A Legal Guide For The Provision Of Health Services In Nigeria Through Digital Channels

1.0. Introduction

The rapid advancement of digital technology is revolutionising various sectors globally, and healthcare is no exception. In Nigeria, integrating digital channels into the health service delivery system holds immense potential to enhance accessibility, efficiency, and quality of care. However, deploying such innovations is not without its complexities and regulatory challenges. This article examines the legal landscape of providing health services in Nigeria through digital channels. It aims to equip healthcare providers, technology developers and other stakeholders with a comprehensive understanding of the legal frameworks, regulatory requirements, and best practices that govern the digital healthcare ecosystem in Nigeria. From licensing, personnel, tax and data protection obligations, this article addresses the critical legal considerations necessary to ensure compliance, protect patient rights, and encourage the growth of digitisation of health services in the country.

2.0. Legal Basis for Providing Digital Health Services in Nigeria

Although the Nigerian legislature, the National Assembly, has not passed any laws directly addressing the provision or regulation of health services in Nigeria through digital channels, some sector regulations have taken steps to clarify the practice under their codes and regulations.

The Code of Medical Ethics in Nigeria (the "Medical Code") issued by the Medical and Dental Council of Nigeria ("MDCN") recognises telemedicine practice as a developing form of medical practice. The Medical Code describes telemedicine as "medicine requested and practised at a distance, and is particularly useful for patient care and management by general practitioners and specialists in accessing tele-support in their daily practices on the basis of requirements for specialist consultation in various specialities of medicine and dentistry." The Medical Code cautions registered practitioners rendering telemedicine services to continuously assess and avoid medico-legal pitfalls in areas such as confidentiality, professional competence, legal and registration status of the specialist being consulted, equipment reliability, sustainable continuity of patient management, and timely patient referral.

The Pharmacists Council of Nigeria ("PCN") introduced the Online Pharmacy Regulation 2021 ("Regulation") to regulate and enable digital innovation in the provision of pharmaceutical services. The regulation allows for, among other things, the registration and regulation of internet-based pharmaceutical service providers in Nigeria. Under the Regulation, every online pharmacy must operate in line with best practices and within relevant regulations in the telecommunications sector. The Regulation empowers the PCN to close down any unregistered internet-based pharmacy platform or website and prescribes penalties for lack of compliance with the Regulation.

3.0. Compliance Obligations of Digital Health Service Providers

3.1 Licensing

Telemedicine Practice

There is no special licensing regime for telemedicine platforms or operators in Nigeria.

Online Pharmacies

Online pharmacies must be registered with the PCN before operating in Nigeria¹.

3.2 Qualified Personnel

In operating a telemedicine platform targeted at Nigeria, the platform must utilise qualified and licensed medical practitioners in their respective jurisdictions in providing the services to Nigerians. When Nigerian medical practitioners render services on a telemedicine platform, they must be registered with the MDCN. The Medical and Dental Practitioners Act² (the "Act") provides for the categories of persons licensed and qualified to practice or provide medical services in Nigeria.

In addition, owners and operators of digital health service channels must ensure that persons engaged to provide relevant services are qualified and licensed under the relevant Nigerian laws to provide that particular service. We have set out below examples of medical personnel and the relevant bodies that they are required to register with:

Physiotherapists, chiropractors, occupational therapists, osteopaths, and speech therapists are required to be licensed by the Medical Rehabilitation Therapists Board of Nigeria;
Pharmacists are required to be registered with the PCN;
Medical laboratory scientists are to be licensed by the Medical Laboratory Scientist Council of Nigeria ("MLSCN"), and all premises for the practice of medical laboratory science shall be fully registered with the MLSCN for such purpose;
Optometrists and dispensing opticians are to be registered with the Optometrists and Dispensing Opticians Registration Board of Nigeria;
Health record officers are to be registered with the Health Records Officers Registration Board of Nigeria;
Community health workers are to be registered with the Community Health Practitioners Board of Nigeria; and
Nurses and midwives are to be registered with the Nursing and Midwifery Council of Nigeria.

3.3 Data Protection Obligations and Safety of Health Records

The Nigerian Data Protection Act 2023 ("NDPA") is the primary law governing the use and processing of personal data in Nigeria. The NDPA applies in all situations where the (i) data controller or data processor is domiciled in, resident in, or operating in Nigeria; (ii) processing of personal data occurs within Nigeria; or (iii) data controller or data processor is not domiciled in, resident in, or operating in Nigeria but is processing personal data of a data subject in Nigeria.

With regard to the security of personal data, a data controller and/or data processor must use appropriate technical and organisational measures to ensure the confidentiality, integrity, and availability of the personal data under its control. A telemedicine platform would, therefore, be required to ensure that it protects the personal data that it collects from its users. The telemedicine platform is also required to process personal data in accordance with the principles stipulated in the NDPA for processing personal data. Under the NDPA, a data controller or data processor is required to ensure that personal data is:

processed in a fair, lawful, and transparent manner;
collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with these purposes;
adequate, relevant, and limited to the minimum necessary for the purposes for which the personal data was collected or further processed;
retained for no longer than is necessary to achieve the lawful bases for which the personal data was collected or further processed;
accurate, complete, not misleading, and, where necessary, kept up to date;
processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing, access, loss, destruction, damage, or any form of data breach.

