OmniHOmniH Data Privacy, Security & Confidentiality Acknowledgment
Effective Date: ___________________
1. PURPOSE
OmniH is a secure healthcare coordination platform that facilitates communication and information exchange among healthcare professionals, diagnostic facilities, patients, caregivers, and authorized users.
As a participating facility, you may receive, access, create, store, transmit, or process patient information, including personal information and health information, through the OmniH platform.
This Data Privacy, Security & Confidentiality Acknowledgment (“Acknowledgment”) establishes the minimum privacy, confidentiality, and security obligations applicable to all participating facilities using OmniH.
2. DEFINITIONS
Patient Information
“Patient Information” means any information relating to an identified or identifiable patient, including demographic information, contact information, laboratory orders, diagnostic reports, imaging reports, clinical notes, medical history, billing information, and any other information associated with the provision of healthcare services.
Personal Data
“Personal Data” means any information relating to an identified or identifiable individual as defined under applicable data protection laws, including the Ghana Data Protection Act, 2012 (Act 843), and may include health information, contact information, identification numbers, financial information, and other personal information processed through the OmniH platform.
Authorized User
“Authorized User” means an employee, contractor, consultant, clinician, administrator, or other individual who has been authorized by the Facility to access OmniH for legitimate business, clinical, operational, or administrative purposes and whose access has been approved by the Facility.
3. OMNIH PLATFORM ROLE
The Facility acknowledges that OmniH is a technology-enabled healthcare coordination platform that facilitates the secure exchange of information among healthcare professionals, patients, caregivers, and diagnostic facilities.
OmniH does not provide laboratory services, imaging services, medical treatment, clinical interpretation, or healthcare professional services. The Facility remains solely responsible for its own compliance with applicable laws, regulations, licensing requirements, accreditation standards, privacy obligations, security obligations, and professional duties relating to services provided by the Facility.
Nothing in this Acknowledgment shall be construed as transferring the Facility’s independent legal, regulatory, clinical, or professional responsibilities to OmniH.
4. COMPLIANCE WITH APPLICABLE LAWS
The Facility agrees to comply with all applicable privacy, confidentiality, and data protection laws and regulations, including:
- Ghana Data Protection Act, 2012 (Act 843);
- Guidance, directives, and regulations issued by the Ghana Data Protection Commission (DPC);
- Applicable healthcare, laboratory, radiology, and professional confidentiality requirements;
- OmniH privacy and security policies communicated from time to time.
The Facility shall process patient information only for lawful, authorized, and legitimate healthcare, diagnostic, operational, billing, quality assurance, or regulatory purposes.
5. CONFIDENTIALITY OF PATIENT INFORMATION
The Facility acknowledges that all Patient Information accessed through OmniH is confidential.
The Facility agrees that it shall:
- Protect the confidentiality of Patient Information;
- Use Patient Information only for authorized healthcare-related purposes;
- Limit access to personnel who require the information to perform their duties;
- Prevent unauthorized viewing, disclosure, copying, downloading, printing, or sharing of Patient Information.
The Facility shall not:
- Sell Patient Information;
- Share Patient Information with unauthorized individuals or organizations;
- Use Patient Information for marketing purposes without appropriate authorization;
- Access Patient Information for personal curiosity or non-business purposes.
6. AUTHORIZED USERS AND ACCESS CONTROL
The Facility shall implement reasonable access controls to protect Patient Information.
The Facility agrees to:
- Maintain an accurate list of Authorized Users;
- Assign access based on job responsibilities and legitimate business need;
- Disable access promptly when personnel leave employment or no longer require access;
- Maintain unique usernames and accounts whenever feasible;
- Prohibit sharing of usernames, passwords, or login credentials;
- Review user access periodically and remove unnecessary access.
The Facility shall immediately notify OmniH if unauthorized access is suspected.
7. DEVICE, SYSTEM, AND WORKSTATION SECURITY
The Facility agrees to implement reasonable safeguards for devices and systems used to access OmniH.
