1Executive Summary: The National Digital Health Shift
In 2023, Kenya enacted the landmark Digital Health Act (Act No. 15 of 2023) alongside the newly gazetted Digital Health (Data Exchange & Interoperability) Regulations. This legislation permanently replaced the fragmented healthcare data landscape with a unified, legally mandated digital infrastructure managed by the Digital Health Agency (DHA).
The Social Health Authority (SHA) is sunsetting its manual web provider portal. Health facilities without an officially DHA-certified Hospital Management Information System (HMIS) integrated into the national Health Information Exchange (HIE) face direct disqualification: claims cannot be processed, contracts cannot be renewed, and insurance payouts will halt.
This guide provides hospital administrators, medical superintendents, clinic proprietors, and IT leaders with exact clarity on what the DHA requires, how the certification pipeline operates, and how BizedHMS guarantees uninterrupted compliance and revenue flow.
2What is the Digital Health Agency (DHA)?
The Digital Health Agency (DHA) is the statutory body established under Section 5 of the Digital Health Act. It operates as the supreme technical custodian of Kenya's national digital health infrastructure, responsible for developing, operationalizing, and maintaining the Comprehensive Integrated Health Information System (CIHIS).
Authoritative national master registries for Facilities (KMHFR), Healthcare Workers (HWR), Health Products & Technologies (HPTR), and Patients (Client Registry).
Regulating and certifying all EMRs, HMIS, LIS, and digital health software operating in Kenya to enforce data safety, FHIR standards, and patient privacy.
3The Kenya Digital Health Superhighway Architecture
The Digital Health Superhighway is not a concept—it is a live, production-grade ecosystem. To interface with it, your HMIS must communicate across several national components:
1. Health Information Exchange (HIE) & Enterprise Service Bus (ESB)
The central routing backbone built on HL7 FHIR R4 REST APIs, enabling bi-directional real-time communication between private facilities, public hospitals, KEMSA, and the SHA.
2. Kenya Client Registry (CR) & Maisha Namba UPI
Deterministic and probabilistic matching linked to IPRS/Maisha Namba, issuing a Unique Patient Identifier (UPI) so every citizen possesses one longitudinal electronic health record across Kenya.
3. National Shared Health Record (SHR)
A federated clinical data store standardizing encounters, vitals, lab orders, and discharge summaries using FHIR and SNOMED CT / ICD-11 coding.
4. Electronic Claims Platform (AfyaConnect API)
Real-time insurance claims generation, AI/ML fraud scoring, automated pre-authorizations, and direct payment reconciliation between healthcare providers and the Social Health Authority.
5. Citizen Portal — Afya Yangu
The patient-facing app empowering citizens to manage biometric verification, view their medical history, schedule appointments, and give consent for clinical record sharing.
4The 6 Mandatory DHA Certification Criteria
To receive official certification from the DHA, every HMIS vendor and health facility software must satisfy six exhaustive evaluation criteria:
Self-Attestation (Form HMIS 4)
Comprehensive internal compliance audit and technical gap analysis submitted through the DHA portal certifying full standards conformance.
ODPC Registration (Cap. 411C)
Valid registration with the Office of the Data Protection Commissioner as both a Data Controller and Data Processor for health data processing.
Data Protection Impact Assessment (DPIA)
Formal DPIA conducted by an accredited assessor identifying clinical confidentiality vulnerabilities and documented risk mitigations.
Security & Privacy Policies
Role-based access controls (RBAC), multi-factor authentication, cryptographic audit logs, and AES-256 encryption at rest and in transit.
Tested Backup & Disaster Recovery
Demonstrated offsite automated backups, tested failover drills, and a verifiable Recovery Time Objective (RTO) under 4 hours.
FHIR R4 & ICD-11 Interoperability
Native compliance with WHO ICD-11, Kenya National Product Catalogue codes, and certified bi-directional FHIR JSON message exchange.
5The 5-Step DHA Certification Flow
Portal Registration & Self-Attestation
Create an official Business Account on the DHA Portal (app.dha.go.ke) and complete the Form HMIS 4 self-attestation gap analysis.
