On this page
TL;DR:
- Kenyan hospitals and clinics can start with AI on low-risk admin work: procedures, staff circulars, complaint templates, reports built from totals, and training material.
- Identifiable patient information should never go into a public AI tool. Health data is sensitive personal data under the Data Protection Act, and the Digital Health Act 2023 adds its own limits.
- Diagnosis, triage, treatment, prescribing and reading results stay with licensed clinicians. A qualified person signs off anything clinical.
- A 2026 High Court case over an AI-assisted radiology platform shows that Kenyan courts will step in on health data and oversight.
- Start small: one written rule, one admin task, and a lawyer's review before any tool touches patient data.
Please note. This guide is about office and administrative work. It gives no clinical advice, and it is not legal advice. Your clinical leadership and your lawyer or data protection officer must decide what applies to your facility.
Who this guide is for
This guide is for the people who run hospitals, clinics, nursing homes, laboratories and pharmacies in Kenya. That includes medical directors, administrators, records and billing teams, HR managers, quality officers and data protection officers.
You do not need technical knowledge. The guide will help you decide where AI can save time, where it creates risk, and what to ask before you buy anything.
Where AI can help, and where it must stop
The safest starting point is work that contains no patient details and that a named person can check. In practice, a health facility's work falls into three zones.
| Zone | Examples | Rule |
|---|---|---|
| Green: no patient data | Drafting procedures, staff notices, job adverts, training quizzes, supplier letters, reports from totals | Use approved tools, and a person checks the result |
| Amber: patient data or patient-facing text | Clinical note drafting tools, patient messaging, patient leaflets, claims work on real files | Only with an assessed tool, a contract and legal review. A clinician approves clinical content |
| Red: clinical judgement | Diagnosis, triage, treatment plans, prescriptions, doses, reading lab or imaging results | Stays with licensed clinicians. Do not hand this to a general AI tool |
Kenya's government is itself interested in AI for health. In March 2026 Business Daily reported that the Ministry of Health planned to work with Causal Foundry on AI in community health systems, with the Principal Secretary speaking of responsible, people-centred technology. That interest does not remove any duty that applies to your facility.
Admin work AI can help with today
Each of these tasks can be done with no patient details at all. Start here.
| Team | Useful AI task | Who checks it |
|---|---|---|
| Front office | Plain scripts for phone queries, appointment procedures | Front office manager |
| Records | Filing procedures, retention checklists from your own policy | Records lead |
| Billing | Excel formulas, summaries of claim rejection reasons from totals | Billing lead |
| HR | Rota templates, job adverts, leave policies, onboarding checklists | HR manager |
| Quality | First drafts of procedures from approved guidance, audit checklists | Quality officer and clinical lead |
| Procurement | Supplier emails, comparison tables from quotations | Procurement lead |
| Communications | Health-day posters and website text | Communications lead, with a clinician approving health content |
| Management | Monthly report text from totals, meeting minutes from masked notes | Report owner |
| Training | Quizzes and summaries from approved training material | Nurse educator or department head |
What must stay with clinicians
Anything that could change a patient's care stays with a licensed professional. A general AI chatbot is not a clinician, and it does not carry a clinician's duties.
Keep these with qualified staff:
- Deciding what is wrong with a patient.
- Deciding how urgent a case is.
- Choosing treatment, medicines and doses.
- Interpreting laboratory results and images.
- Deciding on admission or discharge.
- Giving results and difficult news.
- Taking informed consent.
- Signing and owning the clinical record.
The World Health Organization's January 2024 guidance on large AI models explains why. It lists uses from clerical tasks to diagnosis, and it warns of "documented risks of producing false, inaccurate, biased, or incomplete statements". It also warns about automation bias, where professionals overlook errors or hand difficult choices to the tool.
A patient-facing chatbot needs special care. If a tool on your website starts answering questions about symptoms, it has moved from admin into care. Keep public tools to practical matters such as opening hours, directions and how to book. Send anything about symptoms to a person, and give your emergency contact.
