The Digital Health (Health Information Management Procedures) Regulations, 2025

AI-assisted research summary: The Regulations may be cited as the Digital Health (Health Information Management Procedures) Regulations, 2025.

AI-assisted research summary: Requires ensuring safe management of health information.

AI-assisted research summary: A health data controller must keep a record of engaged health data processors and must provide those processors with role-based access in the System.

AI-assisted research summary: Certain persons may report health data breaches to the Chief Executive Officer using Form HMIS 1; health data controllers and processors must notify the Chief Executive Officer of a breach within forty-eight hours in Form HMIS 1 and provide corrective and mitigation details; failure to notify as required is an offence punishable as per section 35(2) and (3) of the Act.

AI-assisted research summary: Requires personalized authentication and log-in for sensitive personal data

AI-assisted research summary: The Agency must ensure health data in the System is protected throughout its life-cycle; persons or entities must not access health data unless authorized by the client or the health data controller.

AI-assisted research summary: Extract a copy of all their data in the applicable format and transmit the data to the Agency.

AI-assisted research summary: Section 15 sets rules for archiving health data, including time-based retention thresholds, notification and a seven-day archiving trigger after notice, archival timing for deceased persons, obligations on health data controllers to deposit archived data in the County Health Data Bank, requirements for data minimization before archiving, recordkeeping and submission, and a right for persons to request access or recall of archived data.

AI-assisted research summary: Institutions using digital health solutions before these Regulations must transfer legacy data to County Health Data Banks within 24 months of County Health Data Banks becoming operational; the Agency must manage migration according to applicable protocols; failure by a health data controller or processor to migrate is an offence punishable under section 59(2) of the Act.

AI-assisted research summary: Section 17 allows a person to request health data in Form HMIS 2; sets conditions for access, provides review and appeal rights if access is denied.

AI-assisted research summary: Section 18 allows data subjects to access health data via the patient portal, permits secure sharing of their Shared Health Record through the portal, requires clients who received healthcare outside Kenya to update their medical records with guidance from the referring provider, requires data subjects to take precautions to prevent unauthorized access, and requires the Agency to monitor transfers of health-related materials outside Kenya through the System.

AI-assisted research summary: Allows a person to request health data in writing to the Agency; the Agency must verify requests, communicate decisions within forty-eight hours when satisfied, may share personal data subject to the Data Protection Act, and must carry out periodic audits.

AI-assisted research summary: Data subjects may request a health data controller in writing to correct inaccurate, outdated, incomplete or misleading health data; the controller must correct the data within seventy-two hours upon receipt of the request.

AI-assisted research summary: Health data controllers must ensure specified personal data is accessed only in de-identified form; the Agency must consider requests under subregulation (2) and notify applicants within 14 days; using sensitive personal data contrary to the Regulations is an offence.

AI-assisted research summary: Allows a person to request disclosure of a deceased person's sensitive health data; sets permitted purposes and appeal routes including a seven-day appeal to the Agency and further appeal to the High Court.

AI-assisted research summary: Mentions that sensitive personal data in emergencies is to be handled through a multi-factor authentication process governed by the policy of the health data controller of the digital health solution.

AI-assisted research summary: Health data controllers who disclose personal health data for market research commit an offence and, on conviction, are liable to the penalty specified under section 59 (2) of the Act.

AI-assisted research summary: Requires official identification documents before disclosure.

AI-assisted research summary: A health data controller must develop a health data-sharing plan.

AI-assisted research summary: Health data controllers or processors must notify the Agency in writing of their registration and the category of health data they hold within seven days of registering with the Office of the Data Protection Commissioner; the Agency must then record their details in the register on receipt of that notice.

AI-assisted research summary: The Agency must utilize existing relevant government and third party databases in performing its functions to enhance access to and utilization of healthcare services.

AI-assisted research summary: The Agency must coordinate collection and analysis of health information security threats via sector and facility Information Security Operations Centres and report to the Cabinet Secretary.

AI-assisted research summary: Requires an Information Security Operations Centre capability for real time event monitoring, analysis, log collection and aggregation.

