Who Can See Your Medical Records? Your Rights as a Patient

You've moved to a new area and found a new dentist. They ask for your old X-rays. Can your previous practice refuse? Or you're off sick, and your manager wants to know exactly what's wrong. Do you have to tell them?

Your medical records hold some of the most personal information about you. South African law gives you real control over who sees them and how they're used. Most patients just don't know what those rights are.

This guide explains, in plain language, who can see your records, what rights you have, and what to do if something goes wrong.

Who can legitimately see your records

The starting rule is simple: your health information is confidential. The National Health Act says it may be disclosed only with your consent, under a court order or law, or where keeping it secret would seriously threaten public health. POPIA adds that health information is "special personal information", which may only be processed on specific grounds.

In practice, these people can usually see some or all of your records:

• The practitioners treating you. Your doctor, dentist and the clinical team caring for you need your history to treat you safely.
• Practice staff, on a need-to-know basis. Reception needs your contact and billing details, not your full clinical notes. A well-run practice limits access by role.
• Your medical scheme. To process claims and pre-authorisations, your scheme receives diagnosis codes and treatment details. It may only use them for those purposes.
• Other practitioners you're referred to, for the purpose of your treatment.

Everyone else needs your consent or a clear legal basis. That includes your employer, your family, a lawyer and a life insurer. Even a request from a lawyer should only be answered once the practice has confirmed your consent (Medical Protection).

Your rights, in plain language

POPIA gives you, as a "data subject", a set of rights over your personal information. For patients, five matter most.

1. The right to know. When a practice collects your information, it must tell you what it's collecting, why, and who it may share it with. This is usually in the privacy notice or intake form.
2. The right to access. You can ask a practice what information it holds about you and ask for a copy. Formal requests to a private practice go through the PAIA process, usually on Form 2 to the practice's Information Officer. You generally don't pay a request fee when asking for your own personal information, though copying costs may apply (SARS on PAIA).
3. The right to correct. If your records contain wrong information, such as an incorrect allergy, medication or contact detail, you can ask for it to be corrected. Clinical notes aren't deleted; corrections are added so the history stays intact.
4. The right to object. You can object to some uses of your information, especially direct marketing. A practice can't send you promotional messages unless you've agreed.
5. The right to be told about a breach. If your information is accessed or stolen without authorisation, the practice must notify you and the Information Regulator as soon as reasonably possible.

Tip

Your practice's software provider can't hand your records over to you directly. It holds them on the practice's behalf, so your request always goes to the practice (Netpractice PAIA manual).

Consent: what you're actually agreeing to

Most patients sign the intake form without reading it. It's worth a minute, because it usually covers more than treatment. A typical form asks you to agree to:

• Your information being used to treat you
• Your details being sent to your medical scheme for claims
• Reminders by SMS, email or WhatsApp
• Sometimes, marketing messages or newsletters

The first two are part of being treated and paid for. The last two are optional, and you can say no. You can also withdraw consent you've given before, for example by asking the practice to stop sending marketing messages.

Withdrawing consent doesn't erase your clinical record. Practices must keep records for legal and safety reasons, so your history stays on file even if you leave.

Switching practices: what happens to your records?

When you move to a new doctor or dentist, your old practice keeps the original record. That's normal: it needs the record to show what care it gave. But you are entitled to the information in it.

You have two options:

• Ask for a copy for yourself, using the access right above.
• Ask your old practice to send relevant records to your new one, such as X-rays, treatment history and allergies. Put this in writing and give your consent clearly.

How long practices must keep your records

The HPCSA's guidelines on keeping patient records set minimum retention periods (Medical Protection):

So if you need old records, even years later, there's a good chance they still exist. After these periods, the practice may destroy them, and it must do so securely.

Your employer and your health information

Your employer needs to know you were unfit to work. It doesn't automatically need to know why. A sick note confirms you were unfit for work on certain days; under HPCSA rules, the diagnosis appears only if you agree to it.

Since March 2026, new POPIA regulations apply specifically to how employers handle health information, including sick notes, medical certificates and medical records from employees (GoLegal). Employers may process that information only on a lawful ground, most commonly your consent, a legal obligation such as labour law, or administering health-related benefits (ITWeb).

They must also protect it: stored securely, seen only by those who need it, and destroyed properly when no longer needed.

If your manager asks for more detail than you're comfortable sharing, you can politely decline and offer a sick note that confirms you were unfit to work.

Questions to ask your practice

A good practice will be happy to answer these. If it can't, that tells you something too.

1. Where are my records stored? On paper, on a computer in the practice, or in a secure cloud system? Is the data kept in South Africa?
2. Who can see my clinical notes? Is access limited by role?
3. How do you share my information with specialists, labs or my scheme? Look for secure systems, not personal WhatsApp or email.
4. Who is your Information Officer? Every practice must have one, and they handle privacy requests and complaints.
5. What happens if there's a data breach? Will you tell me, and how quickly?
6. How do I get a copy of my records? Is there a form, and what will it cost?

You don't need to be confrontational. Asking calmly signals that you care about your privacy, and good practices welcome that.

If something goes wrong: where to complain

If you think your information has been mishandled, take it step by step.

1. Start with the practice's Information Officer. Explain what happened in writing and ask for a response. Many issues are resolved here.
2. Complain to the Information Regulator. If the practice doesn't respond or you're not satisfied, you can lodge a complaint with the Information Regulator, which enforces POPIA and PAIA.
3. Report professional misconduct to the HPCSA. If a doctor or dentist breached confidentiality, you can also complain to the Health Professions Council of South Africa, which handles professional conduct.
4. Raise scheme issues with the Council for Medical Schemes. If the problem lies with your medical scheme rather than the practice.

Keep copies of everything: emails, letters, dates and names. A clear paper trail makes any complaint much stronger.

The bottom line

Your medical records belong in the hands of the people caring for you, and nobody else without your say. You have the right to know what's held, to see it, to correct it, and to be told if it's ever exposed.

The best protection is a practice that takes privacy seriously. Next time you visit, ask a question or two. A practice that uses secure systems and answers openly is one you can trust with your health.

Share this guide with someone who needs it.

This article is general information, not legal advice.

Sources

• Medical Protection: Medicolegal matters in healthcare practice (RSA)
• Medical Protection: Retention of medical records (SA)
• SARS: Promotion of Access to Information Act
• Netpractice: PAIA Manual
• GoLegal / Eversheds Sutherland: New POPIA Regulations – Processing of health information
• ITWeb: POPIA health regulations – what every employer must know
• Information Regulator