Health Data, Law and Innovation in Cameroon

Cameroon has spent the last decade building the policy foundations for digital health: a long-range health sector strategy, a national digital health plan, a national health information system, and, at the end of 2024, a dedicated personal data protection law. What patients feel at the counter, however, is often still the same: a new card at every facility, results that do not follow them, and phone calls to find out which pharmacy has a medicine or which hospital has blood.

This article looks at where digital health stands in Cameroon, which laws frame the use of health data, where the practical gaps are, and how a patient-owned Health ID network such as OpesCare fits into that picture — without overstating what any single product can do.

How Cameroon's health system is organised

The health pyramid

Cameroon's public health system is usually described as a three-level pyramid:

• The central level — the Ministry of Public Health (MINSANTE) and its central services, which set policy and strategy.
• The intermediate level — the Regional Public Health Delegations, which translate national policy into technical support for the districts.
• The peripheral level — the health districts, the operational base of the system, each divided into health areas served by health centres and district hospitals.

The Health Sector Strategy 2016–2027 treats the health district as the key link in delivering care. Independent analysis has pointed out that districts were created in the 1990s but that many still lack the autonomy and equipment the model assumes; the Nkafu Policy Institute, for example, reports a 2016 evaluation finding that only a small share of the country's districts were well equipped.

The policy framework

Three documents set the direction:

• Law No. 96/03 of 4 January 1996, the framework law on health, which defines the general scope of State action in health and the goal of wider access to integrated, quality care with community participation.
• The Health Sector Strategy 2016–2027, adopted in 2016, the long-range strategy for the sector.
• The 2020–2024 National Digital Health Strategic Plan, published by MINSANTE, which builds on the Health Sector Strategy and sets out how digital tools should support Universal Health Coverage.

The national digital health plan

According to the plan itself and WHO's planning-cycle repository, the Ministry began preparing a digital health strategy in 2018, following a WHO resolution on digital health, and formal drafting started in 2019 with public and private actors from the health and ICT sectors.

The plan's vision is that digital health contributes to Universal Health Coverage through informed decision-making at every level of the health pyramid. It groups its work into strategic areas that will be familiar to anyone who has read a WHO-style digital health strategy:

• leadership and governance;
• legislation, policy and compliance;
• human resources;
• strategy and investment;
• services and applications;
• infrastructure;
• standards and interoperability.

That last area matters most for patients. Interoperability is what allows a result produced in one facility to be read in another, and a patient to be recognised as the same person wherever they go. The Ministry's website also lists a successor plan for 2026–2030, which suggests the work continues beyond the first plan's horizon.

DHIS2 and aggregate reporting

Cameroon adopted DHIS2 as its national health information system for routine aggregate data, and research published in the Journal of Global Health Reports describes its nationwide use from 2015. Studies have also found that use of DHIS2 data for local decision-making at the peripheral level remains limited.

DHIS2 is designed for counts — how many consultations, how many vaccinations — not for an individual patient's record. That is by design, and it leaves a separate need: a way to recognise one patient across facilities and let their record follow them.

Universal Health Coverage

The first phase of Universal Health Coverage (Couverture Santé Universelle) was launched in 2023. The WHO Regional Office for Africa reported more than two million people pre-enrolled within its first months, while noting the work still needed to expand services and reduce out-of-pocket spending. Any coverage scheme depends on knowing reliably who a beneficiary is — another reason patient identity matters.

The legal framework for health data

Health data is among the most sensitive personal data there is. In Cameroon, four texts are directly relevant to any digital health service.

Law No. 2010/012 on cybersecurity and cybercriminality

Adopted on 21 December 2010, this law sets the security framework for electronic communication networks and information systems, punishes ICT-related offences such as illegal access and data interference, and includes provisions on protecting privacy. For a health platform, it means unauthorised access to records is not only a breach of trust but potentially an offence.

Law No. 2010/013 on electronic communications

Adopted the same day, this law governs electronic communications networks and services and created the telecommunications regulator (ART). It was amended by Law No. 2015/006 of 20 April 2015. It matters to digital health because most patient interactions — SMS codes, mobile money, app traffic — run over regulated networks.

