🇳🇬National Health Act, 2014

← Back to laws in Nigeria

Nigeria's health privacy layer

The National Health Act, 2014 is not a general privacy law. It is the framework for regulating, developing and managing Nigeria's national health system and setting standards for health services. But because health services depend on health records, patient information, research data and confidential clinical relationships, the Act is an important sectoral privacy instrument.

For health-sector organisations, the National Health Act should be read together with the NDPA and GAID. The NDPA supplies the general personal data rules. The National Health Act supplies the health-specific duties around users, records, confidentiality, access and protection of health records.

Why health data needs a separate layer

Health information is among the most sensitive categories of personal data. It can reveal a person's physical or mental condition, treatment history, diagnosis, medication, disability, reproductive information, genetic information, infectious disease status and family health history. Misuse can lead to stigma, discrimination, employment consequences, insurance consequences and social harm.

The National Health Act recognises health users as rights holders within the health system. It regulates health establishments, healthcare providers and health workers, and sets duties that shape how patient information is created, stored, disclosed and accessed.

Health records and confidentiality

Part III of the Act deals with rights and obligations of users and health care personnel. The arrangement of sections includes user knowledge, dissemination of information, obligation to keep records, confidentiality, access to health records, access to health records by health care providers, protection of health records and complaints.

The compliance implication is clear: healthcare organisations must not treat health records as ordinary business documents. Records should be accurate, protected, accessible only to authorised persons, retained under lawful retention rules and disclosed only where permitted. Confidentiality is a professional, statutory and data protection obligation.

User knowledge and informed treatment

The Act addresses user knowledge and dissemination of information. This connects directly with privacy transparency. A patient should understand relevant information about services, treatment and records. Under the NDPA, this also means clear information about the purposes of processing health data, lawful basis, recipients, retention and rights.

In practice, health privacy notices should be more specific than ordinary website notices. They should explain patient registration data, medical records, billing information, insurance data, laboratory data, referrals, public health reporting, research use, emergency disclosures and access rights.

Access to health records

The Act recognises access to health records, including access by healthcare providers. This access framework must be managed carefully. Patients need meaningful access to their records, but health establishments also need controls to prevent unauthorised staff browsing, excessive disclosure, informal sharing or access without a care-related reason.

Under NDPA-style governance, access should be role-based and logged. A hospital should be able to show who accessed a record, why they accessed it, whether the access was linked to treatment or administration, and whether inappropriate access was investigated.

Protection of health records

The Act's health record protection provisions should be operationalised through security controls: secure electronic medical record systems, restricted physical files, confidentiality undertakings, authentication, audit logs, encryption where appropriate, secure referrals, controlled laboratory data sharing, backup and recovery measures, and breach escalation.

Health-sector breaches can be more serious than ordinary contact-data breaches. A leak of HIV status, pregnancy information, psychiatric treatment history, sexual health records or genomic data can cause lasting harm. This is why health establishments should treat DPIAs, access logging and breach response as core patient-safety controls.

Research and health information systems

Part IV of the Act addresses the National Health Research and Information System, research or experimentation with human subjects, the National Health Research Ethics Committee, health research ethics committees and the National Health Management Information System. These provisions are important for health research, public health data and health statistics.

Research use should be assessed through both health ethics and data protection. The fact that data is useful for research does not remove the need for lawful basis, ethical review, minimisation, de-identification where possible, security and restrictions on re-identification.

How the Act connects with NDPA compliance

The NDPA recognises health information as sensitive personal data in substance, even where the National Health Act creates the sectoral framework. Healthcare providers should therefore build integrated controls: patient privacy notices, lawful basis assessment, staff confidentiality, access governance, patient rights workflows, processor contracts for laboratories or cloud vendors, DPIAs for electronic systems, and breach notification processes.

For hospitals, clinics, laboratories, HMOs, telemedicine platforms and healthtech companies, the practical question is not whether the National Health Act or NDPA applies. In most serious health data scenarios, both frameworks should be treated as relevant.