AUGUST 200 I ------------ THE SOUTHERN AFRICAN JOURNAL OF HIV MEDICINE

EIsabe Klinck
Legal Advisor, South African Medical Association

LEGAL AND ETHICAL ISSUES

those held by a private sector facility. Apart from this, there
are two further differences between access to information
held by public and private bodies: public bodies have to
appoint so-called 'information officers', and also have to
have a process of internal appeal if the requester is not
satisfied.

Refusal of access to information may only take place on the
grounds prescribed by the Act (sections 34 - 45 in the case
of public, and sections 63 - 69 in the case of private bodies).
If part of a record may be refused, and part of it not, the
principle of severability states that such parts should be
deleted, photocopied out of severed from the parts to which
access should be granted. Therefore the mere fact that part
of a record contains information that may be refused may
not serve as a reason to refuse access to the rest of the
record.

A person requesting information has to do so on the
prescribed form (found in the regulations to the Act), and
there are two types of fees payable. The Act distinguishes
between 'personal requesters' and 'requesters: A per'sonal
requester is a person requesting information about
him/herself. Such a person does not have to pay the
standard fee of R35 (in the case of information requested
from a public body) or R50 (in the case of information
requested from a private body). All other requesters have to
pay that fee. When access is to be given, there are three
more types of fees that all requesters have to pay, i.e.
reproduction fees (for photocopying, computer disks, etc.l.
search and preparation fees (R 15 per hour or part thereof in
the case of public bodies and R30 per hour or part thereof
in the case of private bodies), and actual postage. The Act
does not provide for faxing costs, i.e. a requester would
either have to receive the information by mail, collect it
personally, or the private or public body could fax it, if s/he
so wishes, at the requester's expense.

REFUSAL OF ACCESS

Some of the most pertinent grounds for refusal concern the
protection of privacy of a third party and the protection of
confidentiality agreements. This means that private
information may not be unreasonably disclosed to a third
party. Personal information includes medical information,
financial information, ete. As it is uncertain as to what
'unreasonable' disclosure entails, it is advisable that medical

REQUESTS MADE IN TERMS OF THE ACT

Information in the possession of any facility can fall into
one of two categories: information automatically available,
and information available on request, as explained below. As
a first step, all health care facilities [including private
practices), irrespective of whether they are private or public,
have to decide which information is to be made available
'voluntarily and automatically' to the public at large for free
and for sale. All other information has to be made available
as set out below and at the fees described below.
Information automatically available has to be listed and
included in a manual, available to the public, in which every
facility should also describe the manner of access (and
price) of certain categories of information (sections 14 and
51). A body can also request the Minister of Justice to
exempt certain types of information from the application of
the Act. All facilities should have a policy on the retention of
records, as well as when records may be disposed of, ete.

The Promotion of Access to Information Act of 2000 (the
Act) came into operation in March this year. The Act
purports to give effect to the human right of access to
information. It contains very detailed prescriptions on
procedure, forms and types of access. It also sets time
frames within which the person or institution holding
information has to respond to a request for access to
information. The Department of Justice administers the Act
The Act overrides any other Act that provides for more
restrictive access to information. In this regard concern has
been expressed in relation to its suitability for the health
sector and its relationship with the proposed National
Health Bill.

INTRODUCTION

DECISION REGARDING INFORMATION
AUTOMATICALLY AVAILABLE

THE RIGHT OF ACCESS TO INFORMATION
SOME RAMIFICATIONS FOR THE HEAlTH

SECTOR

A person requesting access to records or information held
by a private body has to show that s/he is requesting the
information in order to protect or exercise his/her rights. A
person requesting information from a public body does not
have to show that s/he is requesting it in pursuance of their
rights. This creates a rather strange anomaly in that persons
will have easier access to health care information (or even
their own records) held by state health care facilities, than



THE SOUTHERN AFRICAN JOURNAL OF HIV MEOICINE ------------

practitioners do not provide any information relating to a
patient to any third party without the patient's informed
consent. Alternatively, medical practitioners may conclude
confidentiality agreements with their patients, if, for
example, they want to protect the medical information of a
minor from being accessed by a parent (this may be the case
where child abuse is suspected, or where the minor has
legally obtained a termination of her pregnancy, has legally
consented to medical tests or treatment, etc.).

