Referring Clinician Privacy Guide
This guide is provided by Dr BN Charles's practice to help referring clinicians handle patient information more safely when making a TMS referral by email or PDF.
Please note:
-
This is practical, educational guidance. It is not legal advice, it is not a compliance certification, and it is not a guarantee that email or PDF use is risk-free.
-
You remain responsible for how you handle patient information in your own practice, in line with POPIA, the HPCSA and your professional obligations.
-
This page was reviewed by Dr BN Charles (clinical reviewer) and is current as of the last-reviewed date below.
A suitability assessment may be considered when a patient has depression that has not responded adequately to treatment, for example, where there has been an inadequate response to two or more appropriate antidepressant trials (treatment-resistant depression). Suitability is determined clinically at assessment, not from a referral form alone.
Before you send
Please provide, where available:
-
Patient knowledge or authorisation where applicable: where required, ensure the patient is aware of and has agreed to the referral, and that you have a lawful basis (e.g. consent or another lawful ground) for sharing their information.
-
Purpose limitation: send only what is needed for the TMS suitability assessment: do not include unrelated information.
-
Data minimisation: include only the information requested on the current referral/funding form (diagnosis, history, medications, relevant records). The less you send, the less there is to protect.
-
Use the current form: use the practice's current referral form so you send the right fields and the correct recipient details.
-
Recipient verification: confirm you are sending to the correct recipient and correct email address before you click send.
When you send
-
No patient information in the subject line: keep the subject line to a safe reference (e.g. "TMS referral — [practice reference]") and not patient names or identifying details.
-
Appropriate accounts, devices and networks: send from your professional account, on a device and network you control and trust; avoid public or shared computers and unsecured networks.
-
Permitted supporting records only: attach only the records the form asks for, and check the file names do not contain patient identifiers where avoidable.
-
Optional document protection: where you can, protect the document (e.g. password protection / encryption). If you use a password, provide it separately (e.g. by a different channel): do not put the password in the same message as the document.
-
Separate-password communication where used: send the password by a separate, safe method.
After you send
-
Safe acknowledgement: check for a safe acknowledgement from the practice; keep your own record of what was sent, when, and to whom (for your own good-practice purposes).
-
Suspected misdirected email or security compromise: if you believe you sent patient information to the wrong recipient, or suspect a compromise, act promptly: contact the practice, notify your own information officer / responsible person, and follow your organisation's incident process. Do not ignore it.
What the practice does after receipt of your referral
On receipt, the practice handles the information in line with its own POPIA and confidentiality obligations.
Responsibility for actions you take before and during sending remains with your practice; responsibility for how the practice handles the information after receipt sits with the practice. This guide does not transfer or alter those responsibilities.
The practice's handling is outside the scope of this checklist, which is provided for the referring side of the process.
Not an emergency service
This referral route is not an emergency service. Routine referrals are handled during normal working hours. In a psychiatric emergency, direct the patient to their nearest hospital emergency centre.
Further reading
-
Protection of Personal Information Act 4 of 2013 (POPIA): the national law governing the processing of personal information.
-
Information Regulator (South Africa): guidance and resources on POPIA compliance: https://inforegulator.org.za/
-
HPCSA Booklet 5: Confidentiality: Protecting and Providing Information and
-
HPCSA Booklet 9: Guidelines on the Keeping of Patient Records (professional records/transmission context).
About Dr BN Charles
Dr BN Charles is a psychiatrist based in Cape Town, offering specialised TMS therapy at Mediclinic Crescent Mental Health Services in Claremont. His practice is dedicated to providing advanced, evidence-based neurobiological treatments that support functional recovery for patients managing treatment-resistant depression
Specialized Training
Dr. BN Charles has completed a Clinical Certification Course in Transcranial Magnetic Stimulation ( TMS ) through the Academy of Brain Stimulation, an internationally recognised organisation dedicated to advancing neuromodulation therapies
This certification ensures that TMS treatments are delivered according to international clinical standards and best practice guidelines

.png)