Why It’s Impossible to Avoid Patient Information on Your Computer — Even If You “Only Use Email”
In the healthcare world, compliance isn’t optional. POPIA and the Health Professions Council of South Africa (HPCSA) place strict requirements on how patient information must be protected.
Yet many healthcare professionals still believe something like:
“I’m not storing patient information on my computer. I only use email.”
Unfortunately, this is not possible.
If you use email in a medical practice — even for something simple — your computer already contains
patient information.
Here’s why.
1. Email Is Patient Information
The HPCSA defines patient records broadly. It includes any personal or health-related details about a patient, even something as simple as:
- A name
- A surname
- A medical aid number
- An appointment confirmation
- A diagnosis or symptom
- A referral letter
- A lab report
As soon as an email contains anything about an identifiable patient, it becomes regulated patient information.
So a message like:
“Please book John Smith at 11:00.”
…is already patient information.
2. Your Computer Automatically Stores All Emails
Many professionals think, “But I don’t save anything to my computer.”
However, that’s not how email works.
If you use Outlook, Apple Mail, Thunderbird, or any desktop mail app, the software automatically:
- Downloads all emails
- Saves them to the device
- Stores attachments locally
- Creates temporary files
- Indexes emails so they are searchable
You don’t have to “save” anything manually — your computer does it for you.
Even if you use Outlook Web, the browser caches copies of emails and attachments in its temporary files.
3. Attachments Make the Risk Even Bigger
Healthcare practices rely on attachments every day:
- Referral letters
- Specialist reports
- Test results
- X-rays
- Medical aid documents
- Scanned forms
Once an attachment is opened or previewed, your computer stores a copy, often in hidden temporary folders. These files aren’t obvious, but they are absolutely there.
4. Email Is the Biggest Source of Data Breaches
Most healthcare breaches happen through email:
- A staff member clicks a malicious link
- A mailbox is hacked
- A laptop is stolen
- An unencrypted device is lost
And because the computer stores patient emails, the incident becomes a breach of patient information — which must be reported under POPIA.
5. Compliance Requires Proper Protection
Because email places patient information directly onto computers, HPCSA and POPIA require that devices used in a medical practice must have:
- Full disk encryption (to protect lost or stolen devices)
- Endpoint security (antivirus/anti-malware)
- Email security
- Backups and archiving
- Access control and strong passwords
- An IT usage policy
- Secure configuration of Microsoft 365
This isn’t optional — it’s a legal and ethical requirement.
6. “I Only Use Email” Is Not a Compliance Strategy
Even the simplest, most basic communication between a doctor and patient involves patient information.
There is no scenario where a healthcare practice uses email but does not store patient information on the computer.
Email = patient information = legal responsibility.
Conclusion
If you’re a healthcare professional, your computer holds patient information — even if you believe it doesn’t. The moment patient details enter your inbox, you carry the responsibility of protecting that information.
The solution is simple:
Secure your devices properly and choose an IT partner who understands the healthcare compliance landscape.
If your practice needs help meeting HPCSA and POPIA requirements, we’re here to help.
