Patients’ Rights and Medical Consent in Kenya: What the Law Says
By Our Law Team on September 19, 2026
Care Comes With Legal Rights
Treatment in Kenya is governed by more than clinical judgment. The Constitution, the Health Act, 2017 and the professional statutes give patients enforceable rights - to information, to consent, to confidentiality and, in an emergency, to treatment. Knowing those rights changes how you deal with a hospital, a doctor or an insurer, whether you are seeking care for yourself or complaining after something has gone wrong. Our health care lawyers in Nairobi advise patients, families and health businesses.
The Right to Health and to Emergency Treatment
Article 43(1)(a) of the Constitution guarantees the right to the highest attainable standard of health, including reproductive health care.
Article 43(2) provides that a person shall not be denied emergency medical treatment - a right the courts have treated as immediate and enforceable.
Article 26(4) permits termination of pregnancy only in the circumstances the Constitution allows, including where emergency treatment is needed or the life or health of the mother is in danger.
Non-discrimination (Article 27): access to care cannot depend on a patient's status, disability, sex, religion or other protected ground.
In practice, most disputes about access concern emergency care and payment. Refusing emergency treatment - including at a private facility, or transferring a patient who is not stable - exposes the facility to both regulatory action and legal claims.
Informed Consent: The Heart of the Relationship
Consent must be informed: the patient should be told the diagnosis, the proposed treatment, the material risks and alternatives, and what may happen if treatment is refused.
Consent must be specific: a general admission form is not consent for an unrelated procedure, and consent to one procedure does not cover another.
Capacity: consent comes from the patient. Where a patient cannot consent because of unconsciousness or incapacity, the law allows treatment necessary to save life or prevent serious harm.
Children: consent is dealt with under the Children Act and requires a parent or guardian in most cases, with specific statutes allowing a mature minor to consent in defined situations.
Refusal: a competent adult may refuse treatment, including life-sustaining treatment, and the refusal should be recorded.
Research and teaching: participation requires informed consent and, where applicable, ethics approval.
Confidentiality, Records and Data Protection
Confidentiality: medical information may be disclosed only with the patient's consent or in the defined situations the law permits - for example statutory reporting, a court order, or where disclosure is necessary to protect life.
Access to records: patients may request their own medical records; the request should be in writing and the facility should respond within a reasonable time.
Data protection: health data is sensitive personal data under the Data Protection Act, 2019, so facilities need a lawful basis, must secure it, retain it only as long as necessary and report breaches.
Third parties: employers, insurers and schools should receive only what the patient has authorised in writing - the authorisation should say what is disclosed and to whom.
Staff conduct: discussing a patient's condition with relatives, or on social media, is a breach however well intentioned it is.
Information, Fees and Choice
Cost transparency: patients are entitled to information about what treatment will cost, and to a clear bill explaining the charges.
Referrals and transfers: a patient should be transferred safely, with records and a clinical handover - an unstable patient cannot simply be discharged.
Second opinions: patients may seek them, and facilities should provide the records needed to obtain one.
Social health insurance: benefit and claim disputes under the social health insurance scheme have their own review and complaint routes.
When Something Goes Wrong
Get the facts in writing: request the medical records and a written explanation of what happened and why.
Internal complaint: use the facility's complaints and patient-safety channels, and put the complaint in writing so that a record exists.
Professional regulators: complaints against a health professional go to the relevant council - for example the Kenya Medical Practitioners and Dentists Council for doctors and dentists, or the relevant nursing or clinical officers council - which can investigate and discipline.
Public facilities: the Commission on Administrative Justice (the Ombudsman) can investigate maladministration in public health institutions.
Negligence claims: where the standard of care was breached and harm resulted, a civil claim for compensation can follow - see our guide on medical negligence claims in Kenya.
Limitation: negligence claims are subject to limitation periods, and delay can end an otherwise strong claim, so take advice early.
A disciplinary complaint and a compensation claim are different processes with different outcomes: the regulator can sanction the professional, while only a court or a negotiated settlement can compensate the patient. They can run in parallel, and the records you gather for one will support the other.
Practical Steps for Patients and Families
Keep copies: discharge summaries, prescriptions, test results, referral letters and receipts.
Note the details: dates, times, the names and designations of the clinicians involved, and the ward or clinic.
Ask questions and record the answers: request the explanation in writing where the outcome was unexpected.
Do not sign a release or settlement without advice, particularly where the harm is ongoing or the full extent is not yet known.
Move quickly: clinical evidence degrades with time, and records can go missing.
Run both routes: the regulator's disciplinary process and a compensation claim serve different purposes.
For Health Facilities: Managing Rights and Risk
Consent processes: proper forms, explanations in a language the patient understands, and a record of the discussion - not just a signature.
Record keeping: complete, timely and legible records are the single most important defence in any clinical claim.
Data protection: policies, access controls, retention rules and a breach response plan, with ODPC registration where the facility processes personal data at the required scale.
Training: consent, confidentiality and professional boundaries, including what staff may say about patients outside the facility and online.
Complaints and incidents: a documented process that catches problems early and shows the regulator that you respond.
Insurance and escalation: professional indemnity cover, and a clear route for notifying the insurer when a claim is threatened.
Regulatory compliance: current licences, qualified staff, and adherence to the standards of the relevant council.
Patients' rights cut both ways: they protect you as a patient, and they define the standards a facility must meet. Our health care lawyers in Nairobi advise patients and health businesses on consent, confidentiality, complaints, regulator investigations and negligence claims. Book a consultation to discuss your position.
