Ghana’s Data Protection Commission has moved from persuasion to enforcement. What it found in one clinic raises harder questions about the national systems now holding the country’s medical records.
I spend part of my week in a laboratory and part of it behind a news desk. On the laboratory side, I sign out results. A full blood count. A fasting glucose. A hepatitis B surface antigen that will change how a patient is treated for the rest of their life.
The moment I release that result, it stops being a piece of paper. It becomes a row in a database. It travels. It is stored somewhere, by someone, under terms I have never been shown.
In nine years of laboratory practice, I have rarely seen a patient told where that information goes, who can see it, or what they are entitled to ask about it.
Whether a signature on a consent form was legally required at each of those moments is a genuine question, and the answer is often no. Act 843 recognises several lawful bases for processing beyond consent. But lawful processing is not the same as invisible processing. The Act also requires that patients be given specified information when their data is collected, that the processing be secure, and that patients be able to see and correct what is held about them.
That is the test. Not whether anyone signed a form, but whether any of it is being done lawfully, transparently and safely.
On 12 October, the Data Protection Commission went to find out.
What the inspectors found
The Commission’s team visited a clinic. According to Graphic Online’s account of the exercise, published on 13 October, the clinic had not appointed a Data Protection Supervisor. It had unpaid fees going back to at least January 2025. Its organisational and technical measures to protect personal information were inadequate.
And it had never carried out a privacy impact assessment of the electronic system in which it stores its patients’ records.
The clinic was directed to give a statement to the police.
Two hospitals were also visited. Both were registered with the Commission, but their data protection certificates had expired. That is a different finding from never having registered at all, and it carries a different enforcement route. A microfinance company was separately referred to CID headquarters over a lapsed registration and an incomplete compliance report.
The Commission’s Executive Director, Dr Arnold Kavaarpuo, has said it can no longer rely on education and persuasion alone, fourteen years after the Act was passed. Its Director of Regulatory and Compliance, Mr Quintin Akrobotu, says the aim is compliance rather than punishment. The Commission recorded 2,575 data controller registrations in 2026, though a registration is a starting point rather than proof that an organisation is compliant. Inspections will continue into 2027 and extend to religious institutions and the media.
One inspection cannot tell you how widespread the problem is. It can tell you what nobody was checking for.
Why a clinic is a data controller
Section 27 of the Data Protection Act, 2012 (Act 843) requires a data controller intending to process personal data to register with the Commission before doing so. Section 50 provides for renewal every two years. Section 56 makes processing personal data without the required registration punishable on summary conviction by a fine of up to 250 penalty units, imprisonment of up to two years, or both.
A data controller is defined by responsibility, not by signage. Any organisation that determines the purposes for which and the manner in which personal data is processed falls within the Act. In practice that captures most hospitals, laboratories, pharmacies, CHPS compounds and private clinics, because each of them decides what to collect about a patient and what to do with it.
One such organisation has now been found without a supervisor, without a privacy assessment and without adequate safeguards on a system holding patient records. The reasonable question is not whether that clinic is typical. It is whether anyone knows.
The year Ghana’s health records went dark
That question lands in the middle of the most disruptive year Ghana’s health information systems have had.
The Lightwave Health Information Management System, LHIMS, was introduced in Ghana in 2017, with implementation documented in the Central Region, and was subsequently expanded under a national programme. In 2019 the government signed a contract worth US$100 million to connect 950 health facilities.
The Minister of Health, Kwabena Mintah Akandoh, told a briefing on 29 October 2025 that the contract was meant to expire in 2022, was extended twice to the end of 2024, and that at expiry only 450 facilities had been connected. He said about US$77 million had been paid, more than 70 per cent of the contract value, and that the contract never received parliamentary approval. He said the vendor had been switching the system off at will after the ministry required it to hand over data and grant administrative access, and that the system had been completely down for about two weeks. His words were that if that is not blackmailing, he does not know what it is.
Those are the Minister’s allegations, not the findings of an independent audit, and the vendor rejects them. Lightwave has disputed the performance calculation, arguing that facilities carried different contractual costs and that its completed deployments represented roughly 72 per cent of the contract’s value. It has also disputed the allegations concerning hosting, access and hardware. Former Health Minister Dr Bernard Okoe-Boye challenged the handling of the termination on JoyNews the same day, arguing the contract should have been wound down in an orderly way, and citing the delivery figure against a different total of 500 units rather than 950 facilities.
What is not in dispute is that records became unreachable. MyJoyOnline reported that patient records going back to 2020 had become inaccessible during the disruption.
On 29 October 2025 the Ghana Health Service directed all public and mission facilities to adopt the Ghana Health Information Management System, GHIMS, a state-owned platform, as the sole authorised system for patient registration, clinical documentation, insurance verification, billing and NHIA claims. The Minister announced a four-week phased rollout, beginning with teaching and regional hospitals and working down through district hospitals, polyclinics, health centres and CHPS compounds.
The unanswered question is what happened to the records
Here is what the public record does not establish.
A patient walks into a district hospital in 2022. They give their name, their age, their symptoms, their HIV status, their pregnancy history. That information is entered into a system operated under a commercial contract the patient has never seen.
Three years later, the government and the vendor are in dispute. Access to records held in that system is disrupted. The government announces a replacement platform.
What remains unclear is the extent to which those historical records have been preserved, made accessible, and transferred to the new system. The Ministry and the vendor disagreed publicly about access to the existing data. Nobody has published an account of what happened to it.
At no point in that chain is it clear what patients were told about how their records would be stored, who would have access to them, or what would happen to their information when the system changed.
The questions the Commission put to one clinic on 12 October apply with far greater force to the national systems:
- How many of Ghana’s teaching, regional and district hospitals are registered with the Commission, and how many hold current certificates?
- Was a privacy impact assessment carried out before GHIMS was deployed, or before patient records were moved onto it?
- Who is the designated data protection supervisor for the Ghana Health Service, and for the Ministry of Health?
- What legal basis applies to each stage of processing, and what were patients told at the point of collection?
- Section 32 of Act 843 gives patients the right to access and correct their records. Can a Ghanaian patient exercise that right today and get a response?
The last one is not academic. A right that nobody can exercise in practice is not a right, it is decoration.
Sovereignty is the easy half
The government has framed the move to GHIMS as a sovereignty win, and there is something in that. A state-controlled platform can strengthen public oversight of health information systems, and a vendor should not be able to turn the lights off during a contract dispute.
But the LHIMS episode shows why the distinction matters. Lightwave has said the Ministry of Health owned the patient data while the company owned the software intellectual property. The Ministry disputed aspects of that account, including access and hosting. Ownership of the data, ownership of the software, control of the infrastructure, and the practical ability to access and recover patient records are four separate questions. A system can be locally controlled and still fail its patients if governance, security and continuity arrangements are inadequate.
There is still time. GHIMS is new, and it is an opportunity to build privacy protections into the registration workflow, to publish a register of health sector data controllers, and to assess the privacy risks attached to the new system and to any movement of patient records onto it. Act 843 already establishes the core obligations around lawful processing, transparency, data security and the protection of data subject rights. The Commission’s own guidance provides a framework for assessing and mitigating privacy risk.
Ghana has built the pipes. The Data Protection Commission has started enforcing the law. The two conversations have not yet met.
They should meet before the next outage, not after.