The Digital Health Bill, 2023
Status Timeline
Proposed
Active now
Public Review
Pending
Debate
Pending
Executive
Pending
Final
Pending
New Digital Health Agency to Oversee Systems
Establishes the Digital Health Agency under Section 5 to develop, operationalise, and maintain the Comprehensive Integrated Health Information System. The Agency will also establish registries for clients, facilities, and health providers, and certify digital health solutions.
Twenty-Year Minimum Data Retention Period
Under Section 31, health data held in the comprehensive integrated health information system must be maintained for a minimum period of twenty years. After this period, data must be secured through de-identification, anonymization, pseudonymization, or archiving.
Licensing Rules for Telemedicine and E-Health
Section 47 requires any entity providing e-health services (including telemedicine, electronic health records, and m-health) to be licensed by a relevant regulatory body or recognized equivalent local authority.
Fines and Jail Terms for Health Data Breaches
Section 41 creates offences for tampering with, losing, stealing, or disclosing health data. Offenders face a fine not exceeding KSh 500,000, imprisonment for up to fifteen years, or both, with sensitive personal data breaches deferred to penalties under the Data Protection Act, 2019.
Bill No.
No. 57 of 2023
Gazette No.
Supplement No. 163 of 2023
Sponsor
Kimani Ichung'wah
Background
The Digital Health Bill, 2023 seeks to establish a legal framework for digital health services in Kenya. It establishes the Digital Health Agency and provides for a comprehensive, integrated digital health information system to enable data sharing, secure data systems, promote e-health service delivery, and manage health data privacy and e-waste.
Key Amendments
- Establishment of the Digital Health Agency: Under Section 5, a new body corporate is created to manage, develop, and maintain the Comprehensive Integrated Health Information System.
- Comprehensive Integrated Health Information System: Created under Section 21 to act as a secure, single source of health data, covering client registry, facility registry, health worker registry, and shared health records.
- National and County Health Data Banks: Section 32 directs the Cabinet Secretary to establish a national health data bank and county executive committee members to establish county health data banks to store and integrate health data.
New Obligations
- Data Custody and Retention: Under Section 31, data controllers must retain health data for a minimum of twenty years.
- Consent Requirements: Healthcare providers must obtain explicit consent to process sensitive personal data, unless exceptional circumstances apply (such as emergencies or public health protection under Section 30).
- Licensing for E-Health Providers: E-health providers—including those delivering telemedicine, m-health, or electronic health records—must hold a valid license from their relevant regulatory body (Section 47).
- E-Waste Management Guidelines: The Cabinet Secretary, in consultation with county governments, must develop guidelines for the safe disposal of health sector e-waste (Section 51).
- Health Tourism Restrictions: Data controllers transferring biological specimens or medical records of Kenyan citizens outside Kenya must ensure confidentiality and report transactions to the Director-General (Section 52).
Penalties
- Breach of Sensitive Personal Data: Under Section 41, anyone who tampers with, abuses access to, improperly disposes of, or steals health research, medical equipment, or aggregate data commits an offence. The penalty is a fine not exceeding KSh 500,000, imprisonment for up to fifteen years, or both.
- General Obstruction and False Statements: Under Section 59(1), obstructing an agent of the Board, disregarding Board orders, or submitting false or misleading information is punishable by a fine of at least KSh 200,000, imprisonment for a term of not less than one year, or both.
- Other Violations: Any violation of the Act for which no other penalty is specified carries a fine of up to KSh 250,000, imprisonment for up to six months, or both (Section 59(2)).
No updates tracked yet
Updates will be visible here once they are approved and applied to this bill.