What Kenyan law says about patient data
Treat every piece of identifiable patient information as restricted. Two statutes apply, and related guidance and regulations are still developing.
| Instrument | What it is | Status as of 9 November 2026 |
|---|---|---|
| Data Protection Act, 2019 | General law on personal data, with extra rules for sensitive data | In force |
| Digital Health Act, No. 15 of 2023 | Health-specific rules on confidentiality, consent and the national digital health system | Commenced 2 November 2023. Parts were challenged in court, but reports in March and June 2026 say the Court of Appeal stayed the ruling, so it operates pending appeal. We did not find a final appeal judgment |
| Digital Health (Data Exchange Component) Regulations, 2025 | Rules made under the Digital Health Act | Listed in Parliament's library. Check the current text |
| Office of the Data Protection Commissioner's draft AI guidance | Guidance on applying data law to AI | Draft dated July 2026. Consultation closed on 17 August 2026, and a policy tracker showed no final version when we checked |
Kenya's proposed AI Bill is a separate matter, and our explainer on the AI Bill 2026 covers it.
The Data Protection Act
The Act's definition of health data is broad. It covers data on a person's physical or mental health, including data collected while registering for or receiving health services. So an appointment list can be health data, even if it says nothing about the illness.
These sections matter most:
- Section 46 says health data may only be processed by or under the responsibility of a health care provider, or by someone under a duty of professional secrecy. Processing needed for public health reasons, or done by another person who owes a duty of confidentiality under law, can also meet this condition.
- Section 31 requires a data protection impact assessment before processing that is likely to create high risk.
- Section 35 gives people the right not to be subject to decisions based solely on automated processing that significantly affect them, subject to the exceptions in the section.
- Section 43 requires a controller to notify the Data Commissioner within 72 hours of becoming aware of a qualifying breach.
- Section 49 says sensitive personal data may be processed outside Kenya only with the person's consent and confirmation of appropriate safeguards.
Many public AI tools are hosted outside Kenya, which is why section 49 matters so much to a nurse with a chatbot open in a browser.
The Digital Health Act
Three parts of this Act deserve your attention:
- Section 31 says a healthcare provider must ensure it has obtained consent to process sensitive personal data, with stated exceptions.
- Section 35 makes it an offence to share sensitive personal data with an unauthorised party, among other acts. Penalties can reach a fine of KES 1 million, 15 years in prison, or both. Where the offence concerns sensitive personal data, it points to the penalties in the Data Protection Act.
- Section 47 says personal health information may only be shared to any person outside Kenya for the purposes of health tourism.
Section 47 is short and its reach is debated. A March 2026 note by law firm Clyde & Co, written for insurers, describes it as appearing to limit cross-border transfer to health tourism. The note also records another reading, under which the limit mainly concerns the Digital Health Agency's own transfers. Until this is settled, ask your lawyer before you send patient information to any foreign-hosted system.
The same note raises other duties for controllers in the insurance setting: telling the Digital Health Agency about Data Commissioner registration within seven days, retaining health data for at least 20 years, and reporting breaches to the Agency within 48 hours. Ask your lawyer whether and how these apply to your facility.
Registration
The Data Commissioner's registration guidance lists "health administration and provision of patient care" among the sectors that must register regardless of turnover or staff numbers. A small clinic is not outside the rule because it is small.
The draft AI guidance
A trade summary published in August 2026 says the draft lists health diagnostics using patient records among the uses that would require a data protection impact assessment. It also says AI providers handling personal data would need a written data processing agreement. These are draft provisions, and they show the direction of travel. We could not open the original draft on the regulator's website today, so read the current version there.
A warning from the High Court
The Rology case shows that a health-tech tool can be stopped over licensing and data handling. In 2026, the High Court in Nairobi suspended the Kenyan operations of Rology Medical Kenya, a teleradiology company, until it was registered and compliant with data protection and digital health law. The Standard reported that the court also ordered regulators to cancel any licences or approvals the company held for handling patients' digital health records.
