Information about a person’s health and health care is generally considered to be highly sensitive and personal and the unlawful divulgence of this information can, in some cases, be an offence. Therefore, information of this type enjoys statutory and common law protection in South Africa.
In terms of the common law right to privacy, public disclosure of private facts is prevented.

Furthermore, statutory protection, as set out in The National Health Act of 2003, makes it an offence to disclose a patient’s information without their consent, except in specifically mentioned circumstances. The Health Professions Council of South Africa has also issued guidelines relating, inter alia, to the obligation to keep medical records confidential.

While employers cannot force their employees to be vaccinated, there are various grounds for dismissing employees who object, provided that the employer has conducted a thorough risk assessment to determine the need for vaccination. They also need to provide every possible reasonable solution to accommodate them. 

One of the grounds on which an employer can let go of an employee who refuses the jab is the refusal of sharing medical information if they wish to be exempt from their workplace's vaccine programme for medical reasons. If an employee objects on medical grounds, they may be sent for medical testing to prove the veracity of their claims.

Employers must, however, ensure that they are obtaining the consent of their employees before they send them for medical testing and that all the provisions of the Employment Equity Act are closely complied with in relation to discrimination.

However, an employer can make the disclosure of medical information mandatory for a public policy reason. Employers can argue that mandatory vaccination and vaccination-related information are critical to the organisation and necessary for the company to continue its operations. An option would be for the inclusion of an employment policy or a workplace vaccination policy which states that vaccination and Covid statuses must be disclosed. If the employer can show that the non-disclosure of it prevents the company from operating, or that it endangers others, it can go as far as dismissing the employee.

In terms of the guidelines and directives of the Health Professions Council of South Africa, registered health practitioners can be approached for a patient's medical details. Any personal information can, however, only be shared in alignment with the council's ethical rules and regulations. Confidential information can only be shared with the express consent of the relevant parties. Any of the personal information can be shared if all parties expressly grant such permission. 

However, in some instances, the law can require that medical professionals provide and/or divulge certain medical information without the consent of a patient, by way of a court order if required by law, and/or if the disclosure is in the public interest.

Although civil actions for breach of confidence are rare, the issue can be a minefield for the unwary. Thus, those who are about to reveal and/or compel the disclosure of confidential information should carefully consider their grounds for doing so and be clear that there is either consent, lawful authority, or some public interest justification.