NigeriaNational Health Act, 2014, health records and confidentiality
National Health Act, 2014 (Act No. 8 of 2014), health records and confidentiality (ss. 25-29)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Access restriction, Consent, Governance, Security
- Audit expectation
- none
What it requires
- Treat all information concerning a user of health services, including information relating to the user's health status, treatment or stay in a health establishment, as confidential (section 26(1)).
- Do not disclose that information unless the user consents in writing, a court order or any law requires the disclosure, a parent or guardian asks in the case of a minor, a guardian or representative asks in the case of a person otherwise unable to grant consent, or non-disclosure represents a serious threat to public health (section 26(2)).
- Where you are the person in charge of a health establishment, ensure that a health record containing the prescribed information is created and available at the establishment for every user of health services, subject to applicable archiving legislation (section 25).
- Where you are the person in charge of a health establishment in possession of a user's health records, set up control measures to prevent unauthorised access to those records and to the storage facility or system in which they are kept (section 29(1)).
- Where you are a health care provider, examine a user's health records for treatment with the user's authorisation, and for study, teaching or research with the authorisation of the user, the head of the health establishment concerned and the relevant health research ethics committee, unless the study, teaching or research obtains no information as to the user's identity (section 28).
- Do not falsify a record, create, change or destroy a record without authority, provide false information with the intent that it be included in a record, or copy any part of a record without authority (section 29(2)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 29(2) provides, for the offences it lists, imprisonment for a period not exceeding two years, a fine of N250,000.00, or both.
What it makes you log
Logging duty
Section 25 requires a health record of the user's care to be created, which is the clinical record and not a log of who accessed it. Sections 26 to 29 set no log field, no retention period and no territorial clause.
- Kind
- None
- As of
What this law does
Section 26(1) makes all information concerning a user of health services, including information relating to the user's health status, treatment or stay in a health establishment, confidential.
Section 26(2) bars any person from disclosing that information unless the user consents in writing, a court order or any law requires the disclosure, a parent or guardian asks in the case of a minor, a guardian or representative asks in the case of a person otherwise unable to grant consent, or non-disclosure represents a serious threat to public health.
Section 27 allows a health worker or health care provider with access to a user's health records to disclose the personal information to any other person, health care provider or health establishment as is necessary for any legitimate purpose within the ordinary course and scope of the provider's duties, where the access or disclosure is in the interest of the user.
Section 25 requires the person in charge of a health establishment, subject to applicable archiving legislation, to ensure that a health record containing the prescribed information is created and available at the establishment for every user of health services.
Section 28 lets a health care provider examine a user's health records for treatment with the user's authorisation, and for study, teaching or research with the authorisation of the user, the head of the health establishment and the relevant health research ethics committee, and those authorisations are not needed where the study, teaching or research obtains no information as to the user's identity.
Section 29(1) requires the person in charge of a health establishment who is in possession of a user's health records to set up control measures to prevent unauthorised access to those records and to the storage facility or system in which they are kept. Section 29(2) makes it an offence to falsify a record, to create, change or destroy a record without authority, to provide false information with the intent that it be included in a record, or to copy any part of a record without authority.
A person who commits an offence under section 29(2) is liable on conviction to imprisonment for a period not exceeding two years, a fine of N250,000.00, or both. The Act is dated , the day the President of the Federal Republic of Nigeria assented to it.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .