On December 4, 2025, Kenya signed a health cooperation framework with the United States focused on supporting priority health programs in Kenya.
The framework covered; HIV/AIDS, tuberculosis (TB), malaria, maternal and child health, polio eradication, disease surveillance, and infectious disease outbreak response.
President William Ruto described the deal as a step towards universal health coverage.
“The framework we sign today adds momentum to my administration’s universal health coverage that is focused on the supply of modern equipment to our hospitals, efficient and timely delivery of health commodities to our health facilities, enhancement of our health workforce, and health insurance for all and leaving no Kenyan behind,” he said.
The agreement promises stronger laboratories, faster outbreak detection, and improved coordination.
The United States pledged about 1.6 billion US Dollars over five years, while the government of Kenya pledged to increase domestic health expenditures by 850 million US Dollars to gradually assume greater financial responsibility as U.S. support decreases over the course of the framework.
The structure marked a shift away from programs run through agencies such as USAID to direct government-to-government funding.
More than just funding agreements
But Kenya’s deal is not an isolated case.
At least 26 African countries, including Rwanda, Uganda, Zimbabwe, and Lesotho, among others, have signed similar bilateral health agreements under what Washington calls a new global health strategy. Only five of those agreements, namely Kenya, Uganda, Mozambique, Nigeria, and Ethiopia, have been made public, leaving the majority hidden from scrutiny.
Across the continent, the pattern is consistent. Funding is being scaled down from previous programs, especially those tied to HIV and tuberculosis, while access to health data and pathogen information is becoming a central requirement.
These are not just funding agreements. They are data agreements.
At the centre of Kenya’s framework is a set of obligations that go beyond financing.
The agreement requires countries to share pathogen samples and genetic sequence data within days of detection, feeding into global surveillance systems.
It also opens up national health databases, including laboratory systems and disease tracking platforms, to external access. In practical terms, this could include personal medical records such as diagnosis and treatment history, genetic information like DNA and disease susceptibility, laboratory samples including blood and tissue, insurance data reflecting coverage and claims, and information from digital health platforms.
Benigno Aquino, a data protection lawyer and managing partner with Aquino Advocates, says while funding commitments run for five years, data access provisions are reported to stretch far longer, in some cases extending for decades, with continued access even after agreements expire.
“The data-sharing agreement is structured to last seven years, with long-term (up to 10 years) data access clauses for the U.S. government following the termination of funding,” he says.
What is less clear is what Kenya receives in return beyond funding.
Aquino says there is no binding guarantee that vaccines, treatments, or technologies developed from shared data will be accessible or affordable to Kenyans.
“The framework requires Kenya to share biological specimens and genetic sequences of pathogens with epidemic potential within days of detection, but without guaranteed reciprocal access to any vaccines or treatments later developed,” he added.
Legalities of the framework
The High Court’s decision to halt the framework’s implementation has brought Kenya’s Data Protection Act into sharp focus.
Kenyans, including civil society organizations and human rights activists, petitioned the framework before the High Court.
The CSOs, alongside Consumer Federation of Kenya and Busia senator Okiya Omtata, questioned the legalities of the framework
In their petition, the parties raised issues with Data privacy and sovereignty, lack of public participation, and the transition of donor funding from a non-governmental organization to a government-to-government arrangement.
Okiya Omutata argues that the agreement collides with key provisions of the law.
In his Petition, he argues that the Framework violates the principle of public participation in articles 10 and 118 of the Constitution, as no consultation was held before the signing of the Framework, notwithstanding that the Framework directly impacts the health rights of the people of Kenya guaranteed under article 43(1) (a) of the Constitution.
The petition further states that the framework breaches the treaty-making procedures in Article 2(6) of the Constitution and Treaty Making and Ratification Act; infringing on fiscal responsibility and accountability in Articles 201, 220, 221, and 232 of the Constitution and Public Finance and Management Act.
While speaking with the media, Okiya reiterated his concerns raised in the petition.
“It is unconstitutional that the framework was never presented to the cabinet, never tabled before the national assembly, and never subjected to parliamentary debate or ratification. Its signature by the 1st respondent was therefore an unlawful act and potentially a criminal offence,” he said.
Data Sovereignty
Section 46 of the Data Protection Act 2019 classifies health data as highly sensitive, restricting its handling to professionals bound by confidentiality. Yet there are indications that external contractors or auditors could gain system-level access.
Victor Ndeda of Amnesty International raises a broader concern about the data sovereignty of a country after selling off the data to another country.
“Health data is among the most sensitive categories of personal information,” he says. “If another government gains real-time access without clear limits, that touches directly on Kenya’s data sovereignty.”
Sections 48 and 49 limit cross-border data transfers unless the receiving country offers comparable protection. But, James Mbugua, A data protection lawyer and executive committee member of the Data Privacy and Governance Society of Kenya, argues that the United States does not have a single, unified data protection law equivalent to Kenya’s framework; instead, it relies on segregated laws from different states.
“The US does not have laws that measure or have a remedy available such as here in Kenya where you can go to the Data Protection Commissioner and seek remedy from or in the European Union where you can go to the data protection authorities,” he said. But Under the General Data Protection Regulations GDPR the United States can still punish or prosecute whenever data agreement is violated,” he added.
