Compliance & Security
Every HISA system is built from the ground up for South African healthcare regulation.
Built for South African Healthcare Law
Each regulation below is directly implemented at the architectural level — not bolted on as a feature.
POPIA (Act 4 of 2013)
Protection of Personal Information Act
Full data protection compliance — right to access, right to deletion, breach notification protocols, and data subject consent management built into every system.
View official source →Health Professions Act (Act 56 of 1974)
Clinical Record Standards
Clinical record standards, practitioner obligations, and patient rights compliance. Every field and workflow maps directly to statutory record-keeping requirements.
View official source →HPCSA Guidelines
Health Professions Council of South Africa
Practitioner registration, supervised student practice roles, and continuing education compliance. Student and supervisor role separation enforced at the system level.
View official source →HL7 FHIR R4
Health Level 7 — Fast Healthcare Interoperability Resources
Full interoperability with South African EHR systems and national health data registries via HL7 FHIR R4 standard export and API integration.
View official source →How We Protect Your Data
Enterprise-grade security controls implemented at every layer of the HISA stack.
Encryption at Rest
AES-256 on all patient data fields and file blobs
Encryption in Transit
TLS 1.3 enforced on all API endpoints; HSTS headers
Authentication
JWT with 30-minute expiry; 2FA mandatory for clinicians
Role-Based Access
5 roles (Patient / Student / Clinician / Receptionist / Admin) — enforced at API layer
Session Management
Auto-logout after 30 minutes inactivity; warning at 25 minutes
Signature Storage
Base64 PNG blobs in private, non-public blob store — never in public CDN
Data Residency
All patient data stored on South African servers (POPIA-compliant jurisdiction)
Backup Policy
Automated daily encrypted backups with 30-day retention
Audit Logging
Immutable log: user ID + action + entity + timestamp + IP for every write operation
Data Handling Register
A transparent record of all data categories processed by HISA systems.
| Data Category | Where Stored | Encryption | Retention Period | Who Can Access |
|---|---|---|---|---|
| Patient Demographics | SA-hosted PostgreSQL | AES-256 at rest | Duration of care + 6 years | Clinician, Admin |
| Clinical Records (SOAP / Antenatal) | SA-hosted PostgreSQL | AES-256 at rest | Duration of care + 6 years | Clinician, Student (supervised) |
| Digital Signatures | Private blob store (SA) | AES-256 at rest | Duration of care + 6 years | Admin only |
| Audit Logs | Immutable log store | TLS 1.3 in transit | 5 years minimum | Admin only |
| Session Tokens | Memory only (no persist) | JWT signed | 30 minutes | Authenticated user |
| Contact Form Data | Resend (email transit only) | TLS 1.3 | Not stored by HISA | HISA staff only |
Immutable Audit Trail
Every write operation in a HISA system generates an immutable audit log entry containing: user ID, action type, affected entity and record ID, timestamp (UTC), and originating IP address. Logs cannot be modified or deleted by any user — including administrators.
The audit log interface is accessible to the Admin role only. Logs are exportable in CSV and JSON format for regulatory audit submissions and clinical governance reviews.
Sample log entry
{
"timestamp": "2026-04-26T08:14:22Z",
"user_id": "usr_9f3a2c",
"action": "UPDATE",
"entity": "ClinicalRecord",
"record_id": "rec_4b12d7",
"ip": "196.10.x.x"
}
Breach Response Protocol
POPIA Section 22 compliant
In the event of a data breach, HISA is committed to notifying the Information Regulator and all affected data subjects within 72 hours of becoming aware of the incident — as required by POPIA Section 22.
All breach notifications will include: nature of the breach, categories of data affected, approximate number of subjects impacted, likely consequences, and remediation measures taken.
Incident Response Contact
security@hisahealth.orgAnnual Compliance Review
Every January — all deployed systems
HISA conducts a comprehensive annual compliance audit of every deployed system — reviewing access controls, data handling procedures, audit log integrity, encryption configuration, and alignment with the current version of all applicable regulations. Clients receive a written Compliance Attestation Report upon completion.
Ready to digitise your clinical workflow?
Schedule a confidential consultation with the HISA Health clinical liaison team to discuss your facility's requirements.
No commitment required. POPIA compliant. SA-hosted infrastructure.
