Patient data protection: a practical checklist.

This guide is general information, not legal advice. Rules and fees change, so confirm current requirements with the Office of the Data Protection Commissioner at odpc.go.ke or a qualified advisor.

The law in one paragraph

Kenya's Data Protection Act, 2019 governs how organisations collect, use, store and share personal data. It is enforced by the Office of the Data Protection Commissioner (ODPC). Health information is classed as sensitive personal data, which carries stricter conditions. A hospital decides why and how patient data is processed, so it is a data controller; a software vendor that processes that data on the hospital's behalf is a data processor. Both have duties under the Act.

Registration with the ODPC

Under the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, organisations that process health data as part of providing patient care are among those required to register with the ODPC, whatever their size. Registration is done online through the ODPC portal, and certificates must be renewed before they expire. If your facility is not yet registered, start here: it is the foundation for everything else on this list.

The checklist

• Register your facility with the ODPC as a data controller and keep the certificate current.
• Map your data. List what patient data you hold, where it lives (paper files, EMR, spreadsheets, phones) and who can see it.
• Collect only what you need for care and billing, and keep it only as long as you need it.
• Get and record consent where you rely on it, for example before sending reminders or health messages.
• Limit access. Staff see what their role requires. Shared logins on the front desk are a common gap.
• Secure devices. Passwords or PINs on every phone and computer holding patient data; no patient lists in personal WhatsApp groups.
• Handle requests. Patients can ask to see, correct or delete their data. Have a simple process and a named person.
• Plan for breaches. The Act requires notifying the ODPC of a qualifying breach within 72 hours of becoming aware of it. Know who decides and who reports.
• Assess high-risk processing. New systems that process sensitive data at scale may need a data protection impact assessment before launch.
• Sign agreements with vendors who process patient data for you, and check that they are registered too.
• Train staff once a year and after any incident.

The Act allows the ODPC to issue penalty notices of up to KES 5 million or 1% of annual turnover, whichever is lower, so this is a governance issue for owners and boards, not only for IT.

Patient messaging and WhatsApp

Reminders and follow-up messages are one of the most useful things a facility can do, and one of the easiest places to get privacy wrong. Keep diagnoses and results out of messages, message only numbers the patient gave you for that purpose, record their language and consent, and honour opt-outs the same day. Our reminder templates are written with these rules in mind.

Choosing vendors

Ask every vendor that will touch patient data four questions: Are you registered with the ODPC? Will you sign a data processing agreement? Where is the data stored and who can access it? What happens to the data if we stop working together?

HealthBridge Solutions is registered with the ODPC as both a data controller and a data processor, signs a data processing agreement with every facility, and the hospital keeps ownership of its WhatsApp number and its patient data. See our privacy policy for details.

More practical guides