PAIA Manual

of

PARYS EDWARDS PHYSIOTHERAPY

Note to Members of the South African Society of Physiotherapy (SASP®):

This is a generic PAIA Manual, which can be used as guidance when preparing a Manual for the practice. It forms part of the compliance framework that an information officer must develop and implement. Information included in this document must be changed to suit the practice structure and information processing practices. Care must be taken that changes do not result in non-compliance with the law. This Manual must be made available at the practice and on the website of the practice.

Each unauthorised distribution or use of this document will incur a fee of R50 000 (Fifty Thousand Rand) + VAT, immediately payable to Healthcare Navigator CC.

Healthcare Navigator CC, its members and consultants shall not be responsible for any liability incurred or any loss or harm of whatsoever nature suffered by the practice as a result of using this document.

If assistance is required with the customisation of this policy, please contact:

Esmé Prins-Van den Berg at 083 381 6428 / esme@healthcarenavigator.co.za

Table of Contents

1. Introduction to the Practice 3
2. Contact Details 3
3. Guide of the SA Human Rights Commission / Information Regulator. 3
4. Records 4
5. Information Available in terms of Other Legislation. 6
6. Records Automatically Available 7
7. Purpose of Processing Personal Information. 7
8. Data Subjects, Their Personal Information and Potential Recipients of this Information. 7
9. Planned Transborder Flows of Personal Information. 11
10. Security Measures to Protect Personal Information. 11
11. Procedure to Obtain Access to Records or Information. 11
12. Fees Payable to Obtain the Requested Records or Information. 12
13. Availability of this Manual 12

Annexure A: Information and Record Request Form.. 13

Annexure B: Fees 14

1.     Introduction to the Practice

PARYS EDWARDS PHYSIOTHEARPY is a private physiotherapy practice, which is conducted in accordance with the requirements of the Health Professions Act 56 of 1974 and is subject to the authority of the Health Professions Council of South Africa (“HPCSA”). The practitioners practising at the practice are registered at the HPCSA and provide physiotherapy services within the scope and ambit of their registration, competence and training. The practitioners are bound by the Ethical Rules issued by the HPCSA, which include the duty to preserve patient confidentiality.

2.     Contact Details

Practice Name: PARYS EDWARDS PHYSIOTHERAPY      

Registration Number: 0720000741302

Head of the Practice: PARYS EDWARDS

Information Officer: PARYS EDWARDS

Physical Address: OLD PARKS SPORTS CLUB, 1 GARDEN ROAD, BORDEAUX, 2194         

Postal Address: OLD PARKS SPORTS CLUB, 1 GARDEN ROAD, BORDEAUX, 2194

Telephone Number: 0727530013

E-mail address: physio@parysedwards.com     

Website address: www.parysedwards.com      

3.     Guide of the SA Human Rights Commission / Information Regulator

The South African Human Rights Commission (“SAHRC”) / Information Regulator compiled a Guide, in terms of Section 10 of the Promotion of Access to Information Act (Act 2 of 2000) (“PAIA”), to assist persons wishing to exercise their rights in terms of this Act. This Guide is available in all the official languages and contains, amongst others, the following information:

• The purpose of PAIA;
• The manner, form and costs of a request for access to information held by a body;
• Legal remedies when access to information is denied;
• When access to information may be denied; and
• The contact details of Information Officers in the national, provincial and local government.

Any person wishing to obtain the Guide may either access it through the website of the SAHRC at https://www.sahrc.org.za/home/21/files/Section%2010%20guide%202014.pdf or should contact the Information Regulator at:

Physical address:          33 Hoofd Street, Forum III, 3rd Floor Braampark, Braamfontein, Johannesburg

Postal address:             PO Box 31533, Braamfontein, Johannesburg, 2017

Telephone:                   +27 (0) 10 023 5207 / +27 (0) 82 746 4173

E-mail address:             inforeg@justice.gov.za 

Website:                      https://www.justice.gov.za/inforeg/

The publication of the abovementioned Guide will be the responsibility of the Information Regulator with effect from 30 June 2021.

