Section 29: Protection of health records

(1)
The person in charge of a health establishment who is in possession of a user's health records shall set up control measures to preve unauthorised access to those records and to the storage facility in which, or, system by which, records are kept.
(2) A person who-
(a) fails to perform a duty imposed on them under subsection (1) of this Act;
(b)
falsifies any record by adding to or deleting or changing any information contained in that record;
(c)
creates, changes or destroys a record without authority to do so ;
(d)
fails to create or change a record when properly required to do so;
(e)
provides false information with the intent that it be included in a record;
(f)
without authority, copies any part of a record;
(g)
without authority, connects the personal identification elements of a user's record with any element of that record that concerns the user's condition, treatment or history;
(h)
gains unauthorised access to a record or record-keeping system, including intercepting information being transmitted from one person, or one part of a record-keeping system, to another;
(i) without authority, connects any part of a computer or other electronic system on which records are kept to any-
(i) other computer or other electronic system ; or
(ii) terminal or other installation connected to or forming part of any other computer or other electronic system; or
(i) without authority, modifies or impairs the operation of any-
(i) part of the operating system of a computer or other electronic system on which a user's records are kept; or
(ii) part of the programme used to record, store, retrieve or display information on a computer or other electronic system on which a user's records are kept,
commits an offence and is liable on conviction to imprisonment for a period not exceeding two years or to a fine of N250,000.00 or both.