Data Protection Commission Probes Ghana’s Health Data Managed by Indian Firm
The Data Protection Commission (DPC) has launched an investigation into access and management of patient data handled by Indian-based Lightwave eHealthCare Solutions under its former contract with the Ministry of Health for the rollout of a National Electronic Medical Records and Patient Management System.
According to the Commission, the probe — supervised by the Minister for Communications, Digital Technology and Innovation — is being conducted in collaboration with the Ministry of Health, the Cyber Security Authority (CSA), and the National Information Technology Agency (NITA).
The investigation seeks to determine whether Ghanaians’ personal health information was securely stored and processed in compliance with the Data Protection Act, 2012 (Act 843).
Irregularities with $100m LHIMS Contract
Speaking at the Government Accountability Series on Wednesday, October 29, Health Minister Kwabena Mintah Akandoh disclosed that the Lightwave Health Information Management System (LHIMS) contract, valued at $100 million, was signed in 2019 to connect 950 health facilities nationwide through a centralised electronic records platform.
The project, originally scheduled for completion within three years, was extended twice — first to 2023 and later to December 31, 2024 — due to repeated implementation delays. However, only 450 facilities were connected by the end of the contract period.
“Out of the 950 facilities, only 450 had been connected. You would all agree that a contract meant for three years, extended to five, but with only half the work delivered, clearly shows underperformance,” the Minister stated.
Despite the limited progress, more than $77 million, representing over 70 percent of the total contract value, had already been disbursed to the vendor.
A subsequent forensic audit, Mr Akandoh said, uncovered several irregularities in the supply of hardware, including the delivery of inferior laptop brands, shortfalls in computer quantities, and a hardware deficit estimated at $18 million.
Ghana’s Health Data Hosted Abroad
Perhaps most concerning, the Minister revealed, was the discovery that Ghana’s electronic medical records were being hosted on servers in India, effectively placing sensitive national health data under foreign control.
“It is unconscionable for any company to have access to the electronic medical records of Ghanaians without the state having control,” Mr Akandoh stressed. “With the cloud infrastructure built somewhere in India, we had to act.”
Transition to Locally-Owned GHIMS
Following these revelations, the Ministry of Health has directed all health facilities to migrate from LHIMS to a new, locally-developed and government-owned system — the Ghana Health Information Management System (GHIMS) — which will ensure full state ownership and control over citizens’ health data.
The matter has also been referred to the Attorney-General’s Department, the DPC, and national security agencies for further investigation and potential prosecution.
DPC Assures Public of Transparent Process
In a statement, the DPC said the ongoing probe will assess how affected data is stored and managed, evaluate compliance with lawful processing, retention, and security standards, and ensure that the rights of data subjects are protected.
The Commission noted that it will engage all relevant stakeholders, including Lightwave eHealthCare Solutions, the Ministry of Health, and associated partners, while collaborating closely with the CSA and NITA to guarantee a transparent and efficient process.
It further assured the public that the investigation will be conducted objectively and in accordance with due process, reaffirming its commitment to protecting personal data — particularly sensitive health information — and strengthening public trust in Ghana’s digital ecosystem.
