Dennis Itumbi sparks outrage over alleged medical data breach in online defense of SHA

This story has significance for readers across Kenya and beyond.

Dennis Itumbi sparks outrage over alleged medical data breach in online defense of SHA

Audio By Vocalize

The incident, which erupted on X, has reignited fierce national debate over the protection of sensitive health data under Kenya's Social Health Authority (SHA) framework and the supposed privacy of patients as stipulated in the Health Act.

The controversy began when popular Advocate Ndegwa Njiru posted on X questioning the effectiveness of the government’s newly rolled-out health insurance system, accusing the government of stage-managing SHA success, and not relying on factual, ground data in its reports.

"If it’s true that SHA is working, why should the OUTGOING President @WilliamsRuto be the one staging a four hours TV show to convince Kenyans how the damn thing is working? Why have a stage-managed doctor on site while calling hospitals on a live television show just to justify and confirm that SHA is working? Why don’t you go to Mathare or Mukuru-Kwa Njenga and do a random survey on the poor hustlers on whether the damn scam is working?" Laywer Ndegwa Njiru asked.

In response, Itumbi published specific details regarding medical admissions, hospital names, bill amounts, and SHA coverage figures pertaining to Njiru’s family members, including a deceased aunt and a hospitalized cousin, citing these cases as proof that the SHA scheme was functional.

"Your Cousin f4ombDifathas was admitted in KNH for a month and had a bill of 789k. SHA paid 704k. Your maternal Auntie, passed on two weeks ago, a few weeks before her death she was admitted at Tenri Hospital and her entire bill was sorted by SHA. Do not fight wha works even with your relatives. Sina mengi ya kusema kwa sasa... " he wrote on X.

The post immediately drew widespread backlash on social media, with citizens and legal professionals raising concerns over how a government official obtained confidential health billing data and used it for a public political dispute.

Many castigated Itumbi for his unethical response, and for having the audacity to publish private hospital information regarding patients not under his watch, wondering how information that was supposed to remain confidential reached the hands of the government spinmaster.

"The egg, I understand journalists have some code of ethics something? This is a major confidentiality breach. Even for you this is waaay low. By simple fact that you have access to this information, SHA is unsafe! You’ll just disclose information on everyone you don’t agree with!" someone wrote on X.

Someone else wrote," Isn’t this private data ? How safe is our data if someone can randomly access it to prove a point on social media? This is potential grounds for a breach of confidentiality lawsuit..."

Yet another shocked Kenyan wrote, "This is a clear breach of patient confidentiality though. Given you're not a medical doctor or attending physician and this is not publicly available information, you're clearly out of DPA line."

The incident highlights growing concerns over the implementation of data privacy protections in Kenya's health sector and the government's commitment to protect these laws.

Under Kenyan law, medical and health records are classified as sensitive personal data. Section 44 of the Data Protection Act strictly restricts the processing and public disclosure of sensitive personal data without explicit, informed consent from the data subject or a legally authorized mandate.

The Health Act of 2017 guarantees every patient the right to privacy and confidentiality concerning their medical conditions, treatment procedures, and health records.

Unauthorized access or sharing of such records by state officers or insurance administrators constitutes a breach of medical ethics and duty of care.

Subsequently, unlawful processing or unauthorized disclosure of protected personal data carries substantial civil and criminal liabilities, including monetary fines imposed by the Office of the Data Protection Commissioner (ODPC) or imprisonment.

As public calls intensify for the ODPC and the Ministry of Health to investigate the leak, the incident underscores the urgent need for strict digital access controls within state health management databases.

Reporting originally appeared via Citizen Digital. Read the full source for additional context.