Under the NDPA, the health status of an individual is deemed to be sensitive personal data. Sensitive personal data is defined under the NDPA to mean personal data relating to an individual's:

(i) genetic and biometric data to uniquely identify a natural person;

(ii) race or ethnic origin;

(iii) religious or similar beliefs, such as those reflecting conscience or philosophy;

(iv) health status;

(v) sex life;

(vi) political opinions or affiliations;

(vii) trade union memberships; and

(ix) any other information prescribed by the Nigeria Data Protection Commission ("NDPC") as sensitive personal data.

The health records or medical data of the users of the telemedicine platform would, therefore, be deemed to be sensitive personal data under the NDPA and would be required to be processed in accordance with the NDPA. The NDPA sets out specific legal bases for the processing of the sensitive personal data of data subjects in Nigeria. This includes instances where the data subject has given and has not withdrawn consent to the processing of his data for specific purposes. The consent of the user of a telemedicine platform is, mostly, the primary legal basis relied upon by the platform in obtaining personal data.

In accordance with the NDPA, Data Controllers and Processors of Major Importance ("DCPMI") are required to register with the NDPC within six months after the commencement of the NDPA or upon becoming a DCPMI. The NDPC defines a DCPMI as any entity which keeps or has access to a filing system (whether analogue or digital) for the processing of personal data and:

processes the personal data of more than 200 data subjects within six months; or
provides commercial Information Communication Technology (ICT) services on any digital device that has storage capacity and belongs to another individual; or
processes personal data as an organisation or service provider in the economy's financial, communication, health, education, insurance, export and import, aviation, tourism, oil and gas, or electric power sectors.

Secondly, a DCPMI is an entity that is under a fiduciary relationship with a data subject by reason of which it is expected to keep confidential information on behalf of the data subject, taking into consideration the significant harm that may be done to the data subject if such data controller or processor is not under the obligations imposed on DCPMIs. What this means is that where the telemedicine platform is deemed to be a DCPMI, it would be required to register with the NDPC.

In addition, every organisation in Nigeria is required to have data privacy and data protection policies. Regulation 2.5 of the Nigeria Data Protection Regulations 2019 ("NDPR") requires every medium through which an organisation collects or processes personal data to display a privacy policy that the data subjects can easily understand. Such media include websites, software applications, online forms, onboarding forms, and other platforms through which an organisation collects personal data. Based on this, telemedicine service providers would be required to upload their privacy policies on their platforms.

The telemedicine platform would also be required to carry out an annual audit of its data protection practices. This is because the NDPR requires all organisations that process personal data to conduct a detailed audit of their privacy and data protection practices on an annual basis, and where the data controller/processor processed the personal data of more than 2,000 data subjects within a period of 12 months, it is required to file the audit report with the NDPC annually by 15th March³ . The data protection audit is to be conducted by a Data Protection Compliance Organisation ("DPCO"). DPCOs are organisations that the NDPC licenses to provide data protection training, auditing, and consulting services to organisations in Nigeria.

In addition, under the Medical Code, a practitioner must keep all patient information in absolute confidence, even after the patient's death.

In providing health-related services through digital channels, it is envisaged that digital health platforms will receive, retain, and/or process the personal and health data of Nigerian patients. The health platform owners and/or operators will need to comply with the data protection provisions summarised above.

3.4 Tax

Telemedicine platforms, online pharmacies, and other digital health service providers incorporated or registered and operating in Nigeria are liable to the various taxes applicable to businesses in Nigeria, including companies' income tax (for companies and Limited Liability Partnerships), personal income tax (for unincorporated entities,

Business Names and Limited Partnerships), tertiary education tax, value-added tax ('VAT"), withholding tax ("WHT"), and local levies and rates, etc., in accordance with the relevant tax laws. The digitised and cross-border nature of telemedicine presents a challenge regarding the taxation of foreign-based digital platforms providing telemedicine and other digital health-related services to persons in Nigeria from outside Nigeria's borders.

Section 13 of the Companies Income Tax Act (as amended by the various Finance Acts) ("CITA") and Section 6A of the Personal Income Tax Act (as amended by the various Finance Acts) provide the legal basis for the taxation of foreign entities and persons deemed to be carrying on business in Nigeria. One of the circumstances under which a foreign company will be deemed to have derived profits from Nigeria and, therefore, taxable in Nigeria includes where such products or services are offered through electronic or digital means to the extent that the company has a significant economic presence in Nigeria ("SEP") and profit can be attributable to such activity. Under section 13(4) of the CITA, the Minister of Finance issued the Companies Income Tax (Significant Economic Presence) Order, 2020 ("SEP Order") to provide clarity as to what constitutes a SEP in Nigeria.

