DPC launches probe into alleged breach of patient data by LightWave Healthcare

The Data Protection Commission (DPC) has launched an investigation into access to patient data managed by LightWave eHealthCare Solutions under a previous contract with the Ministry of Health (MoH) for the implementation of the National Electronic Medical Records (EMR) and Patient Management System.

In a statement issued on Wednesday, October 29, 2025, the Commission said the probe seeks to ensure that all personal health data is being handled securely and in strict compliance with the Data Protection Act, 2012 (Act 843).

The investigation, according to the DPC, is being conducted under the supervision of the Minister for Communications, Digital Technology and Innovation, and in collaboration with the Ministry of Health, the Cyber Security Authority (CSA), and the National Information Technology Agency (NITA).

“The Commission is working to ascertain the facts and ensure that personal health data is securely managed in accordance with the Data Protection Act, 2012 (Act 843),” the statement read.

The scope of the investigation includes reviewing how the affected data is being stored and managed, assessing compliance with lawful processing, retention, and security standards under Act 843, and ensuring that the rights of data subjects are upheld.

The DPC said it will engage all relevant parties, including LightWave eHealthCare Solutions, the Ministry of Health, and associated service partners, to ensure a transparent and efficient process.

Assuring the public of the integrity of the process, the Commission emphasized that the investigation would be conducted objectively and in accordance with due process.

“The DPC remains committed to protecting personal data, particularly sensitive health information, and to maintaining public trust in Ghana’s digital ecosystem.”