Digital Health Act

38. Precautions on release of sensitive personal health data

Edition: 2023-11-24 · In force

38. Precautions on release of sensitive personal health data

(1)A health data bank and health data controller, before releasing any personal health data to any person, shall—

(a)be satisfied as to the identity of the person making the request; and

(b)take reasonable steps to ensure that any personal health information intended for a person is received only by that person or—

(i)where the data subject is a minor, by a person who has parental authority or by a guardian;

(ii)where the data subject has a mental or other disability, by a person duly authorised to act their guardian or administrator; or

(iii)in any other case, by a person duly authorised by the data subject or by a court order.

(2)A health data controller shall not disclose, for the purpose of market research, personal health information that is contained in a health data information bank.

← Previous provision Next provision →

Source: Kenya Law