Medical aid funds, pharmaceutical companies, researchers,
etc. all request patient information from health care
practitioners from time to time. Even though such
information may be de-indentified, it may still constitute a
violation of privacy. In order to protect themselves from
possible legal action, medical practitioners should in all
cases obtain the informed consent of patients regarding the
specific requesters to whom specified information will be
divulged. If a medical aid fund requests information from a
medical practitioner, only information as delineated in the
Medical Schemes Act of 1998 may be given to medical aid
funds, and then only under the prescribed circumstances.
These circumstances include that the information has to
serve the purpose of managed care and that access has to
take place in terms of an agreement between the medical
aid fund and the service provider.

Other grounds for refusal include commercial information
on and of a third party where the disclosure of such
information would cause disadvantage in contractual or
other negotiations, priviledged legal information and the
commercial information on and of a private body. It should
be noted that the list for grounds of refusal in relation to
public bodies differs from those listed for refusal by private
bodies. Information relating to police dockets in bail
proceedings, for example, may be refused under certain
circumstances listed in the Act. South African Revenue
Service (SARS) records are also protected by this list.

Medical records that do not fall within one of the grounds
for refusal, but which contain information likely to cause
serious physical or mental harnl to the patient requesting it,
have to be dealt with in terms of a specific procedure set
out in the Act. In short, the patient must be asked to
nominate a health practitioner who may then be consulted
regarding possible serious harm of such information to the
patient, and who can ensure that adequate arrangements
are made for counselling of the patient.

MANDATORY DISCLOSURE •

Despite falling within the grounds for refusal, the Act states
that certain information has to be disclosed. Such
disclosure must take place if it reveals a substantial
contravention or failure to comply with the law or an
imminent and serious public safety risk, and if the public
interest in the disclosure clearly outweighs the possible
harm. This may be very risky terrain, as some people may
feel that disclosing the HIV status of a person falls within
the ambit of this section. However, it should be borne in

mind that the Act only applies to where information is
requested. It does not apply where information is
volunteered. In such cases the laws in relation to the
protection of privacy, as well as the relevant ethical
considerations, still apply. If information is requested and it
is possible that it falls within this ambit, it is advisable to
first obtain legal advice on this matter.

OPERATION OF THE ACT IN PRACTICE

In practice, the Act will operate as follows:

1. A person will request access on the prescribed form. In
the case of public bodies the information officer will take
responsibility for the request; the head of a private body has
to duly delegate a person to fulfil this function. The
information officer must open a file for every requester, so
as to keep track of the flow of correspondence on the
matter.

2. The information officer writes the requester a letter
stating that the request has been received and a decision
will be made within 30 days. This period may be extended if
the search or request concerns a large number of
documents, etc. In this case, however, the requester must
consent to such an extension. If the record concerns a
health record that may pose serious harm to the requester,
the requester must be asked in this letter to nominate a
health care practitioner.

3. If the request is granted, written notice must be given to
the requester of the access fee (R3S or RSO) and the fees in
relation to searches, reproduction and postage. It is
advisable that a table sets out exactly how this is calculated.
The letter should include reference to the fact that the
requester may approach a relevant court of law if not
satisfied with the outcome. In the case of a public body, the
requester must be made aware of the internal appeal
procedure.

4. If the request is denied, written notice must be given with
full particulars as to the grounds, as specified in the Act. on
which access is refused. Again, information has to be given
as to the rights of appeal or review.

5. If a record was lost, destroyed, could not be found or does
not exist, the requester must be informed as such. An
affidavit or affirmation to that effect has to be made and
attached to the letter. The affidavit must state all the steps
taken in order to find the document and it is advisable that
the policy of the facility in relation to the retention,
destruction, etc. of records be attached to such affidavit
and letter. Destroying or losing a document so as to evade
the provisions of the Act constitutes an offence for which a
fine or up to 2 years' imprisonment may be given.

6. If records are requested for which the consent of a third
party first has to be obtained [sections 47ff and sections
71 ff), those procedures and time frames have to be adhered
to.

AUGUST 200 I