Putting Data Protection at the Centre of Implementation of Digital Health Technologies
Protection and promotion of health-related human rights while using technology is an illusion if we do not talk about data protection. Transform Health Kenya is committed to ensure the right conversations take place. On 10th February 2023, Transform Health Kenya hosted a sensitization session on the Data Protection Act, 2019. The session dubbed, “Data Protection and Digital Healthcare Services,” was facilitated by a Principal Legal Officer at the Office of the Data Protection Commissioner, with 79 participants joining virtually. Participants included coalition members, civil society, communities, private sector, national and county government representatives, healthcare service providers, among others.
Digital health is a rapidly growing sector in Kenya, with the use of technology and data playing a critical role in improving healthcare outcomes. However, the use of digital health also raises important issues around data protection and privacy. The Kenyan government has taken steps to address these concerns by implementing the Data Protection Act of 2019, which sets out the rights and obligations data subject, data controllers and data processors. Participants learnt that the Act requires organizations handling personal health information to take appropriate measures to secure this information and prevent unauthorized access, use, or disclosure. There were key lessons on health data that participants left with. These were:
- The protection of personal health data is essential to ensuring that individuals can trust digital health systems and feel comfortable sharing sensitive information with healthcare providers.
- In Kenya, the protection of personal health information will be crucial in promoting the continued growth of digital health and ensuring that technology is used to improve and not to undermine the privacy and security of citizens.
- Health Data is sensitive data and can only be processed in compliance with the principles of data protection under the Act
- Health data has the potential to be used to profile an individual hence its procession is of high risk and requires a Data Protection Impact Assessment
- Data Protection Impact Assess is important to help manage the risks to the rights and freedoms of a data subject resulting from the processing of personal data by assessing them and determining the measures to address them.
Among other key lessons, the lessons above shone light on the following necessity for institutional services, programmes, projects, and partners to comply with the data protection framework. This can be done through registration with the office as a data controller and/or data processor. Health Institutions are also urged to conduct data protection impact assessments when handling health data. To ensure adherence with the law, they are advised to develop and publish a data protection policy guided by the Act. If possible, they may hire a data protection officer or contract data processors and controllers and ensure that they enter into agreements with data subjects before sharing their data.
The Transform Health Kenya Coalition purposes to take these lessons an promote a culture of Data Protection and awareness while harnessing digital health technologies and data.