AI-assisted research summary: The Health Sector Information Security Operations Centre is designated as the health sector focal point responsible for monitoring, detecting, preventing, responding to, investigating and attributing information security threats in the health sector and must perform a range of specific functions listed in subsection (2).

AI-assisted research summary: A Health Facility Information Security Operations Centre must monitor, detect, prevent, respond to and investigate information security threats in a health facility, and perform specified operational functions including reporting incidents to the Health Sector Information Security Operations Centre.

AI-assisted research summary: A data subject or any person aggrieved may lodge a complaint with the Agency; the Agency must acknowledge receipt within seven days and must consider the complaint within thirty days.

AI-assisted research summary: The Agency must keep an up-to-date register of complaints; entries must record complainant particulars and the complaint; the Agency must protect a complainant's identity if the complainant requests protection.

AI-assisted research summary: Admission of a complaint

AI-assisted research summary: The Agency must prepare an investigation report when an investigation is completed, and in conducting investigations the Agency must comply with the Fair Administrative Action Act (Cap. 7J).

AI-assisted research summary: The Agency may discontinue a complaint if the complainant fails or neglects to communicate without justifiable cause; the Agency must give reasons and notify both parties in writing within fourteen days of the decision; the complainant may re-institute the complaint by providing grounds for restitution.

AI-assisted research summary: A complainant may withdraw a complaint at any stage before a decision; a withdrawn complaint may be re-lodged within six months of withdrawal; re-lodged complaints are to be processed under this Part.

AI-assisted research summary: The Agency must determine the outcome of investigations and, within seven days of that determination, communicate the decision in writing to the parties, including the nature of the complaint, summary of facts and evidence, the Agency's decision and reasons, and any remedy.

AI-assisted research summary: A person aggrieved by an Agency decision may appeal to the High Court within fourteen days from the date of the Agency's decision.

AI-assisted research summary: A data subject aggrieved by a decision under the Data Protection Act must lodge a complaint with the Data Commissioner in accordance with section 56 of the Data Protection Act (Cap. 411C).

AI-assisted research summary: The Agency must certify digital health solutions in line with the Certification Framework; the Agency may set up and certify laboratory testing environments with relevant institutions to assess conformity.

AI-assisted research summary: Healthcare providers or health facilities must not use a digital health solution to provide healthcare services unless that digital health solution has been certified by the Agency.

AI-assisted research summary: Digital health solution providers must apply to the Agency using Form HMIS 4 and, before applying, must self-attest and prepare a self-attestation report; applicants must submit the documents listed in section 38(3).

AI-assisted research summary: Certification considerations include functionality and system and data quality as set out in the Certification Framework.

AI-assisted research summary: The Agency must schedule and test submitted digital health solutions, prepare a testing report, notify providers within five days of the Board adopting the report, may specify non-compliance issues, providers may take corrective action and submit evidence, the Agency issues a certificate if satisfied or will not certify if issues remain, providers may apply for review which the Agency must consider within 14 days.

AI-assisted research summary: A certificate of compliance issued under regulation 40 is valid for two years from issuance; when that period expires, a digital health solution provider must apply for re‑certification.

AI-assisted research summary: The Agency must monitor compliance by reviewing data quality assessments and conducting annual audits; digital health providers and health data controllers must comply with changes to standards within six months; the Cabinet Secretary must continuously revise Data Quality Protocols in consultation with the Agency.

AI-assisted research summary: Requires certified digital health solutions to maintain change logs, ensure data quality, perform updates and data quality assessments using Agency-defined standards, notify the Agency of system changes and breaches, and allows the Agency to audit and verify compliance and corrective actions.

AI-assisted research summary: The Agency may revoke certification for certain breaches or failures by digital health solution providers or health data controllers; dissatisfied providers may apply for review; the Agency must consider review applications within fourteen days; an aggrieved person may seek the High Court; the Agency must comply with the Fair Administrative Actions Act when revoking.

AI-assisted research summary: Existing digital health solution providers in operation immediately before these Regulations continue to provide their solution but must apply for certification (Form HMIS 4) to the Agency within six months; if the Board rejects certification the provider must stop providing the solution from the rejection date.