Ensuring Patient Data Privacy in the Digital Age

In late February 2024, a ransomware crew entered the networks of Change Healthcare, a company most patients had never heard of, through a remote-access server that did not require a second factor of authentication. The company's chief executive said as much, plainly and in writing, to the United States Senate Finance Committee on 1 May 2024 (Witty testimony, Senate Finance Committee, 2024). Because Change Healthcare sits in the middle of the American medical billing pipeline — it routes claims between pharmacies, hospitals and insurers — the intrusion did not stay inside one firm. Pharmacies could not verify insurance. Claims stopped moving. Prescriptions stalled. The Office for Civil Rights at the Department of Health and Human Services, which enforces American health-privacy law, then spent more than a year counting the victims. On 24 January 2025, the company told the regulator that roughly 190 million individuals had been affected; on 31 July 2025 it revised the figure to about 192.7 million (HHS OCR, Change Healthcare incident FAQ). On the available counts it is the largest health-data breach on record in the United States, and it makes this article's subject concrete: patient data privacy is not an abstraction debated by lawyers. It was a single weak login standing between a criminal gang and the medical histories of well over half a country.

Privacy is a clinical variable, not paperwork

The oldest argument for medical confidentiality has nothing to do with software. A patient who trusts the record tells the truth; a patient who fears the record edits the history. People conceal exactly the facts that diagnosis needs most — sexual history, substance use, mental illness, symptoms that carry shame — because disclosure can cost a job, a premium, a marriage or a family's regard. The concealment is rational; the consequences are clinical. A diagnosis built on an incomplete history is a diagnosis built on sand.

What has changed in the digital age is scale. A paper file sat in one cabinet, in one building, watched by one receptionist, and could be stolen by one pair of hands. An electronic health record can be copied in bulk, at machine speed, by a stranger on another continent, and then joined to other records — an insurance register, a pharmacy log, a payments file — until it describes a life. The breaches are not hypothetical. They have a registry, a regulator and a count of victims in the hundreds of millions.

The fiction of the anonymous record

The standard defence against this is de-identification: strip the names, share what remains. The defence fails more often than its users admit, and the reason is arithmetic rather than malice. A birth date, a residence, a sex and a few admission dates are not names, but they behave like them, because combinations of ordinary facts are rarely shared. In July 2019, researchers published the strongest statement of this problem to date in Nature Communications: using machine-learning models to reason about population statistics, they estimated that 99.98 percent of Americans could be correctly re-identified in any dataset containing 15 common demographic attributes, even when the dataset was heavily incomplete (Rocher, Hendrickx and de Montjoye, Nature Communications, 23 July 2019). The authors' point was not that one particular dataset was unsafe. It was that "anonymised" is usually a claim about effort, not a property of the data.

The arithmetic deserves a worked example, offered as an illustration with assumed numbers, not a measurement of any real system. Suppose a hospital releases 50,000 records with names removed, leaving three coarse facts per patient, each with 100 possible values — say a birth year within a hundred-year span, a residence code covering a hundred areas, and a third attribute with a hundred categories. Those three facts combine into 100 × 100 × 100 = 1,000,000 possible profiles. Spread 50,000 people across a million profiles and the average profile is shared by 0.05 people, which is to say by nobody: almost every patient is alone in their combination. Note the assumptions, because they flatter the anonymiser — real attributes are correlated, and correlation makes people easier to single out, not harder.

There is a second, quieter harm that the word "breach" does not cover: reuse. Records collected for one purpose quietly become the raw material for another. The clearest documented case is a commercial risk algorithm used across the American health system, examined by researchers in Science in October 2019. The algorithm had been trained to predict future healthcare costs and treated cost as a proxy for illness; because less money has historically been spent on Black patients at the same level of need, Black patients had to be considerably sicker to receive the same risk score. Correcting the proxy would have raised their enrolment in additional care programmes from 17.7 to 46.5 percent (Obermeyer et al., Science, 2019). Nothing was stolen and no name was leaked. Records assembled for billing were turned into clinical decisions without the patients' knowledge, and the privacy injury was the decision, not the exposure.

The concentration problem

Digitisation also concentrates. Modern health data does not sit in the hospital that generated it; it flows through intermediaries that route claims, verify eligibility and reconcile payments. That is efficient, and efficiency has a price. What failed at Change Healthcare was not a hospital firewall but the login policy of a company in the middle of the pipe — and because the pipe is shared, the failure was shared too. Claims and prescriptions stalled nationwide, and the regulator's count of affected individuals eventually reached roughly 192.7 million on the company's own reporting (HHS OCR; Witty testimony, 2024).

