional rules, or responding to a lawful request from a regulator or court.
• Legitimate interest / proper performance of a public-law duty — where applicable, balanced against your rights, for the orderly running of the practice and the protection of patients and staff.
• Health treatment — processing of health information that is necessary for your treatment by a healthcare professional who is subject to an obligation of confidentiality.

Where we rely on consent, you may withdraw it. Withdrawal does not affect processing that was lawful before the withdrawal, and it may not be possible to continue certain treatment or administrative steps if the information is still needed for those purposes. We will explain if that applies.

Staff are expected to treat personal information as confidential. As a working rule: if there is any doubt about whether a disclosure is appropriate, the request is referred to the Information Officer rather than answered on the spot.

Where information comes from

We collect information from:

• you, and for children, from parents or caregivers, at consultations and in writing (forms, emails, letters);
• referring and treating doctors, therapists and other healthcare providers involved in your care;
• hospitals and facilities where you are admitted or investigated;
• laboratories, radiology and other diagnostic providers;
• your medical scheme, for authorisation and billing; and
• this website, for limited technical data when you visit it.

We take reasonable steps to ensure that information we hold is accurate and, where necessary, updated. Please tell the rooms if your contact details or medical-scheme details change.

Who we share information with

We share personal information only where it is needed for your care, for the administration of your account, or where the law requires or permits it. Recipients typically include:

• Hospitals and facilities where you are treated (including Netcare Unitas Hospital and Nelson Mandela Children’s Hospital, and any other facility involved in your care);
• Other treating healthcare providers — for example referring doctors, anaesthetists, intensivists, radiologists, pathologists, oncologists, therapists and nursing teams who need relevant clinical information for the same episode of care;
• Laboratories, radiology and allied diagnostic services that perform investigations we request or that send us results;
• Your medical scheme and related administrators, for authorisation, clinical motivation and billing;
• Practice operators who process information for us under contract (for example accounting, billing support or IT service providers), subject to confidentiality and security expectations; and
• Regulators, courts or professional bodies, where we are legally obliged or entitled to disclose information.

Other healthcare providers and schemes are generally responsible parties in their own right for the information they hold. We share only what is reasonably necessary for the purpose, and we expect anyone who processes information for us to keep it confidential and secure.

Before transferring information to a third party who will process it on our behalf, we take reasonable steps to agree what will be shared, for what purpose, how it will be protected, how long it will be kept, and how incidents will be reported.

We do not disclose personal information to unrelated third parties for their own purposes without a lawful basis.

Transfers outside South Africa

Most of our processing takes place in South Africa. Some tools we use (for example email, cloud backup, or website hosting) may involve servers or support staff outside the Republic. Where personal information is transferred outside South Africa, POPIA requires that the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection, or that another ground in section 72 of the Act applies (for example your consent, or a transfer necessary for the performance of a contract).

We take reasonable steps to ensure that any cross-border transfer of practice information meets those requirements. If a particular transfer needs your specific consent, we will ask for it.

How long we keep information

Clinical records are kept for as long as professional guidelines, HPCSA expectations and the law require — often for many years after last contact, and longer where the patient was a child at the time of treatment. Administrative and billing records are kept for as long as needed for accounting, medical-scheme queries, audit and legal purposes (including the periods set by tax and related legislation).

When information is no longer required, it is disposed of securely (for example by shredding paper, or by wiping or destroying electronic media). Access to archived material that is no longer in active use is restricted.

How we keep information safe

POPIA requires appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information, and to prevent unlawful access or processing. In this practice that includes the following, adapted to the size and nature of a specialist consulting practice:

