The collection and digitisation of healthcare information has become an integral part of healthcare delivery in Kenya. Healthcare institutions routinely process information relating to patients’ medical histories, diagnoses, laboratory results, prescriptions, treatment and other aspects of their physical or mental health. Given the sensitive nature of such information, its collection, use, storage and disclosure are subject to specific legal safeguards.
The protection of healthcare data in Kenya is grounded in Article 31 of the Constitution of Kenya, 2010, which guarantees the right to privacy, and is further regulated by the Data Protection Act, 2019 (DPA), the Health Act, 2017 and the Digital Health Act, 2023, alongside subsidiary legislation and regulatory guidance issued by the Office of the Data Protection Commissioner (ODPC).
Processing of Health Data Under the Data Protection Act
Section 25 of the Data Protection Act establishes the principles applicable to the processing of personal data. These include lawfulness, fairness and transparency; collection for explicit, specified and legitimate purposes; data minimisation; accuracy; storage limitation; and integrity and confidentiality.
These principles are particularly significant in healthcare. A healthcare provider should only collect information that is adequate, relevant and necessary for the purpose for which it is being processed. Information collected for the provision of medical treatment should not automatically be repurposed for unrelated activities without a lawful basis.
Section 30 of the Act further requires a data controller or data processor to establish a lawful basis for processing personal data. Depending on the circumstances, processing may be based on consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest or other grounds recognised by the Act.
For health data specifically, section 46 provides that personal data relating to the health of a data subject may only be processed by or under the responsibility of a healthcare provider, or by a person subject to an obligation of professional secrecy under law. The provision also recognises circumstances involving public health and persons who owe a legal duty of confidentiality.
This distinction is important because consent to medical treatment should not automatically be treated as consent to every subsequent use of a patient’s personal data. The legal basis for providing treatment and the legal basis for other forms of data processing must be considered separately.
Confidentiality and Security
The legal obligation does not end once information has been lawfully collected. Healthcare providers must take appropriate measures to protect patient information against unauthorised access, disclosure, loss, destruction or damage.
The ODPC’s Guidance Note on the Processing of Health Data recommends safeguards such as access controls, secure storage, authentication, encryption and staff training. These measures are particularly relevant to electronic medical records, cloud-based systems and health applications.
Healthcare institutions should also ensure that access to patient information is limited to authorised personnel with a legitimate need to access it. Confidentiality obligations should extend to employees, healthcare professionals, contractors and third-party service providers who handle patient information.
Digital Health and Sharing of Healthcare Data
The Digital Health Act, 2023 establishes a framework for the governance and management of health data within Kenya’s digital health system.
Section 21 provides for a health data governance framework addressing matters including data quality, security, accountability and appropriate data use and sharing. Part V of the Act further addresses confidentiality, privacy and security of data within the digital health system.
Healthcare providers may also need to share information with laboratories, insurers, pharmacies, other healthcare professionals or technology providers. Such disclosure must have a lawful basis and comply with the confidentiality obligations under the Health Act and the requirements of the Data Protection Act.
Where third parties process information on behalf of a healthcare institution, appropriate contractual and organisational safeguards should be in place to protect the information entrusted to them.
Data Breaches
Healthcare data may be compromised through unauthorised access, accidental disclosure, loss, alteration or destruction.
Under section 43 of the DPA, a data controller is required to notify the Data Commissioner without delay and, where reasonably practicable, within 72 hours of becoming aware of a qualifying personal data breach. A data processor that becomes aware of a breach is required to notify the relevant data controller within the prescribed period.
Healthcare institutions should therefore have clear procedures for identifying, containing, investigating and reporting data breaches.
The importance of these obligations is also reflected in the ODPC’s recent enforcement work. The Commission’s 2026 determinations include complaints involving healthcare institutions such as Penda Health Limited, Shree Swaminarayan Hospital and St. Luke Orthopaedic & Trauma Hospital Eldoret, demonstrating the practical application of data protection requirements within the sector.
Rights of Patients
Patients are data subjects under the Data Protection Act and therefore have rights in relation to their personal information.
These include the right to be informed about the processing of their data, the right to access personal data held about them, the right to object to certain processing and the right to request correction of inaccurate or misleading information. The Act also provides for deletion of false or misleading personal data, subject to applicable legal limitations.
These rights must, however, be considered alongside other legal obligations governing medical records. A request for deletion does not necessarily require a healthcare institution to destroy records where another legal or regulatory obligation requires their retention.
Where a patient believes their health information has been unlawfully processed or disclosed, they may raise the matter with the healthcare provider and, where appropriate, lodge a complaint with the Office of the Data Protection Commissioner.
Conclusion
Healthcare data receives heightened protection under Kenya’s legal framework because of its sensitive nature. The Constitution, Health Act, Data Protection Act and Digital Health Act collectively impose obligations concerning privacy, confidentiality, lawful processing, security and disclosure.
