Service Catalogue · Specialist · Medical & Allied Health Practices

Is your practice patient-data compliant?
Find out before an audit does.

POPIA Compliance for Medical Practices

Patient records are “special personal information” under POPIA, the strictest category the Act protects. A gap in consent, retention or third-party sharing can turn into a compliance complaint, an HPCSA matter, or a breach you only discover when a patient asks where their data went. Run the free self-check, then talk it through on a discovery call.

Run the Free Self-Check See What's Included
17+Years Practising
500+Clients Served
95%Retention Rate

Practising since 2009. The client and retention figures are our own estimates across that time.

Credentials

  • CA(SA) ledChartered Accountant (South Africa)
  • SAICA memberSouth African Institute of Chartered Accountants
  • Zoho Authorised Partner
  • Reg. 2009/018813/07Managing Advancing Wealth (Pty) Ltd
Free Self-Check

Where does your practice stand today?

Five minutes, no login. Answer a short set of questions about how your practice handles patient data and see where the obvious gaps are, before you book a call.

What This Service Is

Compliance built for how a medical practice actually runs.

POPIA compliance for a general practice is one problem. POPIA compliance for a practice handling patient health records is a different, higher-stakes problem, and it sits alongside rules a practitioner already has to answer to.

01

Patient data carries the highest bar in the Act

Health records are “special personal information” under POPIA §26: processing is prohibited by default. Practices rely on the narrow health-provider exception in §32, but that exception doesn’t remove the need for a documented lawful basis and all eight conditions to be satisfied, every time.

02

HPCSA, POPIA and the National Health Act: one register, not three

Record-keeping under HPCSA Booklet 9, confidentiality under the National Health Act, and the eight POPIA conditions overlap more than they conflict. We map all three into a single compliance register instead of three separate scrambles.

03

Chartered-accountant credibility, not a downloaded policy pack

We’re a CA(SA)-led firm, not a template vendor. Where a gap needs more than paperwork, we help implement the actual controls in the systems your practice already runs.

What's Included

The Practice Readiness Assessment, senior-reviewed.

A once-off diagnostic that establishes exactly where your practice stands against POPIA, HPCSA and National Health Act obligations, and hands you a report you can act from, not a hundred-item checklist with no order.

  • Data-flow mapping: every point patient information enters, moves through and leaves your practice, from booking to billing to referral.
  • Gap analysis against the eight conditions: where your current processes fall short of POPIA's lawful-processing requirements.
  • Section 32 lawful-basis register: a documented basis for every category of patient data you process, built on the health-provider authorisation.
  • HPCSA Booklet 9 retention check: record-keeping and retention periods cross-checked against HPCSA guidance, not only POPIA's minimums.
  • Information Officer registration support: practical help getting your practice's own, internally appointed Information Officer registered with the Information Regulator.
  • Prioritised roadmap report: a CA-signed, ranked list of what to fix first, second and third.
How It Works

From self-check to a signed roadmap.

A short, deliberately low-friction path: nothing is asked of you before you know what you're getting.

Step 01
Self-Check
Free, five minutes, no login. See where the obvious gaps are.
→
Step 02
Discovery Call
Free, no commitment. We talk through what the self-check found.
→
Step 03
Readiness Assessment
A CA-led review producing your data-flow map, gap analysis and prioritised roadmap.
Common Questions

The questions we hear most often.

What does the assessment cover, and what doesn't it cover?
The assessment maps your exposure and hands you a prioritised, CA-signed roadmap: the data-flow map, the gap analysis and the §32 lawful-basis register listed above. It does not itself draft your consent forms, notices or agreements, or implement system controls. Turning the roadmap into those deliverables is a separate follow-on engagement, scoped once you've seen what the assessment finds.
Is this the same as appointing an Information Officer?
No. POPIA requires the Information Officer to be a natural person within your own practice: by default the head of the practice, or a suitably placed employee. That role cannot be outsourced. We support your practice's own, internally appointed Information Officer; we never act as, or market ourselves as, your Information Officer.
Do the 2026 Health Information Regulations apply to my practice?
Possibly not directly. Those regulations, in force from March 2026, primarily target medical schemes, insurers and employers, not solo or small group practices. That said, your practice remains fully bound by POPIA itself through the §32 health-provider authorisation and all eight conditions, regardless of whether the 2026 regulations name you directly. We'll give you the honest answer for your specific practice, not a blanket scare line.
How is this priced?
The self-check is free. Pricing for the Readiness Assessment and any follow-on work is confirmed on the discovery call and set out in the engagement letter, never on this page.
Do I have to commit to anything ongoing?
No. The self-check and the Readiness Assessment are once-off engagements. If your practice later wants ongoing compliance support, that's a separate conversation on its own terms, never a condition of the assessment.
Do you sell financial products (insurance, RAs, investments)?
No. We are not an authorised financial services provider. We review, identify gaps, recommend coordination and structure. Product recommendations sit with your authorised FSP. The boundary is set out in every engagement letter.

Find out where your practice stands.

Start with the free self-check, then book a discovery call: free, no commitment, no pressure.

Book a POPIA Call Email Us Instead

What happens on the call: 30 minutes, online. We get to know your business and check that we are the right fit for each other, answer the questions you bring, share best practice for your setup, and quote for any work that falls within our services.

CA(SA) led practice +27 10 592 7717 info@mawinc.co.za 101 Rose Avenue, Lenasia, Johannesburg