If your health information has been exposed
Health records can include your name, address, phone number, medical conditions and insurance details. The main risks are scams that use your real medical details, threats to reveal them, and discrimination. A leak of medical information is serious even when no money is taken.
Do this first
- Find out who held the data. It's usually the hospital, clinic, laboratory or health insurer named in the notice you received.
- Ask them in writing what information was exposed, when, and what they're doing about it. Keep their reply.
- Watch for calls and messages about "test results", "treatment", "insurance claims" or "refunds". Scammers use real medical details to sound genuine.
- If someone threatens to reveal your health information unless you pay, don't pay and don't reply. Keep the messages, take screenshots, and report it to the police. Paying rarely ends it.
Then
- Protect your insurance and hospital numbers. Share them only when you start the contact, not when someone calls you.
- Check any accounts linked to that phone number or email for unusual activity, and change their passwords.
- Ask what you're entitled to. Nigeria's data protection law treats health information as especially sensitive. You have the right to know what an organisation holds about you. The organisation is expected to report a serious breach to the regulator quickly, and to tell you directly when the risk to you is high.
- If the organisation doesn't respond, you can complain to the Nigeria Data Protection Commission. Bring your written correspondence. For misconduct by a doctor or hospital, you can also raise it with the relevant professional or health regulator.
Going forward
- Ask providers how they store and share your records before you give them more.
- Be careful with health apps and forms that ask for more than they need.
- Keep photos of medical documents out of shared folders and group chats.