Patient Data Law for Clinics in Nigeria and Kenya

Both laws use the same two roles. Your clinic decides why and how patient information is used, so it is the data controller. A company that stores or handles that information on your behalf, such as a records software provider, is a data processor. It may use the records only on your instructions.

Both laws expect a written contract between the two that says what the processor may do, how it keeps the records secure, which other companies it uses, and what happens to the records when the contract ends.

The Nigeria Data Protection Act 2023 is overseen by the Nigeria Data Protection Commission (NDPC). In short:

• Health information is sensitive personal data, which may be used only on the grounds the Act sets out, such as providing medical care under a duty of confidentiality.
• Organisations the Commission classes as data controllers or processors of major importance must register with it and appoint a data protection officer.
• A personal data breach that is likely to put people at risk must be reported to the Commission within 72 hours of the controller becoming aware of it.
• Patients have the right to see their information, have mistakes corrected and know who it is shared with.

The National Health Act 2014 also requires health establishments to keep patient records and to keep them confidential.

The Data Protection Act 2019 is overseen by the Office of the Data Protection Commissioner (ODPC). In short:

• Health information is sensitive personal data and needs extra safeguards.
• Controllers and processors must register with the ODPC. The registration regulations list health care among the sectors that must register.
• A controller must report a breach to the Commissioner within 72 hours of becoming aware of it. A processor must tell the controller within 48 hours.
• Under the Data Protection (General) Regulations 2021, personal data processed for providing primary or secondary health care must be processed on a server and data centre in Kenya, or at least one serving copy must be kept in Kenya.

The Digital Health Act 2023 adds rules for health information systems and how health data is shared.

• Give each staff member their own sign-in. Shared passwords hide who did what.
• Let each role see only what its job needs.
• Keep a log of who opened or changed each record, and look at it.
• Have a written agreement with every provider that holds your patient records.
• Know where your records are stored, and for Kenyan clinics, that a copy is kept in Kenya.
• Write down what you will do in the first 72 hours after a breach, and who calls the regulator.

Medly acts as your data processor. Our Terms of Service include the data processing agreement. Every sign-in, every record opened or changed and every staff change is logged, and your admins can search and export the log. If anything goes wrong with your records’ security, we tell you within 24 hours of finding out, so you have time to meet your own deadline. Records of clinics in Kenya are stored and processed in Kenya, backups included.

This guide is general information and not legal advice. Check your own obligations with a lawyer or a licensed data protection compliance organisation.