Such safeguards may include:
- Password-protected computers and mobile devices;
- Automatic screen-locking or session timeout features;
- Antivirus or endpoint protection software where available;
- Secure internet connections;
- Secure storage of paper records;
- Physical controls to prevent unauthorized access to workstations and patient information.
The Facility shall take reasonable precautions to prevent Patient Information from being viewed or accessed by unauthorized individuals.
8. DATA ACCURACY AND MINIMUM NECESSARY USE
The Facility agrees to:
- Use reasonable efforts to maintain accurate patient records;
- Correct known inaccuracies when identified;
- Collect, access, use, and disclose only the information reasonably necessary to perform the requested services;
- Avoid collecting unnecessary patient information;
- Maintain procedures to support the quality and accuracy of Patient Information.
9. CROSS-BORDER HEALTHCARE COORDINATION
The Facility acknowledges that OmniH facilitates healthcare coordination across national borders.
The Facility understands that authorized healthcare professionals, patients, caregivers, and healthcare organizations located outside Ghana may access information necessary for patient care through OmniH.
The Facility agrees to:
- Participate in authorized information sharing necessary for patient care and diagnostic services;
- Follow applicable legal requirements relating to cross-border processing or transfer of Personal Data;
- Maintain confidentiality and security standards for information received through OmniH regardless of the country of origin.
10. DATA RETENTION AND SECURE DISPOSAL
The Facility shall retain Patient Information only for the period required by applicable law, professional standards, contractual obligations, or legitimate healthcare purposes.
When information is no longer required, the Facility shall take reasonable measures to:
- Securely destroy paper records;
- Securely delete electronic records;
- Anonymize information where appropriate;
- Prevent unauthorized recovery or reconstruction of disposed records.
11. INCIDENT AND BREACH REPORTING
The Facility shall notify OmniH without unreasonable delay, and whenever possible within seventy-two (72) hours of becoming aware of any actual or suspected:
- Unauthorized access to Patient Information;
- Unauthorized disclosure of Patient Information;
- Loss or theft of devices containing Patient Information;
- Cybersecurity incidents affecting OmniH-related information;
- Security weaknesses that could reasonably affect Patient Information.
The notification should include:
- Description of the incident;
- Date discovered;
- Types of information involved;
- Known or suspected impact;
- Corrective actions taken or planned.
The Facility agrees to cooperate with OmniH in investigating and responding to such incidents.
12. WORKFORCE TRAINING AND AWARENESS
The Facility agrees to provide reasonable privacy and security awareness training to personnel who access Patient Information.
Training should address:
- Patient confidentiality;
- Data protection responsibilities;
- Password and credential security;
- Phishing and cybersecurity awareness;
- Incident reporting procedures;
- Appropriate use of patient information.
The Facility shall encourage ongoing awareness and accountability among staff.
13. AUDIT LOGS AND COMPLIANCE REVIEW
The Facility acknowledges that OmniH may maintain audit logs and records of platform activity.
OmniH may review such records for purposes including:
- Security monitoring;
- Incident investigations;
- Patient complaints;
- Quality assurance;
- Regulatory compliance.
Upon reasonable request, the Facility agrees to cooperate with compliance reviews or investigations relating to OmniH services.
14. PRIVACY AND SECURITY CONTACT
The Facility shall designate a primary contact responsible for privacy, confidentiality, or security matters.
The Facility agrees to notify OmniH promptly of any changes to this contact information.
15. CERTIFICATION
By signing below, the Facility certifies that:
- It has reviewed and understands this Acknowledgment;
- It will implement reasonable administrative, technical, and physical safeguards to protect Patient Information;
- It will comply with applicable privacy, confidentiality, and data protection requirements;
- The information provided in this document is accurate and complete;
- It will promptly notify OmniH of any material changes affecting compliance with these obligations;
- It has authority to enter into this Acknowledgment on behalf of the Facility.