Document & Policy Submission
Upload verified ODPC controller/processor certificates, the completed DPIA dossier, data security policies, and backup logs along with statutory fee payment.
DHA Technical Review & Sandbox Lab Testing
DHA engineers execute synthetic clinical encounters and claims payloads in the national staging sandbox to verify FHIR schema validity and API responsiveness.
Technical Board Evaluation (30-Day Window)
The DHA Certification Committee formally reviews test outcomes and issues the compliance decision within 30 statutory days.
Certificate Issuance & CIHIS Production Interconnect
The software is published on the official DHA Public Registry and granted production API tokens for live SHA claims and Shared Health Record synchronisation.
6What DHA & SHA Mean for Your Facility
Outpatient & Doctor Practices
- Instant SHA beneficiary eligibility check at reception
- Real-time claim submission for primary outpatient care
- No manual duplicate entry into multiple portals
Nursing & Maternity Homes
- Seamless delivery & ANC package claims
- Automated KEPI immunization and child health tracking
- Pre-authorization requests sent in seconds
Hospitals & Surgical Centres
- Multi-department claims (Theatre, LIS Labs, Inpatient)
- AI-backed rejection prevention before submission
- Full MOH 705/711 automated reporting integration
7Why BizedHMS is Built for the Digital Health Superhighway
While older legacy software vendors in Kenya struggle to retrofit 15-year-old on-premise desktop architectures for modern cloud APIs, BizedHMS was designed from day one on cloud-native HL7 FHIR R4 microservices.
| Feature / Requirement | Legacy Desktop / Server HMIS | BizedHMS Cloud-Native |
|---|---|---|
| Architecture & Hardware | Requires expensive on-premise servers & local LAN setup | 100% Cloud-Native; runs on any browser, tablet, or laptop |
| FHIR R4 & CIHIS Integration | Custom patch-jobs prone to breaking and desync | Native HL7 FHIR R4 schema built-in from the core |
| SHA Claims Processing | Manual export-import or sluggish batch filing | Instant 1-click real-time dispatch via AfyaConnect API |
| Data Protection (ODPC) | Local server theft risk; manual unencrypted backups | AES-256 encryption + 100% in-country Kenyan data residency |
| Queue & Patient Experience | Crowded paper slips and noisy hallway calling | Plug-and-play Smart TV display & WhatsApp turn alerts |
| M-Pesa Cashier Integration | Manual phone checking prone to fake SMS scams | Instant STK push to patient phone with automated receipts |
8Interactive Facility Readiness Audit
Use our interactive tool below to check where your facility stands today and identify critical gaps before the DHA regulatory inspection:
Kenyan Facility DHA & SHA Readiness Audit
Check the items your healthcare facility and current HMIS software currently support:
9Frequently Asked Questions (FAQ)
Will our facility lose our SHA contract if our HMIS is not DHA-certified?
Yes. The Social Health Authority regulations mandate that facilities must be integrated into the national Health Information Exchange via a certified HMIS to renew contracts and receive reimbursement.
Can BizedHMS migrate our existing patient records without clinic downtime?
Absolutely. Our specialized onboarding team imports your historical patient lists, drug pricing, staff credentials, and active accounts over a weekend, ensuring zero operational disruption on Monday morning.
Do we need to purchase new servers or complex networking equipment?
No. BizedHMS runs 100% in the cloud. You can use your existing reception laptops, nurse tablets, doctor computers, and standard Smart TVs with regular office internet.
Is BizedHMS data hosted inside Kenya?
Yes. All patient records and audit logs are hosted in high-security Tier-3 data centers within Kenya, satisfying both the Data Protection Act 2019 and the Digital Health Act 2023.
Prepare Your Facility for DHA Certification & Instant SHA Claims
Don't wait for the 1 September 2026 deadline. Partner with BizedHMS today to safeguard your claims revenue, modernize your clinic workflow, and delight your patients.