South African healthcare is undergoing a significant digital transformation. Paper files are increasingly being replaced by electronic health records, consultations can take place over secure video platforms and prescriptions and other clinical documents can be created, shared and stored electronically.
But while healthcare is becoming increasingly digital, one fundamental requirement has not gone away: establishing who is responsible for a clinical document and ensuring that what was signed is what was subsequently relied on.
This is where the advanced electronic signature (AES) becomes increasingly important.
“Moving a healthcare process from paper to digital doesn't remove the need for trust and accountability. It changes how those requirements are achieved,” says Dr Petrus van Niekerk, founder and CEO of Udok. “A handwritten signature provides a familiar link between a practitioner and a document. In a digital environment, that link needs to be established through technology that can verify the practitioner's identity and protect the integrity of the document.”
Digitising healthcare is about more than removing paper
The shift to digital healthcare has been accelerated by greater connectivity, the normalisation of telehealth and the need to share information efficiently between healthcare providers.
A remote consultation, for example, can generate an entirely digital chain of information: the patient's details, consent, clinical notes, prescription, referral and billing information can all be created electronically.
That creates significant benefits, but it also changes the nature of the clinical record.
With a paper document, a practitioner's handwritten signature provides a visible indication of authorship and approval. A digital document needs an equivalent mechanism for establishing identity and demonstrating that its contents have not subsequently been changed.
“The question isn't simply whether a document is electronic,” says Van Niekerk. “The more important question is whether you can trust that document. Can you establish who signed it? Can you demonstrate that the practitioner authorised it? And can you tell if the document has been changed since it was signed?”
The AES as a digital trust layer
An electronic signature is not necessarily the same as an AES.
The Electronic Communications and Transactions Act 25 of 2002 provides the legal framework for electronic signatures in South Africa. An AES uses a digital certificate and defined identity verification and security processes to create a stronger association between the signatory and the document. Where legislation requires a signature and permits an AES, it provides specific legal and evidentiary benefits.
The distinction matters in healthcare because clinical documentation is not simply business paperwork. A prescription, medical report or other clinical record may have implications for patient care, professional accountability and a future legal dispute.
An AES is designed to address three fundamental questions: Who signed the document? Did they authorise it? And has the document changed since it was signed?
Its digital certificate links the signature to a verified identity, while the signature is bound to the document so that subsequent alterations can be detected.
“The value of an AES is that the signature becomes part of the document's digital integrity,” says Van Niekerk. “It isn't just an image of a signature placed on a PDF. There is a technological and legal framework behind it that helps establish the identity of the signer and the integrity of what they signed.”
From telehealth consultation to signed prescription
Telehealth illustrates why this distinction is becoming more important.
A practitioner conducting a remote consultation may never meet the patient face to face. The consultation, clinical assessment, prescription and related documentation can all be generated electronically.
The process therefore needs to establish trust without relying on physical paperwork.
A simplified digital healthcare workflow might look like this:
Patient identity → telehealth/in-person consultation → clinical record → prescription → practitioner authentication and signature → secure transmission and storage → audit trail
The AES forms an important part of that chain by establishing the practitioner's relationship with the electronic document.
It does not replace the broader professional obligations governing telehealth. Practitioners remain bound by applicable ethical requirements around informed consent, confidentiality and standards of care.
Rather, the AES provides a mechanism for dealing with one specific but critical part of digital healthcare: attribution and document integrity.
When a digital record becomes evidence
The importance of a trusted digital signature becomes particularly clear when a document is subsequently challenged.
Consider a prescription issued following a remote consultation. If the prescription is later disputed, the healthcare provider may need to establish what was issued, who authorised it and whether the document has been altered.
A properly implemented AES can provide evidence connecting the document to the verified practitioner and enabling the integrity of the signed document to be checked.
Section 13(4) of the ECT Act also provides an evidentiary presumption in relation to an AES, subject to the requirements of the Act.
“In healthcare, you have to think beyond the moment the document is created,” says Van Niekerk. “A record may need to stand up to scrutiny long after the consultation has ended. The ability to demonstrate its provenance and integrity is therefore an important part of digital healthcare maturity.”
Protecting the identity behind the signature
The security of an AES depends on more than the technology used to apply it.
The practitioner's identity must be properly established, the digital certificate securely managed and signing credentials kept under the practitioner's control. Multi-factor authentication and appropriate credential-management processes can provide additional protection.
For healthcare organisations, this makes certificate and identity management an operational consideration, not simply an IT issue.
“The signing credential effectively becomes part of a practitioner's professional identity in the digital environment,” says Van Niekerk. “It needs to be protected with the same seriousness that a practitioner would apply to any other professional credential.”
Building trust into digital healthcare
The AES does not operate in isolation. Healthcare organisations must also navigate the National Health Act, POPIA, professional requirements administered by bodies such as the HPCSA and legislation governing medicines and electronic prescriptions.
POPIA is particularly relevant because health information is classified as special personal information and requires appropriate safeguards.
The result is that digital healthcare needs several layers of protection: secure systems, appropriate access controls, confidentiality, reliable identity management, auditability and mechanisms for demonstrating the integrity of important documents.
The AES addresses one important part of that equation.
“The move to digital healthcare should not be viewed as simply replacing a paper process with a digital one,” Van Niekerk concludes. “The opportunity is to build processes where trust, accountability and security are designed into the way information is created and shared. The AES is an important part of making that possible.”
As healthcare moves further into the digital age, the signature may no longer be written in ink at the bottom of a page. But its fundamental purpose remains: to establish responsibility, provide assurance and create trust in the document that carries it.
Share
