How to go paperless in a South African private practice (with a POPIA checklist)

Going paperless isn't about buying a scanner, or swapping the clipboard for a PDF someone emails back. It means patient information is captured once, signed once, stored once, and is findable by the right person, from intake to follow-up. This guide sets out a practical order of work for South African practices, the record-keeping rules you need to plan around, and a POPIA checklist to work through with your team.

This is general information for practice owners, not legal advice. Check your obligations with your professional body or a legal adviser.

Why piecemeal digital doesn't work

Many practices "go digital" one tool at a time: an online form here, a cloud folder there, a separate messaging app for reminders. The admin load stays the same because staff are still copying information between systems, and patient information ends up in more places than before. That's an efficiency problem, and under POPIA it's a security problem too.

A paperless practice needs five things working together:

1. Accurate capture at the start. Patient details, medical aid details and medical history are captured once, by the patient, and reused.
2. Documents that generate, sign and file themselves. Consent, scripts, referrals, sick notes and reports are created from the patient record and saved back to it.
3. Communication inside the workflow. Reminders, forms and instructions go out from the same system, so there's a record of what was sent.
4. Fast retrieval. Anyone with the right access can find what they need in seconds.
5. Room to grow. Adding a practitioner, a room or a branch doesn't add admin.

Step-by-step: going paperless in eight steps

1. Map your paper

Spend one week listing every piece of paper your practice touches: intake forms, indemnity and consent forms, medical history questionnaires, scripts, referral letters, sick notes, lab forms, invoices, statements and post-care instructions. Write down who creates each one, who files it and where it ends up. This list becomes your migration plan.

2. Pick one system as the source of truth

Choose a platform that covers the appointment book, patient records, forms, documents and communication, rather than stitching five tools together. Ask every vendor the POPIA questions in the checklist below before you sign.

3. Bring your existing patients across

Export your patient list from your current software or spreadsheet. Baselayer.med's patient data migration imports CSV files with AI-assisted column mapping and validation, so you don't retype records. Decide what happens to historic paper files: keep them, or digitise them and keep the originals until you've had advice (see the retention rules below).

4. Move intake and consent first

This is where paper causes the most rework. Set up digital consent forms and intake forms for each treatment type. Patients complete them on their own phone before the appointment, or on a reception tablet in kiosk mode. Required fields stop half-completed forms, and each signed form saves as a PDF in the patient's record.

5. Set up the appointment book and online booking

Configure practitioners, working hours, treatment durations and appointment types in the appointment book, then switch on online bookings if you want patients to book themselves.

6. Generate documents from the record

Create scripts, referrals, sick notes, lab forms and motivation letters from the patient file rather than writing them by hand, and send them to the patient by email or WhatsApp through smart communication.

7. Give everyone their own login

Shared passwords defeat the point. Each staff member should have their own login with role-based permissions, so access matches the job. This is also how you show "appropriate, reasonable" security under POPIA.

8. Go live, then switch off paper

Pick a go-live date and stop printing forms from that day. Keep one tablet at reception for walk-ins. After two weeks, review what still ends up on paper and fix it.

Record retention: what the HPCSA expects

Going paperless changes where you keep records, not how long you keep them. The HPCSA's Guidelines on the Keeping of Patient Health Records (Booklet 9) (revised September 2022) say records should ideally be kept indefinitely, especially electronic records. Where that isn't possible, they set these minimums:

Electronic records make long retention much easier, provided they're backed up, access-controlled and can't be quietly altered. Get advice before you destroy any original paper records.

POPIA checklist for a paperless practice

Health information is "special personal information" under the Protection of Personal Information Act 4 of 2013 (POPIA). Section 32 allows medical professionals and practices to process it where necessary for treatment and care or for practice administration, subject to a duty of confidentiality. The rest of the Act still applies, so use this as a working checklist:

• ✓Information Officer registered. The practice owner is the Information Officer by default. Register with the Information Regulator.
• ✓Privacy notice. Patients are told what you collect, why, who you share it with (medical schemes, labs, referral partners) and how to access or correct it (section 18).
• ✓Collect only what you need. Review your intake form and remove fields you don't use.
• ✓Security safeguards (section 19). Individual logins, role-based access, encrypted storage and backups, and devices that lock.
• ✓Operator agreements (sections 20–21). Every vendor that processes patient information for you, including your practice software, needs a written agreement covering security and confidentiality. Baselayer.med's is our DPA.
• ✓Know where your data lives (section 72). Ask vendors where patient data and backups are stored and processed, including any AI features, and how cross-border transfers are covered.
• ✓Breach plan (section 22). Know who decides, and how you'll notify the Information Regulator and affected patients if information is compromised.
• ✓Access requests. Have a process for patients who ask for a copy of their records.
• ✓Retention. Align your retention settings with HPCSA Booklet 9, and don't delete records early.
• ✓No patient data in personal WhatsApp or email. Send through the practice system, so there's a record and you control access.

Getting started with Baselayer.med

A typical setup looks like this:

1. Create your practice account. Add your practice name and logo, then invite your team. Each person gets their own login with role-based permissions.
2. Configure your forms. Start from the consent and intake templates for your profession, then edit fields, wording and conditional logic.
3. Set up your appointment book. Add practitioners, hours, appointment types and colours. Changes sync across devices in real time.
4. Enable kiosk mode. Lock a reception tablet to the form screen. Patients tap, complete, sign and hand it back, and the form is in their record instantly.
5. Import your patients with patient data migration.

From there, add AI-assisted clinical notes, scripts and referrals, lab forms, and email and WhatsApp communication. Electronic medical-aid claims are launching soon.

Baselayer.med is built in South Africa for nine professions, starting with dentistry. Plans are Practice: R2 499/month (unlimited users) and Solo: R899/month (up to 2 users), both with every feature and a 30-day free trial. See pricing.

Frequently asked questions

How long does it take to go paperless? The software setup can be quick. The real work is mapping your paper, importing patients and training the team. Most practices should plan a go-live date a few weeks out, then stop printing forms from that day.

Do I have to keep my old paper records after going digital? The HPCSA's Booklet 9 sets minimum retention periods (for example, 6 years after the last treatment for adults, and until age 21 for minors). Get advice before destroying any originals.

Is cloud storage allowed under POPIA? POPIA doesn't ban cloud storage. It requires appropriate security safeguards, a written agreement with any operator that processes data for you, and rules for transferring information across borders. Ask your vendor where data is hosted.

Can patients fill in forms before they arrive? Yes. Send intake and consent forms by WhatsApp or email to complete on the patient's phone, or use a reception tablet in kiosk mode.

Do I need to register an Information Officer? Under POPIA, the head of a private body (usually the practice owner) is its Information Officer and must register with the Information Regulator.

What should I digitise first? Intake and consent forms. They generate the most retyping, scanning and chasing, and every later step depends on clean patient data.

Next steps

• Read: Digital consent forms for South African practices
• Read: Cutting admin in a South African private practice
• Read: AI in South African private practice: what's safe under POPIA and the HPCSA

Ready to retire the clipboard? Start your 30-day free trial or book a demo.