The Data Protection Commission (DPC) has launched an investigation into the handling and access of patient data managed by LightWave eHealthCare Solutions under a previous contract with the Ministry of Health (MoH). The inquiry focuses on ensuring that personal health information stored under the National Electronic Medical Records (EMR) and Patient Management System is being securely managed in line with Ghana’s data protection laws.
According to a statement issued by the Commission, the investigation seeks to verify compliance with the Data Protection Act, 2012 (Act 843), particularly concerning lawful data processing, retention, and the protection of individuals’ privacy rights.
The DPC, operating under the supervision of the Minister for Communications, Digital Technology and Innovation, is collaborating with the Ministry of Health, the Cyber Security Authority (CSA), and the National Information Technology Agency (NITA) to establish the facts and ensure due process.
As part of its mandate, the investigation will:
- Review how the affected data is being stored and managed.
- Assess compliance with Act 843 on lawful processing, retention, and security.
- Ensure that the rights of data subjects are protected.
The Commission said it will engage all relevant stakeholders, including LightWave eHealthCare Solutions, the Ministry of Health, and associated service partners, while working closely with CSA and NITA to ensure a transparent and efficient process.
“The Commission assures the public that the investigation will be conducted objectively and in accordance with due process,” the statement said, adding that the DPC remains committed to protecting sensitive health information and maintaining public trust in Ghana’s digital ecosystem.
The DPC stressed that its actions reflect its broader mission to uphold data privacy standards and strengthen accountability within Ghana’s expanding digital infrastructure.
DPC’s statement below;