4.     Records

The practice holds the following categories of records:

• Records relating to the form of practice:

Documents related to the establishment of the practice, such as documents required in terms of the Companies Act 71 of 2008 / a partnership agreement / a shareholders’ agreement; other statutory records; governance documents (e.g. practice policies); minutes of meetings; practice code number registration and other related documents.

• Practice management records:

Documentation relevant to the management structure and the management of the practice; protocols, guidelines and related documentation in respect of the management of patients.

• Employment / Appointment records:

Employment contracts; statutory council registration and related records; conditions of employment and work place policies; employment equity and skills development plans and reports; attendance records; salary and wage register; performance management records; collective agreements; complaints and disciplinary records; relevant tax records; training records; leave records; medical scheme and pension fund membership records; essential services’ permits; correspondence.

• Patient records:

Medical records; patient forms; reports and motivations related to injuries and diseases; payment-related records; correspondence.

• Referral records:

Referral notes; correspondence.

• Clinical trial records:

Records related to clinical trials.

• Health and safety records:

Evacuation plan; information related to the Health and Safety Committee / health and safety officer; and health and safety incident reports.

• Financial records:

South African Revenue Services (“SARS”) registration; Annual Financial Statements; auditor’s reports; accounting records; bank statements; invoices, statements, receipts and related documents; VAT records; tax returns and related documentation.

• Records related to assets:

Asset register; purchase records; financing and lease agreements; sale and purchase agreements; title deeds; registers and records kept in terms of the Medicines and Related Substances Act 101 of 1965; stock sheets; delivery notes and orders; and sale and purchase agreements.

• Agreements:

Agreements (and related documentation) with contractors, consultants, suppliers and vendors, including agreements with funders and related to clinical trials.

• Public and private body records:

Documents published in the public domain; correspondence.

• Legal records:

Legal opinions and advice; complaints, pleadings, briefs and other documents pertaining to any actual, pending or threatened litigation, mediation, and arbitration.

• Insurance records:

Insurance policies and related records, including in respect of professional indemnity cover; claims records.

5.     Information Available in terms of Other Legislation

The practice as may be required in terms of the following legislation subject to the specific protection offered by these laws:

1. Basic Conditions of Employment Act 75 of 1997;
2. Children’s Act 38 of 2005;
3. Companies Act 71 of 2008;
4. Compensation for Occupational Injuries and Diseases Act 130 of 1993;
5. Consumer Protection Act 68 of 2008;
6. Disaster Management Act 57 of 2002;
7. Electronic Communications and Transactions Act 25 of 2002;
8. Employment Equity Act 55 of 1998;
9. Health Professions Act 56 of 1974;
10. Income Tax Act 58 of 1962;
11. Labour Relations Act 66 of 1995;
12. Medical Schemes Act 131 of 1998;
13. Medicines and Related Substances Act 101 of 1965;
14. National Health Act 61 of 2003;
15. Occupational Health and Safety Act 85 of 1993;
16. Promotion of Access to Information Act 2 of 2000;
17. Protection of Personal Information Act 4 of 2013;
18. Road Accident Fund Act 56 of 1996;
19. Skills Development Levies Act 9 of 1999;
20. Skills Development Act 97 of 1998;
21. Unemployment Contributions Act 4 of 2002;
22. Unemployment Insurance Act 63 of 2001; and
23. Value Added Tax Act 89 of 1991.

6.     Records Automatically Available

No notice has been submitted by the practice to the Minister of Justice and Correctional Services regarding the categories of records, which are available without a person having to request access in terms of Section 52(2) of PAIA. However, the information on the website of the practice is automatically available without having to request access in terms of PAIA. Access and usage of the information on the website are subject to the Website Terms and Conditions as well as the Privacy Statement of the practice.