• Need-to-know access — clinical and practice systems are available only to people who need them for their work.
• Physical access — consulting rooms and filing areas are not left open to casual visitors; visitors are not left alone with open files or unlocked screens.
• Passwords — systems that hold personal information are protected by passwords. Passwords should be strong (ideally 12–14 characters, mixing letters, numbers and symbols; not dictionary words, obvious sequences, or personal biographical details). Sharing of passwords is not permitted. Access for staff who leave the practice is removed promptly.
• Device lock and clean desk — computers are locked or logged off when unattended. Paper containing personal information is put away when not in use and is not left on desks overnight.
• Encryption and antivirus — practice computers are expected to run current antivirus / anti-malware protection and, where practicable, disk encryption. Firewalls and related safeguards on practice networks are kept reasonably up to date.
• Backups — electronic records are backed up so that care and administration can continue if a system fails. Backup media or services are protected against unauthorised access.
• Staff awareness — people who work in the rooms are made aware of their confidentiality obligations before they are given access to personal information, and are expected to follow this notice and related practice rules.
• Contractors — temporary staff, locums and contractors who may see personal information are expected to follow confidentiality arrangements consistent with this notice.
• Monitoring — where systems support it, access to clinical or administrative records may be logged so that inappropriate access can be investigated. Staff are made aware that such monitoring may occur.
• Periodic review — the Information Officer reviews, from time to time, where personal information is held, who can access it, and whether safeguards remain adequate.

Laptops, phones and portable storage

Portable devices (laptops, tablets, mobile phones, USB memory sticks and external drives) are convenient and also easy to lose or steal. The practice therefore applies these rules:

• Devices used for practice work must be password-protected (and mobile phones must use a PIN or biometric lock as well as any device login). Default PINs must be changed.
• Personal information should not be stored on portable devices if it can reasonably be kept on a central practice system instead. Where storage on a portable device is unavoidable, the data must be encrypted and the device password-protected. Laptops used for practice work should use full-disk encryption where the hardware and software allow it.
• Practice information should not be copied onto personal USB sticks, personal phones or other personally owned storage unless the Information Officer has authorised that use and encryption is in place.
• Care must be taken when using laptops or phones in public places so that screens and conversations do not disclose personal information to bystanders.
• Only software authorised for practice use should be installed on practice devices. Antivirus, anti-spyware and firewall software must be kept up to date.
• Each portable device used for practice work should be attributable to a named individual who is responsible for looking after it.
• Laptops left in the rooms overnight must be physically secured. Portable devices should not be left in an unattended vehicle; if a staff member is going out after work, the device should be locked away at the rooms rather than left in a car.
• USB and similar media should be used for data transfer only when there is a clear business need, and the media should be encrypted.
• Loss or theft of a device that may contain practice information must be reported to the Information Officer as soon as possible so that access can be revoked and, where feasible, remote wipes considered.

Remote access to practice systems (if used) should take place over a secure, encrypted connection with strong authentication. Personal information accessed remotely should not be downloaded to an uncontrolled personal computer if that can be avoided.

Any wireless network used to reach practice systems must use strong encryption.

Email and electronic transfers

Ordinary, unencrypted email is not a secure channel for highly sensitive clinical information. Staff are expected to take particular care with email:

• Avoid sending special personal information by ordinary email where a more secure option exists (for example a secure messaging facility, encrypted attachment, or hand delivery / collection of records).
• Where email is necessary, use the strongest practical protection available (file encryption, password-protected attachments with the password sent separately, or a secure email service), and double-check the recipient address before sending.
• Do not copy personal information from a secure clinical system into an unsecured personal application in a way that bypasses practice safeguards.
• Transfers of personal information to other organisations should use the most secure practical channel (for example secure upload, encrypted file transfer, or secure email), with a clear record of what was sent, to whom, and why.
• Where a third party will receive personal information, we take reasonable steps to confirm the purpose, the minimum information needed, named contacts, retention, encryption method, acknowledgement on receipt, and how a transfer incident would be reported.

Patients and parents are welcome to email the rooms for appointments and non-urgent administrative matters. Please do not send urgent clinical information by email, and be aware that ordinary email can be intercepted or misdirected. Prefer the telephone for urgent concerns, and emergency services in an emergency.

Paper records

Paper files and printouts remain part of many clinical workflows. For paper that contains personal information:

• access is limited to people with a work reason to see the file;
• files are stored in a secure place when not in use, and are locked away overnight where practicable;
• documents are kept out of sight of visitors to the rooms;
• a simple record of who has drawn a file may be kept where that helps accountability; and
• confidential waste is shredded (or otherwise destroyed securely). Notes and printouts containing personal information are not placed in ordinary refuse.

