SECTOR
OLM Law advises hospitals, pharmaceutical companies and health investors in Kenya on licensing, M&A, data protection and dispute resolution.
DISCUSS YOUR MATTER →Kenya’s healthcare sector is undergoing rapid transformation — driven by expanding insurance coverage, growing private-hospital investment, a dynamic pharmaceutical industry and an increasingly active regulatory environment. OLM Law advises hospitals, clinics, pharmaceutical companies, medical-device manufacturers, insurers and investors on the legal and regulatory issues across the entire health value chain.
The sector is regulated principally by the Kenya Medical Practitioners and Dentists Council, the Pharmacy and Poisons Board, the Kenya Medical Devices Authority and the Social Health Authority (SHA). County governments have a significant role in primary healthcare delivery under the devolved system. The Data Protection Act adds an important layer of compliance for patient data and electronic health records. We help clients navigate these overlapping frameworks efficiently.
We draw on our Corporate & Commercial, Intellectual Property, Data Protection and Dispute Resolution teams for healthcare clients.
To invest or operate in Kenya’s healthcare sector, contact OLM Law.
What licences does a private hospital or clinic need in Kenya? Facility registration and practitioner licensing through the Kenya Medical Practitioners and Dentists Council, together with Pharmacy and Poisons Board approvals where medicines are dispensed and the relevant county health authorisations. We manage the applications, inspections and renewals.
How are medicines and medical devices registered? Medicines are registered with the Pharmacy and Poisons Board and devices with the Kenya Medical Devices Authority, each with separate import, storage and distribution permits. We advise on registration dossiers, labelling and the distribution agreements that sit behind them.
What rules apply to patient data and electronic health records? Patient information is sensitive personal data under the Data Protection Act 2019, which requires ODPC registration, a lawful basis for processing, retention and access controls, and breach notification. We build compliant records, consent and vendor frameworks.
