Health data integrity, patient privacy and the case for a national protection plan..
When Cabinet turned down a proposed US health compact, it protected something most citizens never see: the record of their illnesses.
President Mahama explained the decision at the Council on Foreign Relations in New York on September 25, 2026.
The agreement was meant to replace health funding lost when USAID support ended. Cabinet balked at demands for Ghana’s pathogen profile and citizens’ medical records, and moved quickly to reject it.
The decision was right. It is also only the start of the work.
What was on the table
The reported figures differ, and the agreement’s text is not public. Everything here rests on the President’s account and press reports.
Reuters reportedly put the offer at $109 million over five years. One Ghanaian outlet describes a framework of about $300 million, with Ghana funding the remainder.
The President also named two other conditions: a Ghanaian cash contribution, and a bar on the Food and Drugs Authority (FDA) inspecting products brought in under the deal.
Ghana was not alone. KFF counted 35 countries that had signed the new US health agreements by September 11, most of them in Africa.
Nigeria and Uganda signed in December 2025, and their deals reportedly allow access to sensitive health data and pathogen specimens, with some terms running to 25 years of patient data. Zimbabwe and Namibia refused. Kenya, Tanzania and Rwanda signed.
Human Rights Watch reviewed seven of the agreements. It concluded that life-saving aid is being tied to surveillance data and to rights over pathogen samples, and that patient data could reach US drug companies without patient consent.
Those are findings about other countries’ agreements, not about Ghana’s draft.
Item
Reported figure
Direct US funding offered
$109 million over five years
Total framework (one outlet)
About $300 million; Ghana to fund the balance
Funding withdrawn from Ghana’s budget
$174 million
Resulting annual health shortfall
$74 million
Countries with signed US health deals
35 (KFF, September 11, 2026)
Patient data period in Nigeria/Uganda-type deals
Up to 25 years
Why individual records are different
Health data is not like other data. A leaked password can be changed. A diagnosis cannot. HIV status, a psychiatric history or a pregnancy outcome can cost a person a job, a marriage or standing in a community, and the harm lasts.
There are two kinds of data here, and the debate often blurs them. Aggregate surveillance data, such as case counts by district, is how outbreaks are caught and how countries cooperate. Identifiable patient records are another category.
The chairman of Parliament’s health committee drew the same line, calling individual medical data a red line. Ghana can share the first under clear rules.
The second should leave the country only with consent or a court order.
Pathogen data adds a commercial angle.
A sample from Ghana can become a vaccine or a diagnostic. Without a benefit-sharing clause, Ghana supplies the raw material and later buys the finished product back.
The price of refusing
The refusal has a cost.
The President said the withdrawal of $174 million programmed into the budget left a $74 million annual hole in health financing. That is the real tension. Sovereignty is easy to defend if you are not the clinic that loses its HIV commodities.
He linked the loss to the Accra Reset, an initiative aimed at health sovereignty through African production of medicines and vaccines.
Refusing is not the same as protecting
Turning down a foreign request does not secure data at home. Ghana has a legal base.
The Data Protection Act, 2012 (Act 843) set up the Data Protection Commission, and the Cybersecurity Act, 2020 (Act 1038) created the Cyber Security Authority. But a law is not a control.
Many facilities still run paper files or disconnected systems. Staff share logins. Few encrypt records or audit who opened them.
Integrity deserves as much attention as privacy. Integrity means a record is accurate, complete and unaltered.
A wrong allergy entry or a duplicate patient file can harm someone with no hacker involved.
A country that says “our data is ours” must show it can look after that data.
Otherwise the next donor will ask why it should trust the system.
What should happen, and by when
These are my proposals, not government policy. Each needs proper costing.
Timeline
Action
Within 90 days
Publish a national position: no export of identifiable patient records without consent or a court order; aggregate sharing only under written agreements. Review every existing donor and research agreement for data clauses, led by the Health Ministry, the Attorney-General and the Data Protection Commission. Publish the data and inspection terms of any future health agreement before signing and table them in Parliament.
Within 12 months
Classify health data in three tiers (identifiable, de-identified, aggregate) with a sharing rule for each. Set a minimum security standard for every facility holding electronic records: encryption, individual logins, role-based access, audit logs. Aim to bring all regional and teaching hospitals into compliance.
Adopt a pathogen-sharing framework: samples leave only under a material transfer agreement guaranteeing Ghanaian co-authorship, local access to results and a share of any product developed.
Make breach reporting mandatory within a fixed deadline, and publish an annual breach count.
Within 24 months
Host national health data on infrastructure under Ghanaian jurisdiction, with locally held encryption keys. Introduce unified patient identifiers and clean up duplicate records.
Train at least one health data and security officer per region. Fund all of it from a protected line in the health budget, set as a percentage of health spending rather than left to donors.
Funding the principle
Sovereignty without money is a slogan. Data protection belongs inside the Accra Reset agenda, and the same logic applies: build capacity at home, then negotiate as an equal. Partners who want data access can fund the infrastructure that makes safe sharing possible, on Ghana’s terms.
The bottom line
Cabinet made a defensible call: patient records should not be a condition of aid. The harder part comes next. Ghanaians should be able to ask three questions of their health system and get plain answers.
Who can see my record? Who has seen it? What happens if it leaks? Until the system can answer all three, the refusal is a promise, not a protection.
Sources consulted
GBC Ghana Online, “Mahama: Cabinet rejected US health compact over pathogen data, medical records demands”
MyJoyOnline, “Ghana’s Cabinet rejected health deal with US, Mahama says” (September 2026)
Pulse Ghana, “Mahama explains why Ghana rejected US health deal” (September 28, 2026)
West Africa Weekly, “Nigeria and Uganda signed US health deals…” (citing Human Rights Watch)
Ghana Business News, “Beyond the sovereign ‘No'” (September 30, 2026)
KFF tracker of US bilateral health agreements, as cited in press reports
