In this guide
This guide is general information, not legal advice. Deadlines and fees can change at short notice. Confirm your own position with the Digital Health Agency (certification.dha.go.ke, helpdesk@dha.go.ke, or dial 147), with SHA, or with a qualified advisor.
What SHA and the DHA are asking for
Every facility that wants to keep claiming from the Social Health Authority (SHA) must run a Health Management Information System (HMIS) certified by the Digital Health Agency (DHA) and connected to the national Health Information Exchange. The original date for private facilities was 1 September 2026. It was extended by one month, to 30 September 2026.
Facilities that do not meet the requirement risk being left out of SHA contracting, contract renewal or continued participation in SHA-funded schemes. For most private hospitals that is a large share of revenue, at a time when many are already carrying unpaid SHA claims.
If you only do one thing this week: open the DHA public register and confirm your HMIS is on it.
The law behind it
- The Digital Health Act, 2023 (No. 15 of 2023) created the Digital Health Agency and gave it the job of certifying digital health solutions (section 6(m)).
- The Digital Health (Health Information Management Procedures) Regulations, 2025 (Legal Notice 76 of 2025) make it concrete. Regulation 37(1) says a healthcare provider or health facility shall not use a digital health solution in the provision of healthcare services unless it has been certified by the Agency.
- Penalties. Where no specific penalty applies, breaking the Act is an offence carrying a fine of up to KES 1 million, up to two years' imprisonment, or both (section 59(2)).
- The Data Protection Act, 2019 still applies alongside all of this. DHA will not certify a system whose vendor is not registered with the Office of the Data Protection Commissioner.
The duty sits with the facility and the vendor. The vendor applies for certification; the facility must not use an uncertified solution. That is why owners, not only IT staff, need to know where each system stands.
Which systems need certification
SHA's deadline is about your HMIS, because that is what submits claims. The certification rule itself is wider. DHA lists these categories as needing certification before deployment:
| Category (DHA's wording) | Typical examples in a private hospital |
|---|---|
| Electronic Medical Record (EMR) systems | Clinical notes, patient records |
| Health Information Systems (HIS/HMIS) | Registration, billing, claims, pharmacy and lab modules in one system |
| Laboratory information systems | Test orders, results, quality control |
| Pharmacy systems | Dispensing, stock, drug interactions |
| Imaging and diagnostic systems | PACS, radiology information systems |
| Digital health platforms and apps | Mobile health apps, telehealth, and patient engagement solutions such as reminder and follow-up services |
So if you use a separate lab system, a telemedicine service or a patient messaging service alongside your HMIS, ask each of those vendors about certification too.
How to check a vendor in two minutes
- Open the DHA public register at certification.dha.go.ke/registry.
- Search for your system's name. Each entry shows the organisation, category, certificate number, status and expiry date.
- Use Verify a certificate if your vendor has sent you a certificate number.
- If the system is not listed, ask the vendor in writing for their application reference, the stage they are at, and the date they expect a decision.
On 25 September 2026 the register listed 21 certified systems, most of them issued in the previous two weeks. If your vendor is not there yet, you are not alone, but you do need a dated plan from them.
What your vendors go through: steps, time and fees
Knowing the process helps you judge whether a vendor's promised date is realistic. DHA's portal describes nine stages:
- Self-attestation by the vendor: organisation, system classification, clinical functions, reporting, security and interoperability.
- Application fee and submission, paid by mobile money.
- Evidence upload: company and tax records, ODPC registration, a Data Protection Impact Assessment, security policies, penetration-testing reports, backup and recovery policy.
- DHA document review.
- Testing environment set up by the vendor (20-day window by default).
- Laboratory testing fee, set by the system's category.
- Independent laboratory testing.
- Decision: full certification, conditional certification, re-testing or rejection.
- Certificate issued and published on the public register.
The fees in the Second Schedule of the 2025 Regulations are:
| Fee (vendor pays) | Amount |
|---|---|
| Application fee | KES 20,000 |
| Testing: hospital-wide HMIS | KES 500,000 |
| Testing: outpatient-only HMIS | KES 100,000 |
| Testing: telemedicine | KES 250,000 |
| Testing: mHealth solution | KES 50,000 |
| Students and innovators | Up to KES 10,000 |
DHA's own guidance is that certification typically takes three to six months from application to decision, less when documents are complete. A full certificate lasts two years; a conditional certificate lasts one. DHA can audit certified systems during that time and can revoke a certificate after a major security breach.
This week's checklist for owners
- Confirm your HMIS is on the DHA register, and note the certificate number and expiry date.
- Ask your HMIS vendor whether your facility is live on the national exchange for SHA claims, not only whether the software is certified. They are two different things.
- List every other digital tool that touches patient data: lab, pharmacy, imaging, telemedicine, patient reminders. Ask each vendor for its certificate or application status, in writing.
- Check contracts. Add a clause requiring vendors to hold and maintain DHA certification (or to reach it by an agreed date) and to tell you if a certificate is suspended.
- Keep your ODPC registration current and make sure every vendor handling patient data has signed a data processing agreement.
- Protect cash flow. If your system is not ready by 30 September, speak to SHA and your vendor now about how claims will be handled, rather than after claims start bouncing.
- Keep a folder with certificates, vendor letters and dates. If SHA or DHA asks, you can show your position in minutes.
Common questions
Is the 30 September deadline final?
It has already been extended once, from 1 September. Plan as if it is final. Check SHA's and DHA's official channels for any change.
Our HMIS vendor says they are "in testing". Is that enough?
Field-test approval is not certification. Only systems on the public register hold a certificate. Ask your vendor for their expected decision date and what happens to your claims until then.
Does this apply to small clinics and nursing homes?
The regulation applies to any healthcare provider or health facility using a digital health solution to provide care, whatever its size. SHA's deadline applies to facilities contracted with, or seeking contracts with, SHA.
We use WhatsApp to remind patients. Is that affected?
Reminder and follow-up services fall under DHA's "patient engagement solutions" category, so ask your provider about their certification status. Whatever the status, the Data Protection Act rules still apply: consent, no diagnoses in messages, and a data processing agreement. See our patient data protection checklist.
Sources
- DHA Certification Programme, system categories, FAQ and public register
- Digital Health (Health Information Management Procedures) Regulations, 2025 (regulations 36 to 45 and the Second Schedule)
- Digital Health Act, 2023 (sections 6 and 59)
- SHA gives hospitals one more month to meet digital health rules (September 2026)
See the report owners receive every month
A real sample of the monthly retention report: returning patients, no-shows, ANC completion, immunisations and the patients slipping away. Fictional facility, real format. Free, no follow-up calls.