Court halts implementation of Kenya-US five-year health deal
President William Ruto and US President Donald Trump after witnessing the signing of a peace deal between DRC and Rwanda in Washington DC, USA, on December 5, 2025.
The High Court has suspended the implementation of the Kenya-USA five-year health deal, pending the determination of a case filed by the Consumer Federation of Kenya (Cofek) over an alleged medical data breach.
The lobby group argued that once Kenya’s medical and epidemiological data is transferred abroad, the harm becomes permanent and irreversible.
Cofek added that the courts or Kenyan regulators will have no power to recall, restrict or oversee the foreign use of such data, once it is shared as per the deal signed between the two countries.
“This exposes citizens to lasting privacy violations, stigma and potential misuse of their information. The irreversible nature of the harm elevates the urgency of the matter,” said the lobby.
The court said, “…a conservatory order he and is hereby issued suspending, staying and/or restraining the Respondents, whether by themselves, their agents or assigns, from Implementing, operationalizing, or howsoever giving effect to the Health Cooperation Framework executed between the Government of Kenya and the Government of the United States of America on or about 4th December 2025, insofar as it provides for or facilitates the transfer, sharing or dissemination of medical, epidemiological or sensitive personal health data.
The court directed the case to be mentioned on February 12, 2026, for directions on the hearing and determination of the matter.
A similar case was filed by Busia senator Okiya Omtatah and the matter is pending directions.
Cofek said there are reasons to believe that the government has already commenced operational steps toward implementing the Framework, including preparation of data-exchange mechanisms and institutional arrangements that could imminently activate transfer of Kenyan citizens’ sensitive medical information to the USA.
The lobby said the execution and operationalisation of the Framework occurred without compliance with the Data Protection Act, the Digital Health Act, the Health Act, and the Digital Health (Data Exchange Component) Regulations, 2025, all of which require stringent safeguards before any transfer of health data to a foreign entity.
The lobby further said the Framework requires Kenya to share extensive medical and epidemiological data, including information on HIV/AIDS, TB, malaria, maternal health and disease surveillance.
“Such data consists of sensitive personal information belonging to millions of Kenyans and forms part of the country’s strategic health-security infrastructure. The agreement, therefore, directly implicates individual privacy rights and national sovereignty,” Mr Stephen Mutoro said in an affidavit.
He further said that despite its significant implications, the Framework was not subjected to the constitutional principles of good governance under article 10 of the Constitution.
“This omission occurred even though the agreement involves cross-border transfer of sensitive health information and touches on national-security interests. By failing to adhere to the values of accountability, transparency, public participation, and integrity in governance, the Respondents acted contrary to Article 10. The process was therefore opaque and constitutionally improper,” he said.
The lobby said the government was preparing to operationalise the Framework, including activation of data-exchange systems with USA entities.
“The impending transfer has not been preceded by adequacy assessments, lawful safeguards or compliance with statutory conditions. The threatened disclosure is therefore both unlawful and unconstitutional,” the consumer lobby group said.
Mr Mutoro added that once Kenya’s medical and epidemiological data is transferred abroad, the harm becomes permanent and irreversible and that the court or Kenyan regulators will not have the power to recall, restrict or oversee the foreign use of such data.
“This exposes citizens to lasting privacy violations, stigma and potential misuse of their information. The irreversible nature of the harm elevates the urgency of the matter,” he said.
