The Digital Health Act in Kenya: What Every Clinician, Lawyer and Tech Provider Must Know
- Muhoro & Gitonga Associates
- Feb 21, 2024
- 7 min read
Updated: Oct 8
Table of Contents
What the Digital Health Act Establishes
Why the Act Matters for the Health Sector
Key Definitions and Institutional Framework
Obligations for Health Providers and Tech Vendors
Data Protection, Interoperability and Consent Rules
Enforcement, Offences and Penalties
Recent Legal and Regulatory Developments (2024–2025)
Compliance Checklist for Health Businesses
Risks, Liability and Professional Implications
Regulator Inspections and Audit Preparation
1. Executive Summary
1.1 The Digital Health Act 2023 is one of Kenya’s most significant reforms in the healthcare sector. It establishes a structured framework for integrating digital technologies into healthcare delivery while protecting patient data and ensuring accountability among service providers.
1.2 By 2025, the Act has become central to both healthcare and technology law in Kenya. Its provisions affect hospitals, clinics, software vendors, telemedicine platforms, insurers, and government agencies.
1.3 The Digital Health Act introduces obligations on registration, data governance, interoperability, and accreditation. It also sets up a Digital Health Agency to oversee national standards, security, and data exchange across platforms.
1.4 For law firms, health institutions, and tech vendors, understanding the Act is now essential to avoid regulatory exposure and to remain compliant with Kenya’s evolving digital governance regime.
2. What the Digital Health Act Establishes
2.1 The Digital Health Act establishes a legal framework for an integrated national digital health system. It mandates the creation of a Digital Health Agency to coordinate and regulate digital health services across the public and private sectors.
2.2 The Act’s objectives include improving access to healthcare, ensuring safe management of health data, and standardizing electronic health records. It also encourages innovation by setting legal boundaries that support secure data sharing and telemedicine.
2.3 Importantly, the Act aims to build trust in digital healthcare by balancing technology innovation with strong safeguards for patient rights.
3. Why the Act Matters for the Health Sector
3.1 The Digital Health Act directly affects patient rights, healthcare delivery, and compliance responsibilities for medical institutions. It aligns with constitutional rights to health, privacy, and access to information.
3.2 Patients benefit from improved access to their medical records, safer telemedicine options, and clearer data consent mechanisms.
3.3 For healthcare businesses and vendors, the Act creates enforceable legal obligations. Compliance is no longer optional but a statutory requirement tied to accreditation, registration, and data protection.
3.4 Non-compliance could result in regulatory suspension, criminal liability, or loss of reputation.
4. Key Definitions and Institutional Framework
4.1 The Digital Health Agency is the central institution established under the Act. It is responsible for maintaining the national digital health information system, approving standards, and accrediting service providers.
4.2 The Digital Health Information System will be a unified platform that integrates patient data, health facility systems, and national health databases.
4.3 The Data Exchange Framework sets rules for how health information is shared between hospitals, insurers, laboratories, and software providers. It introduces mandatory technical standards and logging mechanisms.
4.4 Accreditation, registration, and compliance with interoperability standards are mandatory for all digital health service providers.
5. Obligations for Health Providers and Tech Vendors
5.1 Healthcare facilities must register and be accredited by the Digital Health Agency before offering digital health services.
5.2 Technology vendors developing digital health systems must also meet specific certification standards related to data security, system integrity, and interoperability.
5.3 Both providers and vendors are required to maintain detailed contracts that define responsibilities for data processing, ownership, security, and breach response.
5.4 All organizations processing health data must maintain up-to-date privacy policies and ensure staff are trained on compliance requirements.
5.5 Any telemedicine or remote consultation platform must have clear clinical oversight procedures, audit trails, and escalation mechanisms for adverse medical events.
6. Data Protection, Interoperability and Consent Rules
6.1 Health data is classified as sensitive personal data under both the Digital Health Act and the Data Protection Act.
6.2 The Digital Health Act reinforces data protection by requiring organizations to obtain clear, informed, and auditable patient consent before collecting or sharing data.
6.3 The Act introduces strict standards for interoperability. Systems must connect and exchange data seamlessly using secure, standardized interfaces as defined by the Digital Health Agency.
6.4 Healthcare providers must implement encryption, access controls, and data retention policies that comply with both the Act and the 2025 Data Exchange Regulations.
6.5 Every institution must maintain detailed logs of when and how patient data is accessed or shared. These records must be available for inspection by the regulator.
7. Enforcement, Offences and Penalties
7.1 The Digital Health Agency is empowered to monitor compliance, conduct audits, and issue administrative penalties.
7.2 Failure to register or obtain accreditation before offering digital health services constitutes an offence.
7.3 Other offences include unauthorized disclosure of patient information, failure to maintain data integrity, and obstruction of regulatory inspections.
7.4 Penalties include suspension of licenses, financial fines, and possible criminal prosecution.
7.5 In cases of severe data breaches, regulators may refer matters to other enforcement bodies including the Office of the Data Protection Commissioner and professional councils.
