When I observe hospitals and health centres, one reality becomes clear to me: data protection is not failing because of a lack of law or systems. It is failing because, in practice, staff do not see it as part of their daily work. Until that changes, compliance will remain fragile.
It is not because data protection is too difficult, but because it is often viewed in the wrong way. Some see it only as laws and policies. Others reduce it to computers and IT systems. And some think it is merely about files, forms, and paperwork
But true data protection is more than that. It’s about people. It’s about trust. It’s about how staff handle patient information every single day.
You can have the best written policy, the strongest IT system, or the thickest files. But if patient folders are left open, if results are shared on personal emails, or if consent is not explained clearly, then compliance has failed.
Real compliance is about people, their behaviour, and the simple habits they repeat every day. It is not just what is written down, it is what is practiced
You can draft the best data protection policy, but if a nurse leaves patient folders unattended at the nurses’ station, you’ve failed.
You can install the most secure IT system, but if lab results are shared through personal email, you’ve failed.
You can cite GDPR or NDPA line by line, but if an Health Information Officers cannot explain patient consent in simple terms, you’ve failed.
That’s why many health organisations miss it. They treat compliance like a project, a checklist.
If your people don’t “get it,” then you don’t have compliance. You just have documents.
The Fix?
Train staff on the basics.
Keep it practical.
Make it consistent.
Build of compliance
Because at the end of the day, compliance is not what you write. It’s what you do for patients, for staff, and for trust in healthcare.
