Handles health records, in Nigeria

National Health Act, 2014 (Act No. 8 of 2014), health records and confidentiality (ss. 25-29) · Read the law's page

• Treat all information concerning a user of health services, including information relating to the user's health status, treatment or stay in a health establishment, as confidential (section 26(1)).
• Do not disclose that information unless the user consents in writing, a court order or any law requires the disclosure, a parent or guardian asks in the case of a minor, a guardian or representative asks in the case of a person otherwise unable to grant consent, or non-disclosure represents a serious threat to public health (section 26(2)).
• Where you are the person in charge of a health establishment, ensure that a health record containing the prescribed information is created and available at the establishment for every user of health services, subject to applicable archiving legislation (section 25).
• Where you are the person in charge of a health establishment in possession of a user's health records, set up control measures to prevent unauthorised access to those records and to the storage facility or system in which they are kept (section 29(1)).
• Where you are a health care provider, examine a user's health records for treatment with the user's authorisation, and for study, teaching or research with the authorisation of the user, the head of the health establishment concerned and the relevant health research ethics committee, unless the study, teaching or research obtains no information as to the user's identity (section 28).
• Do not falsify a record, create, change or destroy a record without authority, provide false information with the intent that it be included in a record, or copy any part of a record without authority (section 29(2)).

Cybercrimes (Prohibition, Prevention, etc.) Act, 2015, section 21, Reporting of Cyber Threats, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 · Read the law's page

• This binds any person or institution, whether public or private, that operates a computer system or a network in Nigeria; there is no sector or size gate.
• Immediately inform the National Computer Emergency Response Team (CERT) Coordination Center, through your sectoral CERT or sectoral Security Operations Centre, of any attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network.
• Report the incident to the National CERT within 72 hours of its detection. Failing to do so is itself an offence, punishable by denial of internet services and a mandatory fine of N2,000,000 payable into the National Cyber Security Fund.