7.     Purpose of Processing Personal Information

The practice processes personal information of data subjects for the following purposes:

1. to conduct and manage the practice in accordance with the law, including the administration of the practice and claiming and collecting payment for services rendered;
2. for treatment and care of patients, including referrals to other practitioners and reporting to referring practitioners;
3. for communication purposes;
4. for the maintenance of practice records and patients’ medical records;
5. for employment and related matters of employees and other practitioners;
6. for reporting to persons and bodies as required and authorised in terms of the law or by the data subjects;
7. for historical, statistical and research purposes;
8. for clinical trials;
9. for proof;
10. for enforcement of the practice’s rights; and/or
11. for any other lawful purpose related to the activities of a private physiotherapy practice.

8.     Data Subjects, Their Personal Information and Potential Recipients of this Information

The practice holds the categories of records and personal information in respect of the categories of data subjects specified below. The potential recipients of the personal information processed by the practice are also specified. Information and records are only disclosed as may be necessary in the circumstances and authorised in terms of the law or otherwise with the consent of the relevant data subjects.

• Practitioners and Employees

Categories of personal information:

Names and surnames; Curriculum Vitae (“CVs”); contact details; identity numbers / dates of birth; race; gender; nationality; qualifications; registered professions and category of registration; statutory council registration numbers; employment history and related information; position and job description; bank details; relevant health information; relevant information on criminal behaviour; complaint and disciplinary-related information; records created in the performance of their duties; tax numbers and related tax information; leave records; remuneration; employment benefits; absenteeism information; vetting reports; references; opinions; next-of-kin details; health and safety-related incidents; COVID-19-related information; correspondence.  

Potential Recipients:

Practice owners; SARS; relevant statutory and other public bodies (e.g. Department of Employment and Labour); the Board of Healthcare Funders of SA (“BHF”); Companies and Intellectual Property Commission (“CIPC”); funders; contractors and suppliers; patients; bodies performing peer review and clinical practice audits; banks; professional societies; vetting agencies; hospitals; members of the public; legal and professional advisers; auditors; executors of estates; purchaser of practice.

• Job Applicants

Categories of personal information:

Names and surnames; Curriculum Vitae (CVs); contact details; identity numbers / dates of birth; race; gender; nationality; qualifications; registered professions and category of registration; statutory council registration numbers; employment history and related information; relevant health information; relevant information on criminal behaviour; vetting reports; interview notes; references; COVID-19-related information; correspondence.

Potential Recipients:

Practice owners and relevant other employees; vetting agencies; legal and professional advisers; auditors; purchaser of practice.

• Patients

Categories of personal information:

Names and surnames; contact details; identity numbers / dates of birth; race; gender; employers and their contact details; medical history; health information, including diagnoses, procedures performed and special investigation reports (e.g. radiology reports, pathology results, etc.); COVID-19-related information; referral notes; complaint-related information; compliments; clinical trial information; opinions; next-of-kin details; correspondence.     

Potential Recipients:

Relevant statutory and other public bodies (e.g. the Compensation Commissioner of Occupational Injuries and Diseases, the Road Accident Fund); funders (e.g. medical schemes); bodies performing peer review and clinical practice audits; hospitals; legal and professional advisers; auditors; executors of estates; next-of-kin; credit bureaus; debit collectors; purchaser of practice.

• Referring Practitioners

Categories of personal information:

Names and surnames; contact details; practice code numbers; practice-related information; qualifications; registered professions; correspondence.      

Potential Recipients:

Relevant statutory and other public bodies; funders; bodies performing peer review; hospitals; auditors; purchaser of practice.

• Hospitals / Health Care Facilities

Categories of personal information:

Names; contact details; relevant staff / office bearer details; website addresses; correspondence; market information; group structures; hospital/facility privilege-related information.                                                    

Potential Recipients:

Auditors; legal and professional advisers; funders; purchaser of practice.

• Contractors, Vendors and Suppliers

Categories of personal information:

Names and surnames; organisation names and details; relevant staff / office bearer details; contact details; website addresses; opinions; correspondence; COVID-19-related information; market information; price structures; financial arrangements; bank details; VAT numbers; Broad-Based Black Economic Empowerment (BBBEE) related information.

Potential Recipients:

Banks; auditors; legal and professional advisers; funders; purchaser of practice.