8. Recent Legal and Regulatory Developments (2024–2025)
8.1 On 12th July 2024, the Kenyan High Court declared the Digital Health Act unconstitutional. In their judgement in Aura v Cabinet Secretary, Ministry of Health & 11 others; Kenya Medical Practitioners & Dentist Council & another, a three-judge bench comprising Hon. Justice Alfred Mabeya, Hon Justice Robert Limo, and Hon. Lady Justice (Dr). Freda Mugambi found that the Act lacked adequate public participation and contained disparities inconsistent with constitutional mandates. The judgment temporarily halted implementation but allowed limited continuity while Parliament addressed the concerns.
8.2 The decision underscored the importance of transparency and stakeholder engagement in health policy-making.
8.3 In 2025, the government published the Digital Health (Data Exchange Component) Regulations. These regulations provide detailed requirements for interoperability, API standards, patient identifiers, and technical compliance.
8.4 Despite litigation, regulators have moved forward with implementation, signaling that the Act remains a living and enforceable framework.
8.5 The combination of court oversight and regulatory rollout means that compliance planning cannot be postponed. Organizations must adapt to the ongoing legal evolution.
9. Compliance Checklist for Health Businesses
9.1 Governance and Oversight
Appoint a compliance officer or team responsible for digital health law compliance.
Establish a governance framework that defines accountability and escalation procedures.
9.2 Contracts and Legal Documentation
Review all vendor and partner contracts to ensure they include clauses on data processing, liability, and confidentiality.
Maintain written service agreements with vendors handling patient data.
9.3 Technical and Security Controls
Ensure systems meet the security and interoperability standards of the 2025 Regulations.
Implement audit trails, encryption, and secure authentication.
9.4 Training and Awareness
Conduct regular staff training on privacy, cybersecurity, and reporting protocols.
Keep training records for compliance inspections.
9.5 Registration and Accreditation
Complete registration with the Digital Health Agency.
Retain evidence of compliance submissions and approvals.
10. Risks, Liability and Professional Implications
10.1 Non-compliance may result in administrative penalties, criminal sanctions, or civil lawsuits.
10.2 Data breaches involving patient information can lead to both regulatory fines and reputational damage.
10.3 Healthcare professionals could face disciplinary action from regulatory bodies for negligence or improper use of digital tools.
10.4 Technology vendors that fail to meet regulatory standards may lose contracts and face liability for damages suffered by clients.
10.5 Professional indemnity and cyber insurance policies should be reviewed to ensure they cover digital health risks.
11. Strategic Recommendations
11.1 Integrate digital health compliance into enterprise governance. Treat compliance as a board-level issue rather than an IT problem.
11.2 Conduct annual audits to identify gaps in data management, technical standards, and contractual terms.
11.3 Use legal and technical due diligence when onboarding vendors. Only partner with companies that are accredited and compliant with Kenyan standards.
11.4 Maintain documentation showing how your organization complies with every major requirement under the Act and the 2025 Regulations.
11.5 Review and update consent procedures to reflect new rules on data portability and patient control.
12. Regulator Inspections and Audit Preparation
12.1 The Digital Health Agency is expected to conduct inspections to verify compliance. Organizations should prepare comprehensive documentation in advance.
12.2 Prepare a compliance file containing governance charts, accreditation certificates, data flow maps, consent forms, and security audits.
12.3 Maintain a record of data breaches, remedial actions, and staff training sessions.
12.4 Ensure your systems can demonstrate interoperability and adherence to the national standards when tested.
12.5 Display transparency by publishing patient privacy statements and data handling procedures on your official website.
13. Conclusion
13.1 The Digital Health Act represents a major shift in Kenya’s healthcare and technology landscape. It brings structure, accountability, and data integrity into health service delivery.
13.2 Despite court challenges, the Act continues to shape policy and practice. The publication of the 2025 Regulations demonstrates that Kenya is moving firmly toward digital transformation in health.
13.3 Health providers, legal advisors, and technology vendors must proactively align with the law, strengthen data protection measures, and document compliance activities.
13.4 The future of healthcare in Kenya is digital. Institutions that adapt early will gain regulatory trust, operational efficiency, and patient confidence.
14. Frequently Asked Questions (FAQs)
Q1: Is the Digital Health Act currently in force?
Yes. Although parts were challenged in court, the Act remains in effect, and implementing regulations were published in 2025. Compliance is therefore required.
Q2: What is the role of the Digital Health Agency?
It oversees registration, accreditation, standard-setting, and enforcement for all digital health systems in Kenya.
Q3: Does the Act apply to private hospitals and telemedicine companies?
Yes. Both public and private providers, including telemedicine platforms, must comply with the Act’s registration and data protection requirements.
Q4: What are the penalties for non-compliance?
Penalties range from administrative fines and suspension to criminal prosecution for serious breaches involving data misuse or patient harm.
Q5: How should healthcare providers prepare for compliance?
Providers should register with the Agency, train staff, secure patient data, review vendor contracts, and conduct annual compliance audits.
Q6: Are software vendors required to be accredited?
Yes. Vendors that develop or operate health systems must be registered and meet specific technical standards before deployment.
Q7: What happens if patient data is shared without consent?
Unauthorized sharing of health data violates both the Digital Health Act and the Data Protection Act and may attract legal and regulatory penalties.
To explore this further, see the Digital Health Act.
