Mediclinic – Serious Concerns Regarding Confidential Medical Records

I am deeply dissatisfied with how Mediclinic handled my concerns regarding the removal, handling and reproduction of confidential medical records.

On 19 February 2026, I formally raised concerns regarding patient confidentiality, compliance with the Protection of Personal Information Act 4 of 2013 (POPIA), chain of custody, and the risks associated with reproducing highly sensitive medical information outside the controlled environment of a healthcare facility.

Mediclinic confirmed that the matter had been escalated to Corporate Office, and I subsequently engaged directly with its Compliance and Data Protection Officer and provided the information requested to assist with the investigation.

On 4 March 2026, Mediclinic advised me that, in certain circumstances, hospital and related records may be copied by a service provider under a formal service agreement. However, this response did not adequately address the specific circumstances I had reported, including whether the correct procedures were followed, who authorised the conduct, whether the evidence provided was properly investigated, and whether any corrective or preventative action was taken.

Despite the matter being escalated and referred to the appropriate compliance function, I have not received a clear or substantive investigation outcome.

More concerningly, to my knowledge, the individuals connected to the circumstances I reported were not meaningfully approached, investigated or held accountable, and no concrete remedial measures have been disclosed to me.

The existence of a service agreement does not, by itself, establish that the specific handling of confidential medical records comp**** with Mediclinic's internal policies, required safeguards or applicable data-protection obligations.

I therefore believe Mediclinic should provide clarity regarding:

1. What investigation was actually conducted into the specific circumstances I reported? 2. Who was interviewed or questioned as part of that investigation? 3. Was the supporting documentation and other evidence I provided properly assessed? 4. Were the individuals connected to the incident identified and investigated? 5. Were any corrective, preventative or disciplinary measures considered or implemented? 6. What factual basis supported Mediclinic's ultimate position? 7. What measures were put in place to prevent similar concerns from arising again?

I am not requesting confidential employee or disciplinary information. I am requesting confirmation that a serious concern involving highly sensitive personal information was properly investigated and appropriately addressed.

I raised this matter privately and in good faith, with the intention of ensuring that confidential patient information was protected and that appropriate procedures were followed. I deliberately refrained from publicly distributing the supporting material in my possession.

Patients entrust healthcare providers with some of their most private and sensitive information. That trust requires more than policies and contractual agreements on paper — it requires those safeguards to be properly implemented, monitored and enforced.

Based on my experience, I cannot regard Mediclinic's handling and resolution of this complaint as satisfactory.

I reserve all rights to pursue the matter through the appropriate regulatory and legal channels should a satisfactory explanation and resolution not be provided.