A reflection under Kenyan law
Last night, while attending a webinar, a familiar name appeared among the participants. It belonged to a doctor who had once raised an interesting medico legal question in conversation. She had been the clinician responsible for writing the clinical notes of a patient admitted to a hospital. After the patient was discharged, she wondered whether she could take the notes with her. After all, she had authored them. The handwriting was hers, the observations were hers, and the clinical reasoning recorded in the file reflected her professional judgment.
Her question was therefore straightforward, since she was the author of the clinical notes, could she take them away once the patient had left the hospital?
At first glance the question seems reasonable. Clinicians create clinical notes through their own professional work. They document examination findings, diagnostic reasoning, treatment plans, and ongoing observations. It is therefore tempting to assume that the notes belong to the doctor who wrote them. Yet the legal position is more structured than that intuitive assumption suggests. Kenyan law distinguishes carefully between authorship of clinical notes, custody of the medical record, and rights over the personal data contained within the record. Understanding this distinction requires examining the interaction between constitutional principles, statutory health legislation, and the modern framework of data protection.
The starting point is the Constitution of Kenya, 2010, which establishes the foundational rights relevant to medical information. Article 31 guarantees every person the right to privacy, including protection against unnecessary disclosure of information relating to their private affairs. Medical information falls squarely within this protected sphere because it concerns intimate details of a person’s physical and psychological condition. At the same time, Article 43 recognises the right to the highest attainable standard of health. A functioning healthcare system depends on accurate documentation and reliable medical records that allow clinicians to understand what has happened to a patient and what care has been provided.
These constitutional principles are reinforced by the Data Protection Act, 2019 (Kenya), which regulates the collection, storage, and use of personal information. The Act classifies health information as sensitive personal data, a category that receives heightened protection. Within this framework, the patient is the data subject, while the hospital or healthcare institution functions as the data controller responsible for determining how that information is processed and safeguarded. The patient therefore possesses legal rights over the personal data contained within the medical record. These rights include the right to access personal data held by the data controller and the right to request correction of inaccurate information. However, the Act does not grant ownership of the physical medical file to either the patient or the individual clinician who authored the notes. Instead, it recognises rights over the information while permitting healthcare institutions to retain and process that information for legitimate clinical and regulatory purposes.
Further guidance is provided by the Health Act, 2017 (Kenya), which imposes explicit obligations on healthcare providers to create and maintain proper health records. Hospitals and health facilities must preserve patient records, safeguard confidentiality, and maintain documentation for prescribed retention periods. Medical records serve multiple purposes beyond the immediate clinical encounter. They support continuity of care, allow clinical audit and quality assurance, and provide documentation that may later be required for regulatory oversight or medico-legal proceedings. For these reasons, the law treats medical records as part of the institutional documentation of the healthcare facility rather than as the personal property of the clinician who wrote them. From a professional standpoint, clinical notes are written by clinicians as part of their duty of care. Authorship reflects responsibility for the accuracy and integrity of the entry but does not confer ownership of the document itself. Each clinician contributes entries to a single institutional record maintained by the healthcare facility in which the patient was treated. The notes therefore form part of the hospital’s official clinical documentation system.
An important related question arises at this point. Even though the patient cannot take away the original medical file, can the patient request a full copy of it? In most circumstances the answer is yes. Under the Data Protection Act, 2019 (Kenya), the patient, as the data subject, has a statutory right to access personal data held by a data controller. In practical terms this means that a patient may request not merely a summary medical report but a complete copy of the information contained in the medical record, including clinicians’ notes, laboratory results, imaging reports, medication charts, operative notes, and other diagnostic documentation. The healthcare institution is generally required to provide access to this information in the form of copies, subject to reasonable administrative procedures and reproduction costs where applicable. This principle aligns with the broader concept of medical records portability, which allows patients to obtain their records for purposes such as seeking second opinions, transferring care to another facility, or maintaining their own personal health documentation.
A related question sometimes arises regarding the so-called “right to be forgotten.” While the Data Protection Act, 2019 (Kenya) recognises limited rights to erasure of personal data in certain contexts, those rights are not absolute in the healthcare setting. Medical records must often be retained for statutory, regulatory, and professional reasons. Hospitals may be required to preserve records for defined retention periods, and those records may later become relevant for clinical follow-up, regulatory inspection, public health obligations, or medico-legal proceedings. For that reason, a patient cannot ordinarily compel a healthcare institution to delete legitimate clinical records simply because she no longer wishes them to exist. The law therefore balances privacy rights with the institutional and public interest in preserving accurate medical documentation.
Returning to the doctor’s question, the legal position becomes clearer once these distinctions are properly understood. Even though she authored the clinical notes, she cannot take the patient’s file with her after the patient has been discharged. The notes were written in the course of her professional duties within a healthcare institution and therefore form part of the hospital’s official medical record system. In legal terms, the physical record and the institutional file belong to the healthcare facility, which bears responsibility for maintaining, safeguarding, and preserving that documentation. At the same time, the information contained within that record relates to the patient and constitutes her personal health data. Under the Data Protection Act, 2019 (Kenya), the patient retains rights over that personal data, including the right to request access and obtain copies of the information recorded about her. Seen in this way, Kenyan law separates three related but distinct concepts. The clinician authors the entry, the hospital owns and retains custody of the medical record as part of its institutional documentation, and the patient holds legal rights over the personal health information contained within it.
This tripartite distinction explains why neither the doctor who wrote the notes nor the patient whose illness is described in them can claim ownership of the hospital file itself. The record remains part of the hospital’s documentation system, while the patient retains enforceable rights to access and control the use of the personal data contained within it.