By The Weekly Vision Reporter
The Office of the Data Protection Commissioner (ODPC) has found St Luke Orthopaedic & Trauma Hospital in Eldoret liable for unlawfully disclosing a patient’s sensitive medical information and ordered it to pay Sh525,000 in compensation.
The determination, issued by Data Commissioner Immaculate Kassait in ODPC Complaint No. 2125 of 2025, concerns a case brought by *M A O, who alleged that the hospital repeatedly gave her medical test results belonging to another patient.
According to the complaint, which was lodged with the ODPC on 16 December 2025, *M A O claimed that the hospital mishandled her personal data in two key ways. First, it failed to maintain accurate and up-to-date medical records. Secondly, it disclosed the medical records of an unrelated patient as though they were her own.
The mix-up reportedly occurred on two separate occasions and involved another patient who shared a similar first name but had a different surname. *M A O also alleged that the hospital shared her sensitive health information with a third-party laboratory without obtaining her explicit and informed consent, arguing that the breach violated her privacy and caused her emotional distress.
In its defence, the hospital acknowledged that *M A O had attended the facility in July 2025 and confirmed that her samples had been referred to an external laboratory for testing. It maintained that only minimal personal information, namely her name, had been shared for identification purposes and attributed the incident to an administrative error.
After reviewing the evidence, the Data Commissioner found that the hospital had breached several key provisions of the Data Protection Act, 2019, including:
- Failing to obtain the complainant’s explicit and informed consent before sharing her personal data with a third-party laboratory.
- Breaching the transparency principle under Section 25 of the Data Protection Act.
- Failing to inform the complainant that her personal data would be processed by a third party.
- Failing to implement adequate technical and organisational safeguards, resulting in the disclosure of another patient’s medical records.
The Commissioner further observed that the hospital’s admission of an administrative error pointed to weaknesses in its data protection systems and inadequate safeguards for handling sensitive medical information.
Having established that *M A O suffered harm as a result of the breach, the ODPC ruled that she was entitled to compensation under Section 65 of the Data Protection Act. The provision allows compensation for both financial and non-financial harm, including emotional distress arising from a data protection breach.
The determination also confirms that either party may appeal the decision before the High Court within 30 days of the ruling. Under Kenyan law, medical records are classified as sensitive personal data and are subject to the highest level of protection under the Data Protection Act, 2019.
