Sending patient documents without loose attachments
How a South African practice sends referral letters, results and accounts by expiring link instead of e-mail attachments, and what POPIA expects of it.
By Achekam · · 5 min read · For Healthcare businesses in South Africa
Every day a practice sends documents that carry some of the most private information a person has. A referral letter to a specialist. Blood results to a patient who asked for a copy. An account with diagnosis codes to an insurer. A sick note to an employer, at the patient's request.
Most of these still go as e-mail attachments. Once an attachment leaves the practice, it cannot be called back. It sits in the recipient's inbox, in any inbox it is forwarded to, and on any phone that downloaded it. If the receptionist picks the wrong "Thandi" from the address book, the practice has no way to undo the mistake. There is a better habit, and South Africa's privacy law gives every practice a reason to adopt it.
The practice answers for what it sends
The Information Regulator says that any organisation, public or private and whatever its size, or any individual that processes personal information, is a responsible party with a duty to comply with POPIA's eight conditions for lawful processing. Its overview of POPIA explains who the Act applies to and what those conditions are.
A practice collects, stores, uses and sends personal information about every patient, so it is a responsible party for all of it, including every document that leaves the building. "The e-mail system did it" is not an answer the law recognises. The practice decides how documents are sent, so it carries the duty for that choice.
What the security condition asks
The Act, in the text published in the Government Gazette in November 2013, requires a responsible party to secure personal information with appropriate, reasonable technical and organisational measures. Those include identifying the risks it can reasonably foresee, maintaining safeguards against them, and regularly checking that the safeguards work and updating them.
For document sending, the foreseeable risks are easy to list:
- The document goes to the wrong address.
- The right person forwards it to someone else.
- It stays in an inbox for years after anyone needs it.
- A shared or stolen phone opens it.
A safeguard should answer each of these, and someone at the practice should check from time to time that staff actually use it.
Sharing by link instead of attachment
A personal link changes the position in three ways: the document stays in one place, access can be limited, and access can be withdrawn.
In Achekam, a document can be shared by e-mailing a personal link with an expiry date, an optional one-time code, and downloading either allowed or not. The share can be revoked at any time. In practice:
- Set an expiry that suits the purpose. A referral letter needs to be open until the appointment; a copy of results for a patient may need only a few days.
- Use the one-time code for anything sensitive, as an extra step before the document opens.
- Block downloading where the recipient only needs to read the document, such as an employer checking the dates on a sick note.
- Revoke the share once its purpose has passed, rather than waiting for it to expire.
When a link goes to the wrong person
The value of a link shows when something goes wrong. If reception sends a share to the wrong address, revoke it immediately. If the document was not opened before revocation, the practice has contained the mistake.
If there is a chance it was opened, the law comes into play. The Act as published requires a responsible party that has reasonable grounds to believe personal information was accessed or acquired by an unauthorised person to notify the Information Regulator and the patient as soon as reasonably possible. The notice to the patient must be in writing, for example by post or e-mail.
Decide in advance who at the practice makes that call, and write down what happened, when it was noticed and what was done. The Act as published also allows the Regulator to issue an infringement notice with an administrative fine of up to R10 million, which the infringer may pay, arrange to pay in instalments, or elect to contest in court within 30 days. A practice that acted quickly and kept a record is in a far better position to explain itself.
What happens to stored documents in Achekam
Documents you share in Achekam sit in Document Centre, a folder-based store where files and whole folders are uploaded, previewed, renamed, moved, tagged, archived and searched. A new version of a file keeps the earlier ones, so a corrected referral letter does not erase the one the specialist first received.
Every stored file gets a SHA-256 fingerprint, a unique value calculated from its contents that shows whether a later copy is identical. Executable files are refused by default, and every upload passes a malware check. That check uses ClamAV when the server is configured for it; otherwise a built-in heuristic check runs.
These features support your safeguards. They do not replace the practice's own measures: who has access to which folders, how long documents are kept, and how staff are trained.
A checklist for reception and billing staff
Pin this where documents are sent from:
- Check the recipient's address against the patient file, not the address book's first suggestion.
- Send a link, not an attachment, for anything containing results, diagnoses or ID numbers.
- Set an expiry that matches the purpose.
- Add a one-time code for sensitive documents.
- Block downloads where reading is enough.
- Revoke shares once they have served their purpose.
- If a link went to the wrong person, revoke it at once and tell the person responsible for privacy the same day.
Change the habit this month
Choose one document type, such as referral letters, and move it from attachments to links this month, then add the others. For information that should not be pasted into tools at all, read AI tools and patient ID numbers, and for how another industry handles identity documents, see storing passport copies.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
