Introduction
Telemedicine refers to the delivery of healthcare services such as diagnosis, treatment, and prevention remotely with the use of Information and Telecommunication Technology.
The wide acceptance and adoption of telemedicine in global healthcare was accelerated by the COVID-19 pandemic. Additional factors contributing to the growth of telemedicine include technological advancement such as the increasing use of cloud technology, remote conferencing and artificial intelligence.
Telemedicine holds significant value, potential to enhance accessibility to health care services, and improving the quality of medical service delivery in Nigeria. In this newsletter, therefore, we highlight the key legal considerations that governs the practice and use of Telemedicine in Nigeria.
Regulatory Landscape
There is currently no exclusive legislation dedicated solely to telemedicine in Nigeria. Telemedicine practice intersects with multiple laws regulating healthcare, technology, data protection, licensing, and professional conduct.
The following laws regulate the practice and use of Telemedicine in Nigeria:
- The Constitution of the Federal Republic of Nigeria (1999) ["Constitution"]
Section 37 of the Constitution provides privacy protection for all citizens in respect of their homes, correspondence, telephone conversations, and telegraphic communication.
Therefore, medical practitioners who adopt telemedicine for medical services such as consultation, diagnosis, treatments and prescriptions are obligated to ensure that utmost privacy is maintained in service delivery. Medical records, health information and the line of treatment of a patient must be kept private and confidential.
- The Nigeria Data Protection Act 2023 ("NDPA" or "Act")
The NDPA is a comprehensive law that provides a legal framework for the protection of personal information including the personal data of patients. The NDPA safeguards sensitive and non-sensitive patients' data, such as medical history, laboratory test result, treatment information, clinical notes and demographic information. Healthcare service and telemedicine platform providers must therefore process the personal data of patients in accordance with the Act.
In providing telemedicine services, medical service providers are expected to comply with the NDPA by ensuring transparent data processing, and regulating cross-border transfer of patient's data. Additionally, by the provisions of the NDPA, telemedicine platforms must register with the Nigeria Data Protection Commission (NDPC) and submit periodic compliance audits to demonstrate compliance with the law.
- National Health Act 2014 (NHA)
The NHA provides a comprehensive framework for the regulation, development, and management of Nigeria's healthcare system. Section 29 of NHA mandates health establishments to implement preventive control measures to prevent patients' health records from unauthorized access. Therefore, telemedicine service providers must put adequate security measures in place to prevent unauthorized access or breach to patients' records. Section 27 of the NHA also provides for the legal basis for which a health service provider may process the personal data of a patient.
- Code of Medical Ethics in Nigeria 2008 (the "Code")
The Code expressly recognizes telemedicine in Nigeria. Appendix 5 of the Code recommends the use of encryption as a security measure for the transfer of patients' personal data. Additionally, the Code urges medical professionals to exercise caution to avoid potential legal pitfalls, particularly in areas such as maintaining patient confidentiality.
- The Medical and Dental Practitioners Act 2004 (MDPA)
The MDPA includes measures for discipline of medical and dental practitioners found culpable of misconduct. Such misconducts may include breach of data protection rights of a patient, negligence leading to data breach or such other infractions committed while adopting telemedicine in consultation, diagnosis or treatment of patients in Nigeria.
Strategies for Ensuring Compliance in Telemedicine
To navigate Nigeria's complex telemedicine regulations effectively, platform providers should:
- regularly update policies including implementing NDPA-compliant data privacy policies and operational documents, with clear patient consent, terms of use etc.;
- enhance data privacy and security by investing in security, registering with the Nigeria Data Protection Commission (NDPC), conducting mandatory annual audits, and filing audit reports as required;
- perform routine audits, risk and impact assessments to identify and address compliance gaps;
- train staff thoroughly on privacy rights, security protocols, and telemedicine-specific issues;
- implement risk mitigation via encryption, pseudonymization, and anonymization to protect patients' data;
- maintain robust patient record systems to efficiently handle consultations, prescriptions, and referrals; and
- timely submit all regulatory filings, including company annual returns to the Corporate Affairs Commission (CAC) and tax returns with the Federal Inland Revenue Service (FIRS).
Licensing and Regulatory Compliance Requirements for Operating a Telemedicine Platform in Nigeria
To operate a telemedicine business in Nigeria, compliance requirements include:
- Company Incorporation Incorporate a local company with the Corporate Affairs Commission (CAC) per the Companies and Allied Matters Act (CAMA). Foreign-owned businesses must also register with the Nigerian Investment Promotion Commission (NIPC) and obtain a business permit from the Federal Ministry of Interior
- .Registrations and Licensing
Healthcare practitioners must hold valid licenses and qualifications as required by relevant Nigerian health laws. Additional permits may be needed from the Federal Ministry of Health, NAFDAC, and others based on the telemedicine model. Telemedicine facilities in Lagos State must annually register with the Health Facility Monitoring and Accreditation Agency (HEFAMAA). - Data Privacy and Protection
Comply with the Nigeria Data Protection Act (NDPA), 2023 including registering with the Nigeria Data Protection Commission (NDPC) as a data controller/processor. The NDPA mandates security measures such as encryption and anonymization to protect patient data and regulate cross-border data transfers. - Technology Transfer
Register any foreign technology transfers, including patents related to telemedicine, with the National Office for Technology Acquisition and Promotion (NOTAP).
Conclusion
Telemedicine substantially advances healthcare delivery in Nigeria. However, achieving sustainable growth with Telemedicine requires not only innovation but also a thorough understanding of the legal framework and regulatory requirements. By addressing the key legal considerations outlined in this newsletter, businesses and innovators can develop platforms that are both compliant with regulations and capable of making a meaningful societal impact.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
