Everything a South African private practice must have on file

A practice inspection tends to move in the same order: who is registered, are they current, where do the medicines and the waste go, and how are patient records protected. Nine documents cover almost all of it.

Reviewed by TefCo Compliance Research — last verified 7 September 2026.

In short

Registration and fee proof for every practitioner, plus CPD records that stand up to a rolling audit.
Healthcare risk waste needs a service contract and consignment records.
Patient records are health information under POPIA and attract the strictest treatment.

People

HPCSA registration certificate and proof of the current annual fee for every practitioner.
CPD records — attendance certificates and a learning portfolio showing a current rolling balance.
SANC registration and annual practising certificate for every nurse.
Employment contracts, scope of practice records and supervision arrangements.
Professional indemnity cover confirmation.

Practice and premises

Practice number and any facility licence required under the National Health Act 61 of 2003.
SAHPRA licence or Department of Health dispensing licence where medicines are held or dispensed (Medicines Act 101 of 1965, section 22C).
Medicine stock records, cold chain records and schedule register.
Healthcare risk waste service contract and consignment or manifest records.
Emergency equipment checks, first aid and incident register.
Occupational health and safety appointments and records for staff.

Patient information

Patient health records are special personal information. The Protection of Personal Information Act 4 of 2013, section 14, requires that records are not kept longer than necessary for the purpose unless retention is required or authorised by law — and health record retention is required by law, so the practice needs to be able to point to the rule it is applying.

The HPCSA's ethical guideline on keeping patient health records is the practical reference most practices work from, alongside the National Health Act.

Information Officer registration with the Information Regulator.
PAIA manual.
Patient consent and information forms.
Records retention schedule with the legal basis stated.
Data breach register and reporting procedure.
Agreements with billing bureaus, transcription services and cloud providers.

Retention periods for health records are commonly quoted as six years for adults, longer for minors. Confirm the period against the current National Health Act regulations before writing it into your policy — we have not published a figure here that we could not trace to the regulation itself.

Frequently asked

Do we need a PAIA manual if we are a small practice?

Yes. Private bodies must have a PAIA manual available, and the Information Regulator has been active on this.

Who inspects a private practice?

The Office of Health Standards Compliance inspects health establishments, including private practices, and enforces under the National Health Act framework set out in its gazetted enforcement policy.

What counts as healthcare risk waste?

Sharps, infectious material, anatomical waste and pharmaceutical waste. It is classified as hazardous waste and tracked under the Waste Classification and Management Regulations made under the National Environmental Management: Waste Act 59 of 2008, section 69.

Sources

TefCo Corporate Compliance (Pty) Ltd is a compliance management platform, not a legal, tax or advisory firm. This guide is general information, not advice. Fees, dates and thresholds change — confirm current figures with the regulator before you rely on them.