According to the SEP Order, a company will be deemed to have a SEP in Nigeria in any accounting year if it derives gross turnover or income exceeding NGN25 million (or its equivalent in other currencies) in a particular year from any one or a combination of the following:

streaming or downloading services of digital content, including but not limited to movies, videos, music, applications, games, and e-books to any person in Nigeria;
transmission of data collected about Nigerian users, which has been generated from such users' activities on a digital interface, including websites or mobile applications;
provision of goods and services (save for those involving connected parties) directly or indirectly through a digital platform to Nigeria; or
provision of intermediation services through a digital platform, website, or other applications that link suppliers and customers in Nigeria.

Where the company derives income exceeding NGN25 million from services provided to persons in Nigeria through the health service platforms, the company will be deemed to have a SEP in Nigeria based on the above (i.e., provision of goods and services (save for those involving connected parties) directly or indirectly through a digital platform to Nigeria).

It would, therefore, become liable to pay companies income tax in Nigeria. Foreign individuals and non-corporate entities that provide telemedicine and healthcare-related services to persons in Nigeria could also be liable to pay income tax in Nigeria.

The CITA provides for a tax rate of 20% on taxable profits for companies with an annual turnover of between NGN25 million and NGN100 million, and 30% on taxable profits for companies with an annual turnover of more than NGN100 million. In addition to becoming liable for income tax in Nigeria, the company will be required to file income tax returns in Nigeria within six months of its financial year-end.

From a VAT standpoint, foreign entities providing services to persons in Nigeria (and who earn or expect to earn over NGN25 million from such services) are required to register for VAT in Nigeria, obtain a Tax Identification Number, include VAT (at 7.5%) in its invoice to Nigeria-resident customers, and remit the VAT on a monthly basis to the Federal Inland Revenue Service ("FIRS"). The Value Added Tax Act (as amended by the various Finance Acts) ("VAT Act") presently exempts medical services and all medical and pharmaceutical products from VAT. The definition does not indicate whether the health practitioner must be licensed to practice in Nigeria for the VAT exemption to apply. Our view is that the FIRS will likely insist that the VAT exemption for medical services only applies if the service is provided by a health practitioner licensed to practice in Nigeria.

3.5 Advertisement

The Advertising Regulatory Council of Nigeria Act 2022 ("ARCON Act") established the Advertising Regulatory Council of Nigeria ("ARCON") to control and regulate the practice of advertising in Nigeria. The ARCON Act, among other things, empowers ARCON to regulate and control the practice of advertising in Nigeria and to do anything which, in its opinion, would facilitate the execution of its functions under the ARCON Act. The ARCON Act repealed and replaced the Advertising Practitioners (Registration etc.) Act ("APCON Act"), but all regulations made under the APCON Act were preserved. By this provision, the following regulations, which were issued by the now-defunct Advertising Practitioners Council of Nigeria ("APCON"), remain valid and in effect under the new ARCON regime:

the Nigerian Code of Advertising Practice, Sales Promotion, and Other Rights/Restrictions on Practice (6th Edition) (the "APCON Code"); and
the Vetting Guidelines 2017.

Digital health services providers are required to comply with the above regulations when advertising their products and services in Nigeria. The APCON Code provides, among other things, that advertisements and marketing communication shall not offer to diagnose or treat any illness by correspondence, digital, virtual, or online medium of engagement. This means that the advertisement of telemedicine practice is prohibited in Nigeria. By implication, telemedicine platform owners cannot advertise their platforms to the Nigerian public. This restriction does not, however, prevent Nigerians from using the platform.

In addition, the Code prohibits the use of health professionals to endorse any medicine, and advertisements for medical products should not offer refunds for dissatisfied users.

4.0 Conclusion

The integration of digital channels into the health service delivery system in Nigeria presents significant opportunities to enhance accessibility, efficiency, and quality of care. With a population exceeding 200 million and a significant disparity in access to quality healthcare, digital health solutions, such as telemedicine and mobile health applications, can bridge critical gaps in healthcare delivery. These services enhance accessibility, particularly for rural and underserved communities where medical infrastructure and specialist healthcare providers are limited. Additionally, digital platforms reduce the burden on hospitals, enabling faster consultations and improved patient outcomes. By leveraging technology, Nigeria can address systemic healthcare challenges, including long patient wait times, shortages of qualified healthcare professionals, and the high cost of medical care.

However, deploying these innovations requires a thorough understanding of the legal and regulatory frameworks that govern the country's digital healthcare ecosystem. Despite the absence of specific laws passed by the National Assembly directly addressing digital health services, sector regulations such as the Code of Medical Ethics in Nigeria and the Online Pharmacy Regulation 2021 provide essential guidelines for telemedicine and online pharmaceutical services.

By adhering to the regulatory requirements outlined in this article, practitioners can mitigate legal risks and contribute to a robust digital health services ecosystem. Proactive engagement with regulatory bodies and continuous assessment of medical and legal pitfalls are imperative for the safe and effective delivery of health services through digital channels.

Footnotes

1 The Pharmacists Council of Nigeria ("PCN") Online Pharmacy Regulation 2021

2 Cap M8, Laws of the federation of Nigeria 2004

3 Regulations 4.1 (5)-(7) of the Nigerian Data Protection Act

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.