NAIROBI — In a major ruling for patient privacy in East Africa, the Office of the Data Protection Commissioner (ODPC) has ordered St. Luke’s Orthopaedic and Trauma Hospital in Eldoret to pay KSh 525,000 to a former client for the unlawful disclosure and mishandling of sensitive medical data.

The determination, issued by Data Commissioner Immaculate Kassait on April 16, 2026, follows a complaint by Merceline Akoth Odeyo, who alleged that the facility repeatedly failed to protect her private health information.

The Breach: A Case of Similar Names

The case centered on a series of administrative and technical failures that led to the exposure of the complainant’s sensitive information:

• Result Mix-ups: On two separate occasions, the hospital issued Odeyo medical test results belonging to an entirely different patient. The facility attributed the error to the fact that both patients shared a similar first name, despite having different surnames.
• Unauthorized Third-Party Sharing: The investigation found that the hospital shared Odeyo’s sensitive health data with an external laboratory without obtaining her explicit or informed consent.
• Accuracy Failures: Under the Data Protection Act (2019), data controllers are required to ensure the accuracy and currency of personal data—a standard the ODPC ruled the hospital failed to meet.

The Defense and Ruling

In its defense, the hospital described the incident as an isolated case of human error that occurred during the reconciliation of results from a third-party lab. It argued that the data processing was necessary for medical treatment and that only minimal identification data was shared.

However, Commissioner Kassait rejected these arguments, noting that an admission of administrative error actually demonstrated a failure to implement adequate technical and organizational measures.

The Penalty

The KSh 525,000 award serves as compensation for both financial and non-financial damages, including the emotional distress and loss of dignity suffered by the complainant.

“Verbal consent, without documented proof, does not meet the legal threshold for processing sensitive personal data,” the Commissioner noted in the ruling.

This decision sends a clear signal to the Kenyan healthcare sector that “human error” is no longer a valid legal shield against data protection violations. Both parties have 30 days to appeal the determination to the High Court of Kenya