THE DIGITAL HEALTH BILL, 2023

Background

The Digital Health Bill, 2023 was developed to establish a robust legal and regulatory framework for the digitization of Kenya's healthcare system. Recognizing health data as a strategic national asset, the Bill aims to streamline data sharing, secure personal health information, and enable advanced electronic health services such as telemedicine, while ensuring strict compliance with the Data Protection Act, 2019.

Key Amendments

The Bill creates a completely new standalone regulatory framework that operates alongside and integrates with the Health Act, 2017 and the Data Protection Act, 2019:

• Establishment of the Digital Health Agency: Section 5 establishes the Agency as a body corporate to oversee the digital health ecosystem, manage core digital systems, and certify digital health solutions.
• Comprehensive Integrated Health Information System: Established under Section 15 to serve as the infrastructure for the collection, analysis, storage, sharing, and retrieval of physical and mental health records.
• National and County Health Data Banks: Section 26 mandates the Cabinet Secretary to establish a national health data bank, while County Executive Committee Members are required to establish county-level health data banks.

New Obligations

The Bill introduces several key operational obligations for healthcare providers, data controllers, and the newly established Agency:

• Custody of Health Data: The Digital Health Agency is designated under Section 22 as the custodian of all health data in Kenya.
• Data Classification and Lifecycle: Data controllers must classify data into categories defined in Section 19 and ensure sensitive personal health data is handled with maximum safeguard controls.
• Data Retention: Under Section 25, data held within the comprehensive system must be retained for a minimum of twenty years, unless authorized for longer under specific lawful exemptions.
• Licensing for E-Health Providers: Under Section 41, any healthcare provider delivering e-health services (such as telemedicine or electronic health records) must hold a valid licence from the relevant regulatory body in Kenya or, in the case of foreign facilities, an equivalent recognized regulatory authority.
• Consent Requirements: Section 31 requires healthcare providers to obtain explicit consent to process sensitive personal health data, except in specific situations such as emergencies or public health mandates.
• E-Waste and Health Tourism Management: Under Section 45, the Cabinet Secretary, in consultation with county governments, must develop an e-waste management system for the health sector. Under Section 46, data controllers transferring biological specimens or health records outside Kenya must obtain a report from the Director-General for Health and protect confidentiality.

Penalties

Strict penalties are established for non-compliance and data privacy violations:

• Health Data Breaches: Under Section 35, anyone who tampers with, abuses privileges of, discloses inauthentic access to, loses, steals, or unauthorizedly shares sensitive personal health data is liable on conviction to a fine not exceeding KSh 1 million, imprisonment for up to 15 years, or both.
• Obstruction and False Representations: Under Section 59(1), obstructing, hindering, or threatening an officer of the Agency, or submitting false or misleading information, carries a fine of not less than KSh 1 million, imprisonment for not less than two years, or both.
• General Non-Compliance: Any other violation of the Act's provisions without a specific penalty carries a fine not exceeding KSh 1 million, imprisonment for up to two years, or both (Section 59(2)).

Transitional Provisions

• Six-Month Compliance Window: Section 62 provides that any person, data controller, or data processor who has been handling health information prior to the commencement of the Act must align their systems and comply with the provisions of the Act within six months of its commencement.