Two things about this event deserve careful separation. The mechanism is established by testimony and regulatory filings: entry through a server lacking multi-factor authentication, followed by ransomware. The forward-looking lessons — that every consolidated health-data platform is a target of comparable value, and that similar incidents should be expected — are forecasts and beliefs, not findings. And the accounting is not closed: the Office for Civil Rights has said publicly that it continues to investigate the incident and the company's compliance with the Health Insurance Portability and Accountability Act, the statute that sets the American federal floor for health data (HHS OCR, 2024–2025).

Kenya and the unfinished rulebook

Kenya's position is more advanced than a decade ago and less settled than the statutes alone suggest. The Data Protection Act, No. 24 of 2019, gives effect to Article 31(c) and (d) of the Constitution, establishes the Office of the Data Protection Commissioner, and classifies health data as sensitive personal data subject to stricter processing conditions (Kenya Law, 2019). Four years later the Digital Health Act, No. 15 of 2023, assented to on 19 October 2023, went further: it provides for a Digital Health Agency and a comprehensive, integrated digital health information system, together with a framework for data governance and the protection of personal health information (Kenya Law, 2023). The Ministry of Health was still, as of a November 2024 notice, developing the regulations under section 60 of that Act — including health information management policies — that will make much of it operational (Ministry of Health, 2024). The honest description is therefore three-layered: the statute is enacted, the machinery is partly built, and the detailed rules are pending.

Artificial intelligence has now entered the same rulebook. In July 2026 the Office of the Data Protection Commissioner issued a draft guidance note on artificial intelligence, setting out the obligations of controllers, processors, developers and deployers of systems that process Kenyans' personal data, and opened it for public comment until 17 August 2026 (ODPC, 2026; KICTANet, 2026). It remains a draft. What it does not yet settle — consent for the secondary use of medical records as training data, and the rules for automated decisions that touch care — is precisely where the technology presses hardest on the law. Kenya's neighbours in East Africa stand at various stages of the same journey, and those differences matter for any regional health programme that would move records across borders.

What protection actually consists of

The measures with a defensible record are unglamorous. Encrypt data at rest and in transit. Require a second factor for remote access — the Change Healthcare intrusion is the control case for what happens when that fails. Keep audit logs and read them. Train staff, because human error remains a common way in. Collect the minimum that the stated purpose requires and use the data only for that purpose: these are the principles of data minimisation and purpose limitation that Europe's General Data Protection Regulation states in Articles 5 and 9, with health data held in a special category (EUR-Lex, 2016), and that the United States approaches through HIPAA's federal standards (HHS). Privacy by design is not a slogan but a sequencing decision: it is far cheaper to build a system that never holds identifying data than to purge the data afterwards.

The institutions that watch this field have said the rest plainly. The World Health Organization's 2021 guidance on the ethics and governance of AI for health set out six principles, including the protection of human autonomy and privacy alongside transparency and accountability (WHO, 28 June 2021). Its January 2024 guidance on large multi-modal models — the generative systems now being asked to draft clinical notes and answer patient questions — warned of inaccurate or hallucinated outputs, bias, and unsafe automated decisions in health contexts (WHO, 18 January 2024). The privacy question those systems raise is an old one in new dress: whose records train them, and under whose consent.

As for the technological rescues in waiting — federated learning that trains models without moving records, blockchains that promise tamper-evident logs — they are scenarios, not established remedies. Each may address part of the problem; none has been shown to solve it, and some techniques for training on distributed data have documented routes of information leakage. A vendor's claim of "anonymised" or "secured by design" data is a hypothesis to be tested, not a property to be assumed.

What to conclude

The evidence supports a narrow set of claims. Confidentiality is clinically load-bearing, because patients edit what they fear will be seen. "Anonymous" health data is usually anonymous in name only, and the arithmetic of ordinary facts defeats most stripping of names. Centralisation multiplies the consequences of every failure, as 192.7 million people now have reason to know. Kenya has enacted the law and is still building the machinery; its AI guidance is a draft rather than a rule.

What the evidence does not support is the belief that any single technology — encryption, blockchain, federated learning — will settle the matter by itself. Privacy in a digital health system is not a feature to be added at the end. It is a constraint that must be imposed at the beginning, on institutions that would rather not carry it, and enforced by regulators with the resources to inspect. The digitisation of medicine will continue regardless. Whether it preserves the confessions of patients or squanders them will be decided not by the software but by whether anyone is made to answer for the login page.

Public-domain Veterans Affairs electronic health-record flow chart, published in 2010. It diagrams record-sharing workflow; it contains no patient data. Credit: U.S. Department of Veterans Affairs health-IT source, via Wikimedia Commons. Image source · Public domain in the United States as a U.S. federal government work