The petitioners, led by officials of the Kenya Association of Radiologists, alleged that images and patient histories were sent outside Kenya without consent and that the AI-assisted platform lacked oversight. Rology disputed that its platform makes AI diagnoses. It said Kenyan radiologists validate reports. TechTrends reported in June 2026 that the company had applied for a stay pending appeal, so check the latest position.
For a hospital buying technology, these are the lessons:
- A vendor's assurance is no substitute for your own checks.
- Where images and records physically go matters.
- Someone must be clearly responsible for every report.
- TechTrends reports that the court refused to let a regulator rely on delays in implementing the rules.
- TechTrends also notes that the ruling did not ban AI or telemedicine.
AI note-taking tools: useful, but check the evidence
AI scribes can save documentation time, and they make mistakes that a tired clinician can miss. If your facility is looking at one, go in with clear eyes.
The idea has been discussed in Kenya for some time. A 2019 draft report from a technical working group of the Medical Practitioners and Dentists Council suggested that AI could turn a recorded consultation into a summary "which the clinician can approve or amend". That was a draft, and we found no current council guideline specific to AI.
Recent research points both ways:
- A 2025 study in Frontiers in Artificial Intelligence compared AI notes with physician-written notes for 97 outpatient encounters. AI notes were rated more thorough and better organised, but hallucinations appeared in 31% of AI notes and 20% of physician notes. The authors had commercial ties to the vendor.
- A University of Edinburgh narrative review, reported in September 2026, found that AI scribes can leave out the patient's own story, concerns and non-verbal cues. It also said that important details such as medicines or symptoms can be missed or misrepresented. Patients may also be less willing to raise sensitive issues while being recorded.
- The same report cited a real-world study that found omissions in 18% of reviewed notes and hallucinations in 11.5%.
None of these studies was done in Kenya. Languages and code-switching between English, Kiswahili and other languages may affect accuracy, so test any tool on realistic but non-patient recordings first.
Six worked prompts with no patient data
FuKazee teaches the four Cs: Clarity (what you want), Context (the background), Constraints (limits) and Customisation (who will read it). These prompts use no patient information. Replace the square brackets.
1. A front desk procedure
I manage the front office of a private clinic in Kenya. Draft a one-page procedure for handling missed appointments. Context: staff are currently inconsistent. Constraints: numbered steps, under 200 words, no medical advice, and a clear step for passing any symptom question to a nurse. Customisation: readers are reception staff with a mix of experience.
2. A complaint reply template
Draft a reply template for complaints about long waiting times at a hospital outpatient department. Use placeholders for the patient's name and date. Constraints: under 130 words, respectful, no admission of liability, no discussion of any treatment, and a named office the person can contact. Customisation: plain English for a worried family member. I will fill in the details outside this tool.
Your legal adviser should approve the template once, so staff are not improvising.
3. Claim rejections from totals only
I use Excel. My sheet has only totals, with no patient details: Month, Payer Code, Rejection Reason, Number of Claims, Value (KES). Give me steps to build a pivot table showing the top five rejection reasons by value for each payer, and a formula for each reason's percentage of total rejected value. Then suggest five questions I should ask my billing team about the pattern.
4. A staff circular
Draft a staff circular from the Hospital Administrator announcing that [non-clinical change, such as a new staff parking system] starts on [date]. Constraints: under 150 words, formal but friendly, state what staff must do and by when, and give a contact office. Customisation: staff will read it on WhatsApp.
5. A leaflet from clinician-approved text
Below is text our clinical team has already approved for [general topic]. Rewrite it as a simple leaflet at about a Class 8 reading level. Constraints: use only the information in this text, add no medical advice, change no numbers, and list every sentence where simplifying might change the meaning. Customisation: give an English version and a natural Kiswahili version. Text: [paste approved text]
A clinician must approve the final version, and a fluent speaker must read the Kiswahili.
