How Ruto-Trump health deal risks patient data

President William Ruto holds talks with the CEO of the US International Develop,ment Finance Corporation in Washington, DC, on December 4, 2025. [PCS] 

A high-stakes bilateral health cooperation framework between Kenya and the US, originally slated for signing in mid-November, was postponed over deep disagreements on health data ownership, real-time surveillance obligations, and national sovereignty.

President William Ruto is now expected to oversee the eventual signing, but civil society, legal experts, and public health advocates are demanding major revisions, warning that the current draft risks turning Kenya’s health information systems into a 25-year American asset.

The MoU aims to advance the Universal Health Coverage (UHC) ambitions through collaboration in six key areas: disease surveillance and outbreak response, laboratory systems strengthening, commodity supply chains, health data systems, technical assistance, and sustained funding.

Yet the most contentious clauses revolve around two issues: an appended 25-year data-sharing agreement (Appendix 5) and mandatory rapid notification plus coordination with the US Government during infectious disease outbreaks.

Insiders in the Kenyan delegation told The Standard that a high-level US team visited Nairobi two weeks ago expecting to witness the signing, only for Kenya to balk at the data and surveillance provisions.

“Everything was ready, but Kenya could not accept the level of access being demanded on live health data and outbreak sequencing,” a source familiar with the negotiations revealed.

The data-sharing clause of the draft MoU states unequivocally: “The US and Kenya intend to enter into a data-sharing agreement… for the purpose of exchanging data on the long-term performance of this MoU and for accountability to the United States Congress for appropriated funds.”

The agreement would run for a quarter century.In practice, this would grant authorised US personnel real-time dashboard access, broad querying rights, and the ability to extract metadata, data models, analytical outputs, and individual-level records from Kenya’s integrated health information ecosystem, including the national health data warehouse, electronic medical records (EMR), Chanjo KE immunisation registry, laboratory information systems, pharmacy management platforms, and commodity tracking tools.

Dr Mugambi Laibuta, a lawyer and data governance specialist, describes the provisions as “legally indefensible and constitutionally perilous.”

President William Ruto shakes hands with his host President Donald Trump after a peace deal between DR Congo and Rwanda in Washington DC. [PCS]

In a detailed legal opinion circulated to ministries and Parliamentary committees, he argues that the clause violates Article 31(c) of the Constitution (right to privacy over health information), the Kenya Data Protection Act, 2019 (requirements for lawful processing, data minimisation, and purpose limitation), and the Health Act, 2017 and Digital Health Act, 2024, which vest health data custodianship in Kenyan authorities.

He also claims it violates international data sovereignty principles.

“The agreement does not mandate de-identification, offers no patient consent pathway, contains no limits on query scope, and fails to restrict access to the absolute minimum necessary,” says Laibuta.

“It effectively outsources stewardship of Kenya’s most sensitive population health data to a foreign government for 25 years.”

Equally controversial are the outbreak surveillance clauses. Kenya would commit to detecting suspected outbreaks with epidemic potential within seven days of emergence, and notifying the US government within 24 hours of detection.

The country is also expected to complete initial response actions within seven days “in meaningful consultation” with the Trump administration.

Further, it would be sharing pathogen genomic sequencing data that pharmaceutical companies need for diagnostics and vaccine development.

Aggrey Aluso, executive director of Resilient Action Network Africa, calls this “data mining disguised as cooperation.” He points out that existing continental and global mechanisms already exist: Kenya reports to the Africa Centres for Disease Control and Prevention (Africa CDC) and the World Health Organisation (WHO) under the International Health Regulations (2005).

Routing sensitive genomic intelligence first, or exclusively, to Washington bypasses these multilateral frameworks and risks commercial exploitation.

“Sequence data is the crown jewel,” he explains. “Once you hand over the genetic blueprint of a novel pathogen circulating in Kenya, you have handed pharmaceutical giants the starting point for countermeasures, often without benefit-sharing arrangements for the source country.”

President William Ruto after a peace deal between DR Congo and Rwanda in Washington DC. [PCS]

The proposed MoU explicitly aligns with the US’ “America First Global Health Strategy”, a policy document that The Standard has reviewed. It prioritises procurement from US manufacturers and long-term data access for Congressional oversight and threat monitoring. In financial year 2024 alone, over US$350 million in HIV and malaria rapid diagnostic tests were purchased from American companies such as Abbott, Cepheid, and Hologic.

The strategy commits future programmes to continue favouring US suppliers and ensuring pooled procurement mechanisms facilitate market entry for American innovations.

A Kenyan negotiation team member, speaking anonymously, summarised the emerging bargain: “They reduce direct funding over five years, demand country ownership (meaning Kenya injects more domestic resources), but retain control over procurement and data flows. It’s aid transition dressed as a partnership.”

The negotiations occur against the backdrop of a severe health financing crisis triggered by the January 2025 US “Stop Work” order under the second Trump administration. The freeze created a Sh30.9 billion hole, including Sh140 million earmarked for health information systems maintenance and upgrades.

Critical platforms, among them the HIV electronic medical records and Chanjo KE, now face degradation without urgent donor or domestic replenishment.

Health Cabinet Secretary acknowledges that Kenya remains 70 to 80 per cent donor-dependent for health data infrastructure. The lure of renewed, albeit conditional, American funding is therefore powerful.

Not all stakeholders oppose cooperation. Nelson Otwoma, executive director of the National Empowerment Network of People Living with HIV/Aids in Kenya, welcomes the emphasis on country ownership and gradual funding transition.

“If it forces Kenya to finally budget adequately for ARVs and health workers, that is progress,” he says. “But data sovereignty and procurement fairness must be non-negotiable.”

Civil society coalitions are mobilising. A petition circulating among more than 40 organisations demands deletion or radical renegotiation of Appendix 5, removal of mandatory 24-hour US notification during outbreaks, and explicit benefit-sharing clauses for any pathogen data shared. 

It also calls for an independent data protection impact assessment before signing.

With President Ruto keen to project decisive global partnerships, pressure to sign before the end of 2025 is intense. Yet the chorus of legal and ethical objections grows louder.

One Parliamentary health committee member told The Standard: “We cannot mortgage 25 years of our citizens’ health data for five years of conditional funding. Parliament will demand public participation and a thorough risk assessment.”

As it is, Kenya stands at a crossroads: accept an asymmetric pact that secures short-term financing at the cost of long-term control, or reject it and accelerate the painful but necessary journey toward genuine health sovereignty.

The stakes could not be higher, and the nation is watching.