Patient Data Privacy 101: How We’re Locking Down Your Secrets. What Happens If the Key Is Lost? (Part 2)

Who is Looking at Your Private File?

Welcome back! In Part 1, we talked about the private health data your hospital collects. Now, let’s talk about keeping them safe.

Think of your digital health data as a secret diary locked in a big, secure room. Who has the key to it?

The main rule is: If you don’t need it for your work, you don’t see it. That’s the need-to-know rule, only people who must see the facts can look at them.

Digital Safety. What are Role-Based Access Controls?

We use a high-tech safety system that acts as a “role key.” It’s like giving hospital staff members keys that only open certain doors:

• Your doctor has the master key. They need to see everything: your lab results, your old notes, and the private notes from last week.

• The pharmacist has a drug key. They only see the facts needed to dispense your medicine. This includes prescriptions, allergies, and the right dose. They cannot read your doctor’s detailed notes.
• The registry clerk has a registry key. They see only the facts needed to start your visit: your name, date of birth, and insurance number. They do not see your diagnosis, lab results, or medicine list.

This system works inside the hospital’s HMIS*. It always locks out anyone who doesn’t have the “digital need” to know. We always make sure a doctor’s private notes stay secret.

*HMIS – Hospital Management Information System.

Protecting Data from Compromise: Scrambling Your Secrets

How do we stop strangers from breaking into the system and seeing your health data? We use top-level security tools that become an invisible, digital armor for your health data.

How Do Technical Safeguards Work?

1. Encryption. The Secret Code:
   • This is a key safeguard. Encryption takes your data (your name, diagnosis, etc.) and always turns it into a secret code.
   • To a stranger, accessing this code tells them nothing. They can’t read it because it is meaningless information to them.
   • To a stranger, this code means nothing. They cannot read it at all. Only approved people with the right computer key can change the code back to see the real file.
   • We use this safeguard when your care team saves your patient file. We also use it when the doctor or pharmacist sends your private data over the internet.
2. Firewalls and Monitoring. The Security Gates:
   • Firewalls are digital security walls. They block unwanted traffic from getting into our system.
   • We also have systems that always watch for suspicious stuff. An example is when someone tries to guess passwords or open files they don’t need. If something looks wrong, an alarm goes off right away!

What About Third Parties? How Do We Guard Your Patient Data?

Your health data file serves your care first. But sometimes hospitals must share some patient data with other groups. Kenyan law (the Data Protection Act and Digital Health Act) sets strict rules for data sharing.

Strict Legal Conditions for Sharing

We only give your personal data (the file with your name on it) to:

• Your insurance company. The purpose here would be for them to pay your bill, but only the parts needed for payment.
• Another doctor you are consulting outside the hospital. The hospital only shares the data needed to continue your care (e.g., a referral).
• The Ministry of Health can see it, but only for legal reasons. This helps them track disease outbreaks.

Important: Your hospital must ask you in writing. They ask before they share your health data for reasons like marketing or research. The only time they do not ask is if a law says they must share it.

Anonymization: Hiding Your Identity for Research

What about medical researchers? They need data to find cures or improve treatments. This is how anonymization helps.

• This process takes out all your personal tags. Personal data in this includes your name, phone number, ID number, and address.
• The data then becomes a number in a big group. For example, “A 45-year-old female patient with diabetes had this outcome.”
• The law lets people share data for research only if the data is all anonymous. This means researchers get the knowledge they need and never know who you are.

Accountability: What Happens if your Private Data Gets Out?

We do everything right, but sometimes mistakes or bad acts happen. What if someone picks your secret diary’s lock, or what if a doctor loses the key to your data? Is that a data breach?

What is a “data breach”?

A data breach means your personal information has been:

• Lost. For instance, a hospital laptop with unencrypted patient files goes missing.
• Stolen. For instance, a hack gets past our defenses or the hospital’s defenses.
• Accessed by the Wrong Person. An example of this would be an employee snooping into a patient’s file for gossip.

It is any time an unauthorized person sees, uses, or loses control of your private data.

Our Obligation: The 72-Hour Rule

Kenyan law, as detailed in the Data Protection Regulations (DPR, 2021), states this rule. If we or the hospital discovers a data breach, we have a strict legal duty:

1. We must investigate the breach immediately.
2. We must notify the ODPC** within 72 hours of learning about it.
3. We must also notify you, the patient, if the breach could cause you significant harm.

**ODPC – the Office of the Data Protection Commisioner, is Kenya’s data regulator.

This quick action is not optional; it’s the law, and it holds us accountable.

What Can You Do? Filing a Complaint

If you ever feel someone has violated your health privacy rights, you have a clear path to take action.

Step-by-Step for a Patient Complaint

1. Talk to Your Hospital’s DPO***: Every hospital has a person responsible for data privacy. They are the main guardian of your patient file at the hospital. If you have complaints about your health data, they must look into your concerns.
2. Escalate to the ODPC. What happens if the hospital does not fix the problem? What happens if you don’t like their answer? You can file a complaint with the ODPC. This office is an independent government agency. It enforces the Data Protection Act. Its duties include investigations and fining violations of data protection laws.

***DPO – the Data Protection Officer.

Your peace of mind is our priority. Know your data rights. Your rights give you control over your health information.