ODPC to Audit SHA System as Government Lacks Control Over Health Data

The Office of the Data Protection Commissioner (ODPC) has announced plans to audit the Social Health Authority's (SHA) digital health information system following concerns over data security and system ownership.

The move follows an audit revealing that the Kenyan government lacks ownership and control over the SHA system, with private entities holding its intellectual property rights. Auditor General Nancy Gathungu’s report highlighted that the system, valued at Ksh104.8 billion, is managed by a private consortium, leaving the government without authority over critical health data.

Additionally, the audit found that 2.5% of SHA member contributions were being funneled into an escrow account with inadequate transparency and oversight.

In response, Busia Senator Okiya Omtatah has urged the Ministry of Health to suspend SHA operations pending a full investigation into alleged corruption and operational failures. He warned that the system’s flaws undermine public trust and threaten Kenya’s universal health coverage goals.

The ODPC’s audit will assess SHA’s compliance with data protection laws and address security gaps to safeguard citizens' personal health information. Data Commissioner Immaculate Kassait stressed the need for user consent when involving third parties in data processing.

These revelations have intensified scrutiny of the SHA system, prompting calls for transparency, accountability, and reforms to protect Kenyans’ health data.