Law No. 2024/017 on personal data protection

Law No. 2024/017 of 23 December 2024 is Cameroon's first standalone personal data protection law, according to DLA Piper's country guide and legal commentators such as Lex Africa. Commentators report that it:

• restricts transfers of personal data outside Cameroon unless the destination offers an adequate level of protection;
• provides for an independent personal data protection authority;
• gave organisations a transition period to comply, reported as ending in mid-2026.

Some implementing details, including the setting-up of the authority, were reported as still pending at the time of writing. We do not quote penalty figures here, because published summaries disagree; read the official text before relying on any specific number.

Law No. 96/03, the health framework law

The 1996 framework law is not a data law, but it frames State action in health and the objective of integrated care. Integrated care, in practice, depends on information following the patient.

Where the gaps are

Policy has moved. The day-to-day experience has moved less. Four gaps stand out.

1. Fragmented records

A patient who sees a health centre, a district hospital, a private laboratory and a pharmacy may leave four separate records, none of which knows about the others. Allergies, current medication and recent results arrive late or not at all.

2. Duplicate identities

Without a shared identifier, the same person is registered several times — with a different spelling, a missing date of birth, a new phone number. Duplicate records split a person's history and can put the wrong result on the wrong chart.

3. Finding a medicine you can trust

WHO has issued alerts about falsified medicines found in Cameroon, including a falsified antibiotic found at street-market level in Douala in 2018. A critical review in the American Journal of Tropical Medicine and Hygiene found that most samples in Cameroonian quality studies came from the informal sector. When patients cannot quickly find a licensed pharmacy that has a medicine, the informal market fills the gap.

4. Finding blood in time

VOA reported in 2021 that blood donations collected in Cameroon fell sharply in 2020, which national blood officials attributed largely to COVID-19. Families still often search for blood themselves, hospital by hospital, when a transfusion is needed.

How a patient-owned Health ID helps

OpesCare is a private, patient-centred Health ID network operated by OPES Health Systems. It is not a government ID, it has no MINSANTE partnership, and it does not ask any facility to change the software it already runs. Here is what it actually does against each gap.

One Health ID per person

A patient registers once at opescare.com/signup/patient and receives a Health ID with a QR card. Staff at a connected facility find the patient by exact Health ID or by scanning the QR code — there is deliberately no search by patient name.

A Master Patient Index that never guesses

Behind the Health ID sits a Master Patient Index (MPI). It detects likely duplicates when patients are registered and in scheduled scans, and raises them for a human to review. Nothing merges automatically. A merge can be reversed, and the old identifier keeps working as an alias. We explain this in detail in why duplicate patient records are dangerous.

Consent before access

A clinician who wants to read a record must have a care relationship with the patient — an appointment, a care team, an episode at the facility — or a consent grant the patient approved. The patient can see who opened their record and when. Emergency "break-glass" access exists, opens only a limited profile, requires a reason and alerts the patient. See who can see your record.

Standards-based exchange

OpesCare accepts inbound data from partner systems in HL7 FHIR R4 — diagnostic reports, observations and immunisations — so results produced elsewhere can join the patient's timeline. Details are in the Health ID, interoperability layer and MPI explained.

Finding a medicine and finding blood

• The Medicine Finder shows which pharmacies on the network hold a medicine, and when they last said so.
• The Blood Finder shows available blood by group and component across connected hospitals and blood banks.

Both only show stock published by the facility itself through its live stock records. If no pharmacy on the network has reported a medicine, the finder says so — it never fills the page with sample data.

Built for the local context

The whole service runs in English and French, prices are in XAF, and bill payment at the counter supports MTN Mobile Money and Orange Money where a facility enables it. Care is never conditioned on payment.

What OpesCare does not do

Being clear about limits is part of being credible:

• It is not a hospital information system or a full electronic medical record.
• It does not handle insurance claims.
• It does not replace DHIS2; the aggregate reporting it can prepare for facilities is counts only, reviewed by an administrator before sending.
• It does not guarantee stock: availability is information to act on, not a reservation.

Conclusion

Cameroon now has a health sector strategy, a digital health plan with interoperability at its core, a national information system for aggregate data, and a personal data protection law. The missing piece for patients is practical: one identity that follows them, a record they control, and a fast answer to "where can I get this medicine, or this blood, today?"

OpesCare offers Cameroon's first Health ID: a first-of-its-kind, patient-owned Health ID network aimed at exactly that, working alongside the systems facilities already use.

Get your free Health ID at opescare.com, or, if you run a facility, apply to join the network.