Nairobi — The Office of the Data Protection Commissioner (ODPC) has found St Luke's Orthopaedic and Trauma Hospital liable for unlawfully disclosing a patient's sensitive medical information and ordered it to pay Sh525,000 in compensation.

In a ruling issued under the Data Protection Act, 2019, Data Commissioner Immaculate Kassait said the hospital violated data protection principles by mishandling and incorrectly sharing a patient's medical results.

The complaint was filed by Merceline Odeyo, who said the facility repeatedly issued her with test results belonging to another patient with a similar first name but a different surname.

She also accused the hospital of sharing her sensitive health data with a third-party laboratory without her informed consent, leading to a breach of privacy and loss of dignity.

Keep up with the latest headlines on WhatsApp | LinkedIn

In its defence, the hospital argued that samples were lawfully collected and referred to an external lab under standard procedures, adding that only minimal personal data was shared through a barcode system.

It attributed the mix-up to an isolated administrative error during results reconciliation and maintained it acted in the patient's best interest.

However, the Data Commissioner rejected the explanation, noting the hospital failed to prove it had obtained explicit and informed consent to share sensitive data.

The ODPC found multiple violations of the law, including failure to obtain consent, lack of transparency, failure to notify the patient of third-party processing, and inadequate safeguards that led to the data mix-up.

Kassait said the breach caused harm to the complainant, making her eligible for compensation under Section 65 of the Data Protection Act, which covers both financial and non-financial damages such as emotional distress.

The hospital has been ordered to pay Sh525,000, with both parties granted the right to appeal the decision at the High Court within 30 days.