The Data Protection Commission (DPC) has launched an investigation into alleged breaches involving access to patient data managed by LightWave eHealthCare Solutions under a previous contract with the Ministry of Health (MoH) for the implementation of the National Electronic Medical Records (EMR) and Patient Management System.

In a statement issued on Tuesday, October 29, the Commission said the probe seeks to establish how patient data was stored, processed, and accessed, and whether those actions complied with the Data Protection Act, 2012 (Act 843).

The investigation, which is being carried out under the supervision of the Minister for Communications, Digital Technology and Innovation, involves collaboration with the Ministry of Health, the Cyber Security Authority (CSA), and the National Information Technology Agency (NITA).

According to the DPC, the exercise will focus on three key areas: reviewing how the affected data is being stored and managed; assessing compliance with Act 843 in relation to lawful processing, retention, and security; and ensuring that the rights of data subjects are upheld.

The Commission noted that all relevant stakeholders, including LightWave eHealthCare Solutions, the Ministry of Health, and associated service partners, will be engaged to ensure a transparent and efficient process.

It assured the public that the investigation would be conducted objectively and in accordance with due process.

“The DPC remains committed to protecting personal data, particularly sensitive health information, and to maintaining public trust in Ghana’s digital ecosystem,” the statement noted.