A hospital, clinic, or insurer shares your medical information with your employer or another party
Premiumadvanced9 minutes
The Situation
What They Said
“We shared your medical report with your employer because they were asking about your fitness for duty — it is standard procedure.”
A hospital, clinic, doctor, or health insurer shared your medical records, diagnosis, or health status with your employer, an insurance company, a family member, or another third party without your explicit consent. Health information is among the most sensitive categories of personal data. Disclosure of a diagnosis, HIV status, mental health record, or pregnancy to an employer or insurer can have devastating consequences for your livelihood and dignity.
The Fallacy
Healthcare Provider Can Share Medical Information to Facilitate Employer's Interest
The healthcare provider frames the disclosure as routine administrative cooperation — helping the employer manage their workforce. The law draws a sharp line: health data is a special category of sensitive personal data that attracts the highest level of protection. It can only be shared in extremely narrow circumstances — the patient's explicit written consent, a medical emergency, or a specific legal obligation. An employer's request, however pressing, is none of these. The healthcare provider has a professional and legal duty of confidentiality that overrides employer convenience.
What the Law Says
Your Legal Foundation
Data Protection Act, 2019 (No. 24 of 2019)
Section 46 — Sensitive Personal Data — Enhanced Protection
“Sensitive personal data includes data relating to a natural person's health status. Processing of sensitive personal data is prohibited unless the data subject has given explicit consent; the processing is necessary for preventive or occupational medicine; the processing is necessary to protect vital interests; or the processing is authorised by written law.”
Your medical records are sensitive personal data subject to enhanced protection. The healthcare provider could only share them with your employer if you gave explicit, specific, written consent for that particular disclosure. A general consent for treatment does not cover sharing with employers. Any disclosure beyond these narrow grounds is unlawful.
Health Act, 2017 (No. 21 of 2017)
Section 119 — Medical Confidentiality
“A health care provider shall not disclose any information obtained in the course of their professional relationship with a patient to any person without the patient's written consent, except where required by law, in life-threatening emergencies, or in the public interest as defined by law.”
Medical confidentiality is a legal duty, not just an ethical principle. A doctor or hospital that discloses your diagnosis to your employer without your written consent is in breach of the Health Act and is liable to disciplinary action by the Kenya Medical Practitioners and Dentists Council.
What Scripture Says
God's Word on This
Proverbs 17:9 (ESV)
“Whoever covers an offense seeks love, but he who repeats a matter separates close friends.”
A person who trusts a healer with the most vulnerable details of their physical condition — illness, injury, diagnosis — is extending profound trust. To take that information and carry it to the person's employer or others is to exploit a sacred confidence. God's wisdom is that the information given in trust should be covered, not broadcast. The law reflects this wisdom by making medical confidentiality a legally enforceable duty.
🔒
You Know the Law — But Do You Know What to Say?
Reading your rights is one thing. Using them under pressure — calmly, correctly, in the right words — is what actually protects you. Members get the scripted rebuttal for this exact situation: what to say first, what to say if they push back, the tone to use, and the constitutional provision to cite. Practise out loud with audio until it's automatic.