NDPA DSAR in Nigerian Hospitals: What a Patient Data Export Should Include

A lawyer's letter, an HMO dispute, or a calm patient at the front desk can all ask the same thing: give me a copy of my data. Under the Nigeria Data Protection Act 2023, that request is a data subject access request (DSAR). A photocopied folder, a WhatsApp zip, or a slide titled "NDPA compliant" is not an answer.

This guide is for medical directors, administrators, and privacy owners buying EMR or HMS in Nigeria. Pair it with patient consent, who opened the chart, NDPC controller duties, and the NDPA healthcare overview. Score the export on a named patient. This is operational practice, not legal advice.

What is an NDPA DSAR in a Nigerian hospital?

A DSAR is the hospital's duty, as controller, to give a data subject access to the personal data you hold about them, in a form they can use. Health records are sensitive personal data. The clinic decides why the record exists. The software vendor usually processes it on the clinic's instructions.

Keep the language boring: who asked (patient, verified guardian, or counsel), what you actually store, a portable file rather than a screenshot, which owner or admin ran it, and what you refused (retention, legal hold, identity not verified). Never a silent ignore. A shared "nurse" login makes the pack fiction.

A DSAR is not a handover PDF, not the patient portal, and not a certification stamp. Prefer NDPA-oriented consent logging and a patient-access audit trail. Do not buy "NDPA certified," "fully NDPA compliant," "NDHI ready," or "FHIR national exchange" as a substitute for a file you can open.

DawaHQ labels the staff JSON export as an NDPA_DSAR_EXPORT and cites NDPA 2023 Section 34 in that file's metadata. That is product text. It is not a legal opinion that your hospital has finished its NDPA duties.

What should a patient data export include?

Ask for named categories, then open the file. If the vendor says "all patient data" and cannot list the tables, they have not shown a DSAR.

| Category | Why buyers ask | |----------|----------------| | Patient row | Name, phone, identifiers, HMO fields you actually store | | Visits / queue history | When they attended, not only the last bill | | Prescriptions and items | What was ordered | | Invoices and items | What was charged | | Appointments | Booked and completed slots | | Lab requests and items | What was ordered in the lab module | | Vitals | Recorded measurements | | Consent history | What was granted or withdrawn, which version, who captured it | | Document metadata | That a scan or letter exists (type, title, date), even if the file itself is a separate store |

On DawaHQ, an owner or clinic admin (the manage_settings capability) can generate that JSON from GET /api/patients/[id]/dsar. The download filename looks like dsar-{patient-id}-{date}.json. The query is clinic-scoped. A doctor, nurse, or cashier who lacks that capability gets 403, not a quiet empty file.

The JSON includes those nine packages. It does not automatically include every clinical module you may have switched on:

• SOAP consultation notes live on the consultations table. The DSAR JSON currently exports patient_visits (queue / visit rows), not the consultation note pack.
• IPD admissions, nurse chart, MAR, theatre, dialysis, ICU scoring, radiology reports, and HMO claim batches are not in this JSON.
• Uploaded document files are not streamed into the JSON. The export lists document metadata (id, type, title, mime type, notes, created at, uploaded by).

A buyer who needs a fuller chart should also walk Export PDF and the live modules. One file is not the whole hospital.

How is a DSAR JSON different from the medical-record PDF?

Hospitals mash these together. Vendors let them.

DSAR JSON (owner / admin). Portable structured file. Categories listed above. No dedicated "Download DSAR" button on the patient chart today: the route is staff-authenticated. Confirm the path in the demo rather than hunting a marketing icon.

Export PDF (owner / admin). The patient chart has Export PDF. That pack is demographics plus consultation history (the PDF renders up to 20 consultations) plus invoice lines. Useful handover. Not the DSAR JSON.

Logging split. The PDF export writes a patient-access row and a staff activity export event. The DSAR JSON route, as shipped, does not call that same access-log helper. If your SOP says every export is logged on the chart, test the JSON path. Do not assume the reports tab lists the DSAR download.

Can patients download their own EMR from the portal?

They usually want a subset: next appointment, a completed lab summary, an invoice, a receipt. That is reasonable. It is still not a DSAR workflow.

DawaHQ's patient portal is clinic-branded mobile web: OTP sign-in, book/view appointments, completed lab summaries (not raw analyser values), and invoice list plus receipt download. Enable it per clinic. Patients do not pay bills online from the portal today. There is no patient self-serve "request my full data" inbox and no 30-day SLA clock in the product.

The hospital still needs a named intake: log the request, verify the requester, decide lawful limits, fulfil from the staff export or explain the limit, and keep an off-system ticket. Software can produce the pack. It cannot invent a DPO.

Does a DSAR export make the hospital NDPA or NDPC compliant?

No.

