1. Who this applies to
Every user of GomoClinic: doctors, nurses, clinical officers, pharmacists, laboratory and imaging staff, records, billing and finance staff, administrators, and our own engineers. It applies during employment and after it ends.
2. The duty of confidentiality
Information about patients, and personal information about colleagues, is confidential. This duty comes from professional codes of conduct, employment contracts and Uganda's Data Protection and Privacy Act, 2019. Breaching it can lead to disciplinary action, professional sanctions and legal liability.
3. What every user must do
- Access on a need-to-know basis only. Open a patient's record only when you are involved in their care or it is part of your job. Curiosity about friends, family, colleagues or public figures is never a reason.
- Keep your login to yourself. Your account is personal. Never share your password or let someone work under your name, and never use someone else's session.
- Lock or sign out when you step away from a shared computer.
- Talk carefully. Don't discuss patients where others can overhear, and don't share patient information on personal phones, messaging apps or social media.
- Handle printouts securely. Collect them from printers straight away, keep them out of public view, and shred them when they are no longer needed.
- Record accurately. Enter information truthfully and promptly. Correct mistakes through the system, where corrections are tracked, rather than deleting them.
- Report concerns such as a lost device, a suspected leak or a colleague misusing access to your supervisor or data protection lead immediately.
4. How access is monitored
Every change made in GomoClinic is recorded with the user, time, branch, device and the before-and-after values. Facilities can review this trail at any time, and do so when a question arises. Permissions are limited by role and branch, so most staff can only reach the parts of the system their job requires.
5. Sharing information appropriately
Sharing is part of good care. Information may be shared with others caring for the patient, with the patient themselves, with their consent, or where the law requires. If you are unsure whether to share, ask your supervisor first.
6. Leaving the facility
Accounts are deactivated when staff leave. The duty of confidentiality continues after employment ends; do not take or keep any patient information.