Ghanaian clinic stored patient records on an unassessed system before regulator intervened

I spend part of my week in a laboratory and part of it behind a news desk. On the laboratory side, I sign out results. A full blood count. A fasting glucose. A hepatitis B surface antigen that will change how a patient is treated for the rest of their life. The moment I release that result, it stops being a piece of paper. It becomes a row in a database. It travels. It is stored somewhere, by someone, under terms I have never been shown. In nine years of laboratory practice, I have rarely seen a patient told where that information goes, who can see it, or what they are entitled to ask about it. Whether a signature on a consent form was legally required at each of those moments is a genuine question, and the answer is often no. Act 843 recognises several lawful bases for processing beyond consent. But lawful processing is not the same as invisible processing. The Act also requires that patients be given specified information when their data is collected, that the processing be secure, and that patients be able to see and correct what is held about them.