NDPA is about how your hospital processes patient data as a controller. Prefer NDPA-oriented consent logging and a patient-access audit trail. DawaHQ is built to align with those controls. We do not sell "NDPA certified" or "fully NDPA compliant." Filing, a DPO where required, breach process, and staff behaviour remain yours. See NDPC registration.

NDHI / FHIR / "national EMR." A private HMS export is not a national exchange.

NHIA / HMO. Claim batches belong in HMO claim workflows. They are not a DSAR and not an NHIA national portal.

Erasure vs retention. Clinical records often cannot vanish. DawaHQ records a retention policy (minimum 7 years, MDCN-oriented; paediatric records recommended longer). Changing that number is owner-only. Clinical mass-delete is not automated. The retention cron reports age candidates. It does not wipe the ward. An export also does not certify that the care was correct.

How should hospitals handle erasure without destroying the chart?

The useful product move is anonymise, not "delete the admission so the audit disappears."

On DawaHQ, owner or clinic admin sees a Data & Privacy block on the patient chart. Anonymise patient data asks for a reason (patient_requested, legal_requirement, deceased, other) and the word CONFIRM. The action:

• Replaces name, phone, email, date of birth, address, next of kin, NIN, NHIA/HMO identifiers, referral free text, allergy/notes text on the patient row, and consent IP fields with placeholders.
• Sets is_anonymised with who and when.
• Purges uploaded document files from storage, then soft-deletes that metadata.
• Leaves clinical shells (consultations, prescriptions, lab rows) in place for audit.
• Writes patient_anonymised to the staff activity log with the reason.

That is identifier erasure, not a guarantee that every backup or paper copy is gone. Counsel should set when you refuse, when you anonymise, and when a legal hold blocks both.

What else is "patient export" that is not a DSAR?

Keep the names separate.

Consent log. Type (data_processing, whatsapp, email, clinical_procedure, research), granted or not, version, method (digital, verbal, written), staff user, optional IP. Withdrawal is another row. See patient consent.

Patient-access log. Who opened the chart, a consultation, IPD, theatre, dialysis, or the PDF export. Separate from failed logins. See hospital audit trail.

CSV / Excel masters. Patient, drug, lab, HMO, and store-item imports help migration. They are not a data-subject pack.

WhatsApp reminder consent. Clinic-owned credentials and STOP. A reminder job is not a DSAR and not a promo list.

What should you test in a DSAR demo?

Run last month's awkward request, not a brochure.

1. Use an owner or clinic admin login on a named patient. Confirm a doctor or cashier cannot pull the DSAR JSON (403).
2. Open the JSON. Confirm metadata (NDPA_DSAR_EXPORT, exported at, exported by, clinic id) and the nine packages. Confirm consultation SOAP notes are not silently inside.
3. Click Export PDF. Confirm it is a different pack (consultations + invoices) and that a patient-access row exists for the PDF.
4. Ask whether the DSAR JSON itself wrote an access-log row. On DawaHQ, do not assume it did.
5. Record a data_processing consent event, then a withdrawal. Confirm both rows under consent_history.
6. Anonymise a test patient only: reason + CONFIRM. Confirm the list no longer shows the real name and that clinical rows still exist.
7. Open Settings > Data retention. Confirm the recorded years (minimum 7). Ask whether old patients are auto-purged. On DawaHQ they are not.
8. Confirm the path: book a demo, request access, custom quote. No self-serve trial. No "NDPA certified" badge.

Bring the administrator and whoever will answer NDPC-facing letters, not only IT.

How does DawaHQ support DSARs today?

On clinics that run the hospital EMR/HMS:

• Owner/admin DSAR JSON with the named categories, clinic scope, and 403 for everyone else.
• Export PDF for a consultation-and-invoice pack, with patient-access logging.
• Anonymise for identifier erasure; documents purged; clinical shell retained.
• Consent log and patient-access audit trails (named clinical opens + PDF export).
• Retention policy recorded (minimum 7 years). Clinical purge not automated.
• Patient portal for day-to-day subsets, not a self-serve DSAR inbox.
• Qualified NDPA wording: consent logging, access audit, and a portable staff export. Not a certification stamp, NDHI, FHIR national exchange, or NHIA portal.

This sits on the same HMS as beds, billing, and HMO claim workflows. Pricing is sales-led from ₦25,000/month, then a scoped quote.

What to do next

Write the one-page intake this week: who logs the request, who verifies identity, who may run the export, and where the ticket lives (not a personal WhatsApp).

Then book a demo or request access. Walk one named patient, the JSON categories, the PDF pack, one consent row, and anonymise on a test record. Explore HMS for Nigeria, EMR for Nigeria, and the hospital solution. If the product cannot open a file and name what is missing, it will not help when the letter has a deadline.