SHA patient data safety questioned after Nairobi man’s records show treatment in Garissa

Concerns have emerged over the safety and integrity of millions of Kenyans’ private medical records under the Social Health Authority (SHA) following the case of a Nairobi man whose account showed that he had received treatment at a health facility in Garissa County, yet he was at work in Nairobi at the time.

Obed Oruki says he was shocked after discovering records indicating that he had been diagnosed with a urinary tract infection and placed on active medication.

His case, which has drawn widespread attention online, is raising serious concerns over fraud, data privacy, possible identity misuse, and the credibility of Kenya’s digital health records system.

Obed Oruki’s routine check on his SHA account turned into a shocking discovery. The SHA portal showed he had received treatment and medication from a dispensary in Garissa County on May 6, 2026 at exactly 7:16am.

At that very time, Obed says he was nowhere near Garissa and was seated in his office in Nairobi, engaged in work.

“The previous day Citizen had actually aired a show where they interviewed Allan Namu and his team on error by design so because I was busy that day I didn’t watch it…I said I will watch it, and while at it I just thought out of curiosity why not check on SHA and shock on me,” Obed says.

Obed has private medical insurance and has so far, never used his SHA cover. The records show someone underwent medical assessment under his name and details.

“So I looked at it the first time and I was hesitant I was like probably it is a mistake let me refresh…so I looked at it the second time and the same thing so I went to the medical history and I was like something is wrong,” he narrates.

Records indicate that whoever accessed Obed’s account first logged into the system at midnight. The patient’s vital signs were captured hours before the diagnosis and prescription were later entered at around 7am.

The false records show Obed was diagnosed with a urinary tract infection and prescribed two medications: Cefixime 400 milligrams for five days and Paracetamol 500 milligrams

“They didn’t even have the decency to give me a ‘good’ ailment…a UTI…I like how Kenyans joked about it but the shock that it is possible for someone to get into your account and do things and make decisions on your behalf and the ramifications of that in the long term assuming that is information that is going to stay in my account for long…I never suffered that but probably it maybe used against me somewhere,” adds Obed.

Citizen TV used the service provider number appearing on Obed’s SHA records to verify the authenticity of the institution.

The search led to Hagardul Dispensary, a government-owned Level Two health facility in Dertu Ward, Dadaab Sub-County, Garissa County.

It raises serious concerns over the safety, accuracy and protection of millions of Kenyans’ personal medical data under the Social Health Authority system.

“I didn’t have any OTP notification prior to logging in coz I did get an OTP when I logged in but prior I didn’t and that tells you in my view it’s an inside job…somebody has bypassed that and denied me an opportunity to pick that problem immediately,” Obed says.

An individual identified as Idle Kusow Hassan made entries in Obed's records. Citizen TV could not verify whether such an individual exists in the facility, and his role. Efforts to reach Hagardul Dispensary for clarification were unsuccessful.

Digital Health Authority Chief Executive Officer Anthony Lenayara maintains that access to member information and services is protected through a strong authentication and consent mechanism, adding that they haven't received sufficient details regarding this particular case, to independently verify the claims.