• Insurers

Categories of personal information:

Names and contact details; premiums; correspondence.

Potential Recipients:

Auditors; legal and professional advisers; relevant public bodies; purchaser of the practice.

• Public and private bodies (e.g. regulators and funders)

Categories of personal information:

Names; contact details; office bearers; fee / benefit structures; rules; information published in public domain; payment-related information (e.g. remittances, statements); correspondence.

Potential Recipients:

Legal and professional advisers; patients; debt collectors; auditors; public; employees; purchaser of the practice.

9.     Planned Transborder Flows of Personal Information

The practice stores electronic information, including personal information of data subjects, in the ‘cloud’, the servers of which may be located outside of the borders of the Republic of South Africa. Due care is taken in the selection of appropriate cloud service providers to ensure compliance with the law and protect the privacy of data subjects. The practice is not planning to send any other personal information about any data subject to any other third party in a foreign country. Should this be required, relevant data subject consent will be obtained, where required, and transfers of such information will occur in accordance with the requirements of the law.

10.  Security Measures to Protect Personal Information

The practice is committed to ensuring the security of the personal information in its possession or under its control in order to protect it from unauthorised processing and access as well as loss, damage or unauthorised destruction. It continually reviews and updates its information protection measures to ensure the security, integrity and confidentiality of this information in accordance with industry best practices. The measures it adopts to ensure the security of personal information, includes technical and organisational measures and internal policies to prevent unauthorised access, loss or use of personal information, for example, the physical securing of the offices where information is held; locking of cabinets with physical records; password control to access electronic records, which passwords are regularly updated; server access control; and off-site data back-ups. In addition, only those practitioners and employees that require access to the information to treat patients and discharge their functions are permitted access to the relevant information and only if they have concluded agreements with or provided undertakings to the practice requiring them to implement appropriate security measures and to maintain the confidentiality of the information. Contractors are required to adhere to the strict policies and processes implemented by the practice and are subject to sanctions for any security breach. All security breaches are taken seriously and are addressed in accordance with the law.

11.  Procedure to Obtain Access to Records or Information

The fact that information and records are held by the practice as listed in this Manual should not be construed as conferring upon any requester any right to that information or record. PAIA grants a requester access to records of a private body, if the record is required for the exercise or protection of any right. If a public body lodges a request, the public body must be acting in the public interest. Access to records and information is not automatic. Any person, who would like to request access to any of the above records or information, is required to complete a request form, which is attached to this Manual as Annexure A, and pay the prescribed fees as referenced below. The request form is also available from -

• the Information Officer of the practice at the contact details stipulated above; and
• the Information Regulator at the contact details stipulated above.

The requester must provide sufficient detail on the request form to enable the Information Officer to identify the record and the requester. The requester must identify the right he/she is seeking to exercise or protect and explain why the record requested is required for the exercise or protection of that right. If a request is made on behalf of another person, the requester must submit proof of the capacity in which the request is made to the satisfaction of the Information Officer. Access to the requested records or information or parts of the records or information may be refused in terms of the law. Requesters will be advised of the outcome of their requests.

12.  Fees Payable to Obtain the Requested Records or Information

The fees for requesting and accessing information and records held by the practice are prescribed in terms of PAIA. The fees payable, which may be amended from time to time in accordance with notices published in the Government Gazette, are attached hereto as Annexure B. Details of the fees payable and any change to such fees may be obtained from the Information Officer. The fees are also available on the website of the Information Regulator. A requester may be required to pay the fees prescribed for searching and compiling the information, which has been requested, including copying charges.

13.  Availability of this Manual

A copy of this Manual is available for inspection, free of charge, at the practice and on its website. A copy of the Manual may also be requested from the Information Officer against payment of the appropriate fee, which may be obtained from the Information Officer.

Annexure A: Information and Record Request Form

https://www.justice.gov.za/forms/paia/J752_paia_Form%20C.pdf

Annexure B: Fees

https://www.sahrc.org.za/home/21/files/PAIA%20Notice%20on%20fees.pdf