Section 25 of the Data Protection Act 2019 requires data to be collected for a clear purpose. Paul Otuma, the Executive Director at National Empowerment Network for People Living with HIV & Aids in Kenya, NEPHAK, says patients seeking treatment are not consenting to their biological samples being uploaded into international research systems.
“People who go to the hospital to seek medical care do not consent to their data being uploaded to digital platforms. And as you know, people living with HIV are sometimes sensitive due to stigma, even getting them to speak with a counselor is sometimes difficult,” he said.
Section 31 requires a Data Protection Impact Assessment for high-risk projects. Petitioners argue that no such assessment was made public before the agreement was signed.
Okiya Omutata on his X (formerly Twitter) account argued that the agreement bypassed public participation. In his X post, he says no consultations with the public, including citizens, Civil Societies, and health sector stakeholders, were done.
“No consultations were conducted with citizens, civil society, or health sector stakeholders. The Framework was never tabled before Parliament as mandated by the Treaty Making and Ratification Act, 2012, amounting to a breach of Articles 2(6), 10, 118, and 232. The Executive effectively usurped legislative authority,” part of the post reads.
“We are dealing with structured health records, surveillance dashboards, and possibly identifiers linked to programme beneficiaries. Once that data leaves Kenya, we are not sure of enforcement mechanisms if something goes wrong,” he says
Mbugua further notes that the deal qualifies as a treaty, which ought to have passed through the parliament for discussion by the members of parliament before signing.
Did Kenya rush the deal
Not all countries have responded the same way. While Kenya moved early to sign the deal bypassing parliament, other countries ware more careful with what they are getting themselves into like Zimbabwe.
Zimbabwe rejected a similar agreement outright, choosing to forgo hundreds of millions of dollars in health funding rather than accept the terms. Zambia has pushed back, with negotiations stalling over data-sharing provisions.
Rwanda signed, but negotiated a customized deal that includes specific partnerships with American firms, including Zipline International for drone delivery and Ginkgo Bioworks for ‘biothreat radar’ surveillance. This allows rapid, nationwide delivery of medical supplies to remote areas and advanced biological surveillance, strengthening pandemic preparedness and establishing Rwanda as an African hub for technology-driven healthcare.
Nigeria, on the other hand, agreed to the largest package, reportedly tying parts of the funding to internal policy considerations.
The variation reveals something deeper. African countries are not simply accepting these deals. They are weighing them against immediate financial pressure.
Kenya’s decision did not happen in a vacuum.
For years, programs like PEPFAR have underpinned HIV treatment, prevention, and support services. When funding cuts and restructuring hit in 2025, the gap was immediate.
Health systems that relied on external support were suddenly exposed.
Rough estimates show that US funding accounted for a significant share of Kenya’s health spending. According to Aid Data, a site showing US funding to different countries, FROM 2001 to 2018, the United States spent roughly Nine Hundred and thirty million US dollars to bilateral assistance to Kenya annually. Of the total bilateral assistance, 65% of the chunk goes to the health sector. When that pipeline shrank, the government faced a stark choice: accept new terms or risk disruption of critical services.
In that context, 1.6 billion dollars over five years begins to look less like a partnership and more like a lifeline.
Meanwhile, Nelson Otuma sees continuity in the partnership. In his view, it is the funding model that has changed.
“The US has supported Kenya for decades,” he says. “What is changing is the structure moving from donor-managed programs to direct government partnerships.”
There are also geopolitical considerations.
Kenya’s growing security ties with the United States, including its role in international missions and defense agreements, form part of a broader relationship where health, security and economic support intersect.
The move from multilateral support to bilateral deals fragments negotiating power. Instead of acting as a bloc, countries negotiate individually, often under pressure.
The Africa Center for Disease Control and Prevention has raised concern. Its leadership through the Director General, H.E Dr. Seah Kaseya, publicly questioned the implications of data sharing and pathogen access, warning that control over African health data is at risk.
In a statement issued by the Africa CDC says Africa’s health security is non-negotiable and that a self-reliant Africa is essential to not only Africa as a continent but also for the stability of global health.
“Africa’s Health Security and Sovereignty Agenda is non-negotiable. It represents our collective commitment to move from dependency to ownership, and from vulnerability to resilience. A secure and self-reliant Africa is essential not only for our continent but for the stability of global health systems. Health sovereignty does not mean isolation; it signals a new model of partnership in which African nations lead with clarity and confidence, and global partners support African-defined priorities,” reads part of the statement.
The government of Kenya, through the Ministry of Health, has, however, defended the framework saying the government of Kenya did not negotiate a specimen-sharing agreement.
Speaking in a local television morning program, Health Principal Secretary Dr Ouma Oluga who is the Accounting and Authorised Officer in the ministry termed the framework as forward-looking.
“What we signed was sharing of de-identified aggregated data such that the data cannot trace back to the original owner,” he said.
He further urged Kenyans to have faith in their specialist and give them the benefit of the doubt.
“What I can tell my fellow Kenyans is that they need to have faith in their specialist. I have been part of the negotiating team from the onset, and I can assure you that there are no calls for alarm because we also want the best for our country,” he added.