At the end of the life of computer equipment or storage media that has held personal information, the practice arranges secure wiping or physical destruction rather than ordinary disposal.

Security compromises and breaches

If we become aware of a compromise of personal information (for example loss or theft of a device, a misdirected email containing clinical details, or unauthorised access to a system), we will take steps to contain the incident, assess the risk to affected people, and notify the Information Regulator and, where required by POPIA, the data subjects concerned, as soon as reasonably possible after discovery.

Please report any suspected incident involving this practice’s information to the rooms or to the Information Officer using the contact details below, so that it can be investigated promptly.

Your rights as a data subject

Subject to the limits and procedures in POPIA, you (and a parent or caregiver acting for a child) may:

• ask whether we hold personal information about you (or your child), and request a description of that information and details of the identity of third parties who have, or have had, access to it;
• request access to the personal information we hold;
• request correction of information that is inaccurate, incomplete, misleading, out of date, or obtained unlawfully;
• request deletion or destruction of information, where the Act allows;
• object to processing in the circumstances set out in the Act;
• withdraw consent where processing is based on consent, without affecting the lawfulness of earlier processing; and
• lodge a complaint with the Information Regulator of South Africa.

Some clinical records must be kept for fixed periods under professional and legal rules. We therefore cannot always delete everything on request. If that applies, we will explain why.

We also do not release information in a form that would allow a person to be identified for research or statistical purposes without a lawful basis and, where required, consent or ethics approval.

Objections, correction and deletion

Requests to object to processing, to withdraw consent, or to correct, delete or destroy personal information should be made in writing to the Information Officer (see How to contact us). Please include enough detail for us to identify the record and the change you are asking for.

We will consider the request under POPIA and respond within a reasonable time. If we cannot agree to the request in full, we will say so and explain the reason (for example a legal duty to retain a clinical record).

Unauthorised alteration or disclosure of personal information by staff is treated as a serious matter.

How to request access

Under sections 23 and related provisions of POPIA (and, where applicable, the Promotion of Access to Information Act), you may request confirmation of whether we hold personal information about you and request access to it. Please send access requests to the Information Officer. We may need to verify your identity (and, for a child’s records, your authority to act) before releasing information.

We will respond within the time frames allowed by law. In some cases a prescribed fee may apply for copies; if so, we will tell you before the copies are made.

Complaints · Information Regulator

If you are not satisfied with how we have handled your personal information or a request under this notice, please contact the Information Officer first so that we can try to resolve the matter.

You also have the right to lodge a complaint with the Information Regulator of South Africa:

• Website: inforegulator.org.za
• Email (general enquiries / complaints; check their site for current addresses): enquiries@inforegulator.org.za · POPIAComplaints@inforegulator.org.za

This website and cookies

This website provides general information about the practice. It is not a patient portal and it is not used to collect clinical histories online.

Like most websites, our hosting environment may record ordinary technical logs (for example IP address, browser type, pages visited and time of visit) to operate and secure the site. We do not use those logs to build marketing profiles of patients.

This site embeds Google Maps on the contact page. Google may set its own cookies or similar technologies when that map loads; those are governed by Google’s policies. We do not use marketing or analytics cookies of our own. You can control cookies through your browser settings.

If you use the “request a copy” form on the journal pages, the email address you enter is used only to send that paper (see that form). It is separate from clinical enquiries to the rooms.

Please do not send sensitive clinical information through ordinary website contact forms if a more secure channel is available; use the telephone for urgent matters.

Changes to this notice

We may update this page from time to time to reflect changes in the law, in our systems, or in how the practice is run. The version published on this website is the current notice. Material changes will be reflected here; please check this page periodically if you want to stay informed.

How to contact us

For access requests, corrections, objections or other privacy questions:

• Information Officer: Professor Jason John Labuschagne
• Deputy Information Officer: Mrs S P E Labuschagne
• Email for privacy / access requests: reception.jjlab@gmail.com
• Telephone (rooms): 012 664 6026
• Post / in person: Room 403, Netcare Unitas Hospital, 866 Clifton Avenue, Lyttelton Manor, Centurion

Please mark written requests “Information Officer — POPIA” so that they are routed correctly.

Consent forms Practice FAQ Contact the rooms