Hospitals Given Three Months To Acquire Data Handling Licenses

Hospitals across Kenya have been given until March 31, 2025, to obtain new licenses to handle patient data.

In a notice issued on Tuesday, December 17, the Kenya Medical Practitioners and Dentists Council (KMPDC) directed all health facilities to apply for a Certificate of Data Handler within the first three months of next year.

KMPDC CEO David Kariuki stated that starting January 1, 2025, all new health facility registrations must include a valid Certificate of Data Handler or Processor issued by the Office of the Data Protection Commissioner (ODPC).

Facilities that fail to comply with this directive face fines of up to Ksh5 million or 1 percent of their annual turnover.

The requirement is part of the government’s effort to align healthcare facilities with data protection regulations. Under the new laws, entities handling personal data must register as either data controllers—who determine how data is processed—or data processors, who handle data on behalf of controllers.

The directive comes as the government rolls out the Taifa Care health scheme, supported by the proposed Digital Health Information Management Regulations 2024.

The regulations require all health facilities accredited under the Social Health Authority (SHA) to store patient data collected during diagnosis and follow-up visits in a centralized National Health Data Bank. Facilities will also link data to County Health Data Banks through an Enterprise Service Bus (ESB) framework.

Kariuki emphasized that safeguarding patient privacy is a critical pillar of ethical medical practice.

“This requirement underscores the importance of ensuring data protection and aligning with national regulations,” he said.

According to the ODPC, registration fees for the Certificate of Data Handler are tiered based on annual turnover and staff size. Micro and small entities will pay Sh4,000, medium entities Sh16,000, and large entities Sh40,000. Entities with an annual turnover below Sh5 million or fewer than 10 employees may be exempt from registration.

The application process for the certificate takes 14 days, with licenses valid for 24 months before requiring renewal.