Court freezes AI-powered radiology platform over patient safety, privacy fears

Rology said it had "served more than 60,000 patients" and supported services in 40 public health facilities.

In a judgment that could shape how AI-powered systems, cross-border telemedicine and patient data are regulated in the country's healthcare sector, the court found gaps in oversight requirements designed to protect patients.

The judge said courts have the power to intervene to prevent harm arising from AI-driven or digital health systems even before patients can demonstrate actual injury, particularly where questions of privacy, safety and constitutional rights arise.

The court ordered the company to immediately cease operations until it complies with the Kenya Medical Practitioners and Dentists Act, the Data Protection Act, the Digital Health Act and regulations governing digital health services.

It also directed the Ministry of Health and the Kenya Medical Practitioners and Dentists Council (KMPDC) to cancel any licences, approvals or authorisations issued to the company relating to the handling, storage or processing of patients' health records through its digital platforms.

The case was filed by four officials of the Kenya Association of Radiologists, who argued that the company's operations exposed patients to privacy breaches, undermined professional oversight and disadvantaged locally licensed radiologists subject to strict regulation.

The judgment places patient safety and regulatory accountability at the centre of the country's push to modernise healthcare through digital technologies.

At issue was whether Rology, described in court filings as a Kenyan affiliate of an Egyptian-founded teleradiology platform, had been lawfully operating in Kenya while facilitating interpretation of medical images through a network of radiologists outside the country.

The petitioners alleged that radiological images and patient histories were being transferred abroad without informed consent and without disclosure of the identities and qualifications of the professionals generating reports.

They argued that the arrangement violated constitutional rights to privacy, consumer protection, fair labour practices and the highest attainable standard of health.

However, Rology Medical Kenya Lt denied the allegations. In affidavits filed in court, the company said it addressed shortages of radiologists by connecting hospitals with qualified specialists worldwide.

It said reports generated through its platform were reviewed and validated by licensed Kenyan radiologists before being released to healthcare facilities.
The company also disputed claims that artificial intelligence generated diagnoses.

It told the court that its platform "matches medical images uploaded by hospitals with qualified radiologists worldwide" and that Kenyan radiologists review the reports before formal issuance.

The court found that the constitutional questions raised by the petition extended beyond administrative disputes that could be resolved by sector regulators.

"They touch the very fabric of constitutional protections," the court said while rejecting arguments that the dispute should first have been handled by the Office of the Data Protection Commissioner or other statutory bodies.

The judge said the KMPDC had failed to provide a substantive response to allegations that Rology was operating without registration required under Kenyan law.

"Registration is not a procedural nicety," the court said. "It is a statutory safeguard designed to ensure accountability, professional competence, and the protection of those who rely on medical services."

The court said the scale of the company's activities heightened the public interest considerations before the court.

"When an entity providing radiology services engages with tens of thousands of patients, the question of regulatory compliance is not abstract," said the judge.

"It bears directly on patient safety, professional oversight, and the constitutional and statutory obligations designed to protect the public."

The court further held that KMPDC could not rely on delays in implementing the Digital Health Act to avoid its regulatory responsibilities.

"The obligation to ensure that all providers of health services, whether operating through traditional or digital platforms, are duly registered, licensed, and subject to regulatory oversight flows directly from the Constitution," the court said.

It further found that the regulator's actions exposed patients to "a real and avoidable risk" of privacy breaches and substandard services, while leaving consumers without adequate safeguards.

"The continued operations of the sixth respondent ... violate Articles 43(1)(a), 46(1)(a) and (c), and 41(1) of the Constitution," it ruled, underscoring that technological advances in medicine remain subject to the same standards of accountability, licensing and patient protection that govern traditional healthcare providers.

The decision comes as Kenya expands the use of digital health technologies and seeks to improve access to specialist care amid shortages of medical professionals, particularly outside major urban centres.

The case also unfolded against wider uncertainty over the country's digital health framework after the Digital Health Act was challenged in court.

The court noted that although an earlier High Court judgment had declared the law unconstitutional, that decision was subsequently suspended by the Court of Appeal, meaning the Act remains in force pending determination of the appeal.

→ [email protected]

Follow our WhatsApp channel for the latest business and markets updates.