Health Minister Aaron Motsoaledi wants to a have a grip on how many medical scheme members use public sector health facilities and what the cumulative impact this holds for national policy. Basically, as his spokesman Joe Maila claims, one of the aspects of the project is to ascertain which members of medical aids are using public sector health facilities without paying and which he [Motsoaledi] wants to set right.

It is a fair issue. In the DA’s Our Health Plan [OHP] we propose a much closer interaction between private and public sector health. We recommend that where quality health services are available in the public sector, medical aid members with the proviso that schemes pay up may use these. Pilot projects should be introduced to begin to do the reverse, where idle private sector theatres can for example be used by the public sector, also with payment.

To accomplish this requires an efficient cross-billing system that, despite millions of rands of investments in IT systems, does not exist. It is here, at the point of service, that information about whom is using what, is collected. But because there is an extraordinary failure to collect patient information at the point of service in the public, Motsoaledi turns to the Council of Medical Schemes [CMS] to set up a system of data collection with no security provisions made to protect it against hacking.

The other aspect of the project, in the words of Joe Maila, is to have “information regarding the profile of each medical scheme option, burden of disease for each option, distribution of scheme members, etc. The objective here is to obtain summary information not individual personal or private information”. But the Beneficiary Registry asks for private information like names and residential addresses and CMS provides no compelling assurances or technical guidelines that the data will be anonymised. Many medical scheme principals rightly refused to provide the requested information. There is now an impasse.

Section 14 of the Constitution of the Republic of South Africa, 1996, provides that everyone has the right to privacy. The right to privacy naturally includes a right to protection against the unlawful collection, retention, dissemination and use of personal information. The state must respect, protect, promote and fulfill the rights in the Bill of Rights.

Furthermore, the Protection of Personal Information Act (Act No 4 of 2013) known as POPI, is designed to ensure that all South African institutions including medical aid schemes conduct themselves in a responsible manner when collecting, processing, storing and sharing entity’s personal information by holding them accountable for abusing or compromising citizen’s personal information in any way.

Section 5 of the POPI Act specifically deals with the privacy rights of data subjects. It states that: “A data subject has the right to have his, her or its personal information processed in accordance with the conditions for the lawful processing of personal information as referred to in Chapter 3” that, in case of the CMS, must comply with 8 separate conditions. Here follows a checklist of questions to which the Health Ministry must provide adequate answers to comply with the following provisions of the Protection of Personal Information Act (Act No 4 of 2013):

1. Processing limitation (sections 9 to 12) – Is the information processed lawfully and in a reasonable manner that does not infringe on the privacy of the medical aid members? Is only the minimal necessary information – that is information that is adequate, relevant and not excessive – to be processed? Has consent been obtained from every member? Has the legitimate interest of the data subject been taken into account?
2. Specific Purpose (sections 13 and 14) – Is the personal information collected for a specific, compelling, explicitly defined and lawful purpose and what steps have taken to ensure that the member is made aware of the purpose? Will records of personal information be retained longer than is necessary for achieving the purpose for which the information was collected or subsequently processed?
3. Further processing limitation (section 15) – Will the further processing of personal information be in accordance or compatible with the purpose for which it was originally collected?
4. Information quality (section 16) – Has reasonable steps must be taken to ensure that information is complete, accurate and updated;
5. Openness (sections 17 and 18) – When the personal information is collected, will reasonable and practicable steps to taken to ensure that the medical aid member is aware that the information being collected and for what purpose? What are those steps?
6. Security Safeguards (sections 19 to 22) – What appropriate, reasonable, technical and organisational steps are being taken to secure the integrity and confidentiality of personal information being collected and stored to prevent the loss of, damage to or its unauthorised destruction or unlawful access to or processing?
7. Data subject participation (sections 23 to 25) – Will the medical member have access to the information, and the ability to correct information?

Motsoaledi is not ipso facto legally entitled to the information. Considering that no provision appears to be made regarding the security of the information, such a database could automatically and easily be targeted by hackers and would severely compromise medical aid members. Given the number of people and institutions that must, of necessity, access the database, it will be close to impossible to ensure the security of the information.

Motsoaledi is using the Council of Medical Schemes [CMS] to collect the data from the medical schemes, many of who rightfully refuse to comply. By law, the CMS is the prudential and market regulator of medical schemes and its task is to ensure that they are financially viable and stable in the interests, principally, of ordinary members. The CMS is therefore an institution serving medical aid members’ interest and not that of the Minister of Health.

This could be another instance of “state capture”, this time by Motsoaledi, to make sure medical aid schemes are led for National Health Insurance (NHI) purposes rather than prudential and market regulatory purposes. It is no secret that Motsoaledi would love to park the resource-rich medical schemes in the NHI. Law however governs the CMS and any effort to subject it to political ends must – and will – compel a legal challenge.

The DA would fundamentally change the way Regulators and related institutions are governed. In Our Health Plan (OHP) released in November 2016 we recommend that the CMS be fire-walled from the Minister of Health. The CMS should remain the prudential and market conduct regulator of medical schemes, but under DA governance the Council and all appeal structures will be appointed independently of the Minister and the entities it regulates.

South Africans did not fight for and achieve a rights-based democracy only to be victim to the untransparent maneuvers of a Minister schooled in the behind-the-scenes manipulative culture of the ANC-in-exile. The state has no right to our personal information and the CMS has no business in providing it. It cannot be that national government asks a national institution to not comply with our own laws. DM

Dr Wilmot James, MP, is DA National Spokesperson on Health.

Photo: Minister of Health, Dr Aaron Motsoaledi addressing the media on the outcomes of the negotiations on the African Growth and Opportunity Act (AGOA), Pretoria, 07/01/2016. Siyasanga Mbambani.