6. A monthly management report
Here are this month's departmental totals, with no patient details: [paste]. Draft a half-page commentary for the management committee. Constraints: describe only what the numbers show, do not suggest clinical causes, and list questions management should ask. Mark anything unclear with [CHECK].
What must never go into a public AI tool
Use one simple rule for staff: if it could identify a patient, it does not go in.
- Names, ID numbers, insurance numbers, phone numbers and addresses.
- Patient files, referral letters, discharge summaries and lab reports.
- Screenshots of the hospital information system.
- Photographs of patients, wounds, images or handwritten notes.
- Staff medical records and disciplinary files.
- Passwords and system details.
Removing the name is often not enough. A rare condition, a small town, an exact date and a job title can identify someone together. In a small community, people may recognise a case from very few details. Treat this as a job for careful, trained staff, and take advice on what truly counts as anonymised.
Tools differ, and their terms change. Google's Gemini privacy page says a subset of chats may be reviewed by humans and asks users not to enter confidential information. Claude's privacy page says consumer chats may be used to improve models if the user allows it. Microsoft says prompts in Copilot Chat, as used by organisations, are not used to train foundation models. Even an enterprise contract does not settle the Kenyan questions about consent, location and section 47. Some facilities ask whether a locally run open-source model could reduce the risk. That needs ICT support and the same legal review.
Ten questions to ask any AI vendor
Put these in writing before you pilot any tool that touches patient information.
- Where exactly is our data stored and processed, including backups and subcontractors?
- Are you registered with Kenya's Data Commissioner, and in what role?
- What registration or approval do you hold under Kenyan health regulation?
- Will you sign a written data processing agreement?
- Is our data used to train any model?
- Who, including your staff, can see our data?
- How do we delete data at the end of the contract?
- What evidence shows accuracy in Kenyan settings and languages?
- Who is responsible when the output is wrong?
- How do you notify us of a breach, and how fast?
If a vendor cannot answer in writing, stop there. Then complete a data protection impact assessment with your data protection officer before any patient information is used.
What goes wrong, and how to avoid it
| What goes wrong | Why it happens | What to do |
|---|---|---|
| A nurse pastes a patient summary into a free chatbot | Nobody explained the risk, and the tool is easy to reach | Clear rule, training and an approved alternative |
| AI invents a reference or guideline | The tool sounds certain even when wrong | Check against the original document every time |
| A clinician signs a note without reading it | Time pressure and automation bias | Audit a sample, and make review part of the workflow |
| A leaflet quietly changes a clinical message | Simplifying changed the meaning | Clinician approval on every version |
| Website chatbot gives health advice | Scope was never limited | Restrict topics, and hand off to a person |
| A pilot spreads without review | People like the tool and share it | One owner, written approval, and a list of approved tools |
| Patients do not know a recording tool is in use | Consent process was not updated | Legal review and a clear consent process first |
A 90-day plan for a clinic or hospital
Days 1 to 30: set the rules. Name one owner, with clinical and data protection input. Check your Data Commissioner registration. Write a short policy using our guide to an AI usage policy for Kenyan organisations. Choose one green-zone task, and record how long it takes today.
Days 31 to 60: train and pilot. Train admin staff on the never-paste list, the four Cs and checking outputs. Build a small shared library of prompts. Log every error and how it was caught.
Days 61 to 90: review. Compare time spent, including checking. Ask reviewers about quality. Decide whether to add another green-zone task. Only consider amber-zone tools after legal review, vendor answers and an impact assessment.
Questions people ask
Can a Kenyan hospital use ChatGPT at all?
It can use AI tools for work that contains no patient information, if the hospital has approved the tool and set rules. Identifiable patient data is a very different matter. Get legal advice before any patient information reaches a foreign-hosted tool.
Can staff paste a patient's notes if they remove the name?
That is risky. Other details can still identify a person, and a small community makes this easier. Unless your data protection officer has approved a proper method, keep patient notes out.
