The Data Protection Commission (DPC) has launched a probe into access to patient data managed by Indian-based Lightwave eHealthCare Solutions under its previous contract with the Ministry of Health for the rollout of a National Electronic Medical Records and Patient Management System.
According to the Commission, the investigation, supervised by the Minister for Communications, Digital Technology and Innovation, is being conducted in collaboration with the Ministry of Health, the Cyber Security Authority (CSA), and the National Information Technology Agency (NITA).
The goal is to determine whether personal health data has been securely managed in accordance with the Data Protection Act, 2012 (Act 843).
Alleged failures and irregularities with LHIMS implementation
Speaking at the Government Accountability Series on Wednesday, October 29, Health Minister Kwabena Mintah Akandoh revealed that the Lightwave Health Information Management System (LHIMS) contract, worth $100 million, was signed in 2019 with Lightwave Company Limited from India, to connect 950 health facilities nationwide through a centralised electronic records system.
The project, expected to be completed in three years, was extended twice — first to 2023 and later to December 31, 2024 — due to repeated implementation delays. Yet, only 450 facilities were connected by the end of the contract period.
“Out of the 950 facilities, only 450 had been connected. You would all agree that a contract meant for three years, extended to five, but with only half the work delivered, clearly shows underperformance,” he said.
Despite the poor output, the minister revealed that over $77 million, representing more than 70% of the total amount, had already been paid to the vendor.
A forensic audit, according to Mr Akandoh, revealed further irregularities in the supply of hardware components. These included inferior laptop brands, shortfalls in the number of computers supplied, and a hardware deficit of at least $18 million.
Ghana’s health data hosted in India
According to the Health Minister, perhaps the most alarming development in all of this, was the discovery that Ghana’s health data was being hosted on servers in India, leaving the nation’s electronic medical records under foreign control.
“It is unconscionable for any company to have access to the electronic medical records of Ghanaians without the state having control,” he stressed. “With the cloud infrastructure built somewhere in India, we had to act.”
GHIMS to the rescue
The Minister has since ordered all health facilities in Ghana start a process to replace the LHIMS with a new locally-developed and locally-owned solution called the Ghana Health Information Management System (GHIMS), which will give Ghana government full control of the country’s health data.
He has also referred the matter to the Attorney-General’s Department, the Data Protection Commission and national security agencies for further investigation and possible prosecution.
The DPC therefore stated that the investigation will focus on how affected data is being stored and managed, assess compliance with lawful processing, retention, and security requirements, and ensure that the rights of data subjects are protected.
The Commission said it would engage all relevant stakeholders, including LightWave eHealthCare Solutions, the Ministry of Health, and associated service partners, while working closely with CSA and NITA to ensure a transparent and efficient process.
It also assured the public that the investigation will be conducted objectively and in line with due process, reaffirming its commitment to safeguarding personal data, especially sensitive health information, and to maintaining public trust in Ghana’s digital ecosystem.
