A Nigerian hospital that hands over a patient's file to an employer, insurer or relative without proper authority is now breaking two sets of rules at once: the long-standing duty of medical confidentiality, and the Nigeria Data Protection Act 2023, which classifies health data as sensitive personal data. The practical instrument that keeps disclosures lawful is a written medical release authorization signed by the patient. This guide explains when one is needed, what it must contain, and where consent has limits.
Legal basis: Nigeria Data Protection Act 2023
medical release authorization nigeria — free, fillable template; download as PDF or Word.
Two layers of protection over your medical file
Professional confidentiality. Nigerian physicians are bound by the ethical duty of confidentiality reflected in the profession's Code of Medical Ethics — disclosure without patient authority exposes the practitioner to disciplinary action before the Medical and Dental Council of Nigeria.
Data protection law. The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission (NDPC) and put personal data processing on a statutory footing, building on the earlier Nigeria Data Protection Regulation (NDPR) of 2019. Health information falls in the sensitive category, which demands a clear lawful basis — most commonly the patient's explicit consent — before it is disclosed to third parties. Hospitals, HMOs, laboratories and insurers processing that data are data controllers or processors with their own compliance duties.
When a written release is required
- an insurer assessing a claim or underwriting a policy;
- an employer requesting fitness-for-work information beyond a bare certificate;
- a lawyer assembling medical evidence for a personal-injury claim;
- a relative collecting records on the patient's behalf;
- transfer of records to another hospital at the patient's request.
Emergencies, statutory reporting of certain communicable diseases, and court orders are the classic situations where disclosure may proceed on a legal basis other than consent — narrow lanes, not general exceptions.
What a valid authorization contains
- Patient identification — full name, date of birth, hospital/folder number;
- Who may disclose — the named hospital or practitioner;
- Who may receive — a named recipient, not “any interested party”;
- Exactly what is covered — a date range and record types (consultation notes, lab results, imaging), rather than the entire file by default;
- Purpose of disclosure — consent under data-protection principles is purpose-bound;
- Expiry and revocation — a validity period and a statement that the patient may withdraw consent prospectively;
- Signature and date — by the patient, or a parent/guardian for a minor, or a duly authorised representative (for example under a power of attorney) for an incapable adult.
Limits of consent
Consent obtained under pressure — an employer conditioning salary on a blanket release, for instance — sits uneasily with the NDPA's requirement that consent be freely given, and over-broad releases (“all records, forever, to anyone”) invite exactly the disputes the written form exists to prevent. Recipients should also remember data-minimisation: request the records the purpose actually needs.
Patients' access to their own records
Data-subject rights under the NDPA include access to one's own personal data. A patient asking for their own file is exercising a right, not asking a favour — though hospitals may follow verification procedures and charge reasonable administrative costs per their policies.
A precise medical release authorization template for Nigeria puts the patient, recipient, scope, purpose and expiry into a single signed page that satisfies both the hospital's records department and NDPA-conscious compliance teams.
Need the document itself? Download the free template →
This article is general information, not legal advice — see our accuracy & editorial policy. Confirm the cited law is current before relying on it.