Is the Digital Health Act in force?
Yes, according to reports we checked from March and June 2026. Parts of it were challenged, and the Court of Appeal stayed the High Court's ruling, so the Act operates pending appeal. Check the current position with your lawyer.
Do we need a data protection impact assessment for AI?
Section 31 of the Data Protection Act requires one where processing is likely to create high risk. Patient data used with AI is a strong candidate. The regulator's draft AI guidance, as summarised in August 2026, would also list health diagnostics using patient records.
Can AI read X-rays or suggest diagnoses in our clinic?
That is clinical work and sits outside this guide. Any such system raises licensing, safety and data questions for your clinical leaders, regulators and lawyers. The Rology case shows how seriously Kenyan courts may treat them.
Should clinicians get AI training too?
Yes, because many will already be trying these tools. Training should cover the limits of AI, automation bias and data rules. It should not teach anyone to use a general chatbot for clinical decisions.
Sources
- Data Protection Act, 2019, copy on the Data Commissioner's website, last checked 9 November 2026
- Digital Health Act, No. 15 of 2023, Kenya Gazette Supplement No. 192, copy on the Pharmacy Council's website, last checked 9 November 2026
- Clyde & Co, "Health data protection in Kenya" (17 March 2026), last checked 9 November 2026
- Parliament of Kenya library, Digital Health (Data Exchange Component) Regulations 2025, last checked 9 November 2026
- Office of the Data Protection Commissioner, Guidance Note on Registration of Data Controllers and Data Processors, last checked 9 November 2026
- PPC Land, summary of Kenya's draft AI guidance (3 August 2026), last checked 9 November 2026
- Digital Policy Alert, Guidance Note on Artificial Intelligence, consultation status, last checked 9 November 2026
- The Standard, "Court blocks Rology operations over health data compliance failures" (2026), last checked 9 November 2026
- TechTrends KE, "Rology's suspension brings Kenya's health-tech oversight into focus" (17 June 2026), last checked 9 November 2026
- World Health Organization, guidance on large multi-modal models (18 January 2024), last checked 9 November 2026
- Kenya Medical Practitioners and Dentists Council, draft report on the regulation of electronic health practice (2019), last checked 9 November 2026
- Palm and others, "Assessing the quality of AI-generated clinical notes", Frontiers in Artificial Intelligence (22 October 2025), last checked 9 November 2026
- Medical Economics, report on the University of Edinburgh review of AI scribes (September 2026), last checked 9 November 2026
- Business Daily, "Ministry to deploy AI in community healthcare programmes" (4 March 2026), last checked 9 November 2026
- Google, Gemini Apps Privacy Hub, last checked 9 November 2026
- Anthropic, "Is my data used for model training?", last checked 9 November 2026
- Microsoft, "Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat", last checked 9 November 2026
Where FuKazee fits in
FuKazee trains teams to use AI safely on the work in front of them. For hospitals and clinics, that means admin, management and support teams learning what they can do with AI, what must stay out of AI tools, and how to check every output. We do not give clinical advice, and we do not tell clinicians how to treat patients. Your clinical leaders decide what is appropriate for clinical staff.
We assume nobody in the room knows AI, and we avoid jargon. We show the free version of each feature, never promote one tool, and use masked or made-up examples only. Since 2022 we have trained more than 3,000 people. Our AI readiness assessment can help you see where to begin.
See AI training for healthcare teams in Kenya, or our main page on AI training in Kenya.
To talk about training for your hospital or clinic, email us at lead@fukazee.com
Want guided support instead?
Plan AI training around your team's real work. Answer a few quick questions about your sector, team size and goals, and we will recommend the right programme and format. Sessions are built on your workflows and include a usage policy.
Rodney has run FuKazee's training since 2022 and still teaches inside every programme line: corporate sessions, the postgraduate cohort and the KCSE examiner webinars. First Class Honours in Journalism and Mass Communication, University of Nairobi.
