If your hospital or clinic in Kenya still thinks about NHIF-compliant software, that vocabulary is out of date. The National Hospital Insurance Fund was replaced by the Social Health Authority (SHA), which began operating on 1 October 2024 under the Social Health Insurance Act. What matters for software buyers now is not an NHIF claim form. It is whether your HMIS (Health Management Information System) is certified by the Digital Health Agency (DHA) and can exchange data and claims with the national digital health infrastructure.
This guide is for facility owners, medical superintendents, and HMIS or IT leads in Kenya. It explains what changed, what SHA-compliant EMR software has to do, what DHA certification involves, and how to evaluate any vendor, including us. It is general information, not legal advice, so confirm current rules with SHA and the DHA before you commit.
What Changed: From NHIF to SHA
The Social Health Insurance Act, 2023 created SHA to manage public health financing through three funds: the Primary Healthcare Fund, the Social Health Insurance Fund (SHIF), and the Emergency, Chronic and Critical Illness Fund. SHA replaced NHIF, which had operated since 1966. The Ministry of Health announced the 1 October 2024 launch on its official site.
The digital side is just as important as the insurance side. SHA moved from a provider portal to an HMIS-based model branded Taifa Care, where verification, authorisation, and claims run electronically. Reporting in 2026 indicated that claims processing for Level Four public hospitals had already moved onto this HMIS. That is the direction for every facility.
The Deadline: 30 September 2026
SHA set a deadline for facilities to operate a DHA-certified HMIS that is integrated with the national health information exchange. Reports on 1 September 2026 said the compliance deadline had been extended to 30 September 2026, and that facilities without a compliant system risk being left out of SHA contracting, contract renewal, or continued participation in SHA-funded schemes. You can read one of the reports on Capital FM.
Deadlines in this area have moved before, so treat the date as a planning constraint, not a promise of leniency. Check the latest guidance directly with SHA and the DHA.
What Is a DHA-Certified HMIS?
The Digital Health Act, 2023 established the Digital Health Agency to build and maintain Kenya's national health information infrastructure. Under the Digital Health regulations of 2025, only certified solutions may connect to the national exchange. In practice, a DHA-certified HMIS is a facility system that has passed DHA review for security, data protection, and interoperability, and appears on the DHA's public registry.
Practitioner guides describe six requirements for certification. Confirm the current list with the DHA, but expect to prepare:
- A self-attestation report (the DHA HMIS form).
- Registration with the Office of the Data Protection Commissioner (ODPC) under the Data Protection Act, 2019.
- A Data Protection Impact Assessment (DPIA) for the system.
- A security, privacy, and confidentiality policy.
- A backup and recovery policy that has actually been tested.
- Proof of interoperability and standards compliance.
On standards, practitioners report that the exchange expects FHIR for data exchange, HL7 message transformation, ICD-11 diagnosis coding, SNOMED CT terminology, and alignment to national product and facility registries. The DHA's technical review includes interoperability testing, and successful systems are listed on its registry.
What SHA-Compliant EMR Software Must Do
| Requirement | What to look for in the software |
|---|---|
| Patient verification | Look up a patient's SHA eligibility at registration and store the insurance identifiers |
| Pre-authorisation | Request and record authorisations for services that need them, with status tracking |
| Electronic claims | Build claims from clinical and billing records, submit them electronically, and track acceptance, rejection, and payment |
| Standards | FHIR, HL7, ICD-11 and SNOMED CT support for exchanged records |
| Registries | Alignment with client, health worker, facility, and product registries |
| Data protection | Access control, audit trail, ODPC registration support, DPIA evidence |
| Resilience | Documented and tested backup and recovery, and offline handling for weak connectivity |
Where Quecorex Fits, and What We Will Not Claim
Quecorex includes the building blocks a facility needs for insurance-driven care: patient registration with insurance information, payer management, charge capture, coding, claims management, pre-authorisation, and insurance exclusions in the billing module, plus audit and monitoring, compliance management, and data privacy tools. On the interoperability side, the platform includes a FHIR client, FHIR outbound sync, and HL7 interface management.
Building blocks are not the same as certification. DHA certification is granted per system by the DHA, and you should not rely on a vendor's claim alone. Whatever vendor you choose, ask for the DHA certificate reference, verify it on the DHA registry, and ask for a written statement of which SHA functions are live in production. If you want to know Quecorex's current certification and integration status for Kenya, contact us and we will answer in writing.
A Readiness Checklist for Kenyan Facilities
- Confirm whether your current system is on the DHA registry. If it is, get the certificate details on file.
- If not, ask your vendor for their certification timeline in writing, with dates.
- Register with the ODPC if you have not, and complete your DPIA.
- Write and test your backup and recovery procedure. Keep the test record.
- Map who registers patients, who verifies eligibility, who codes, and who submits claims.
- Check that your diagnoses can be exported in the coding standard the exchange expects.
- Train billing staff on the electronic claim rejection workflow before go-live.
- Plan downtime and connectivity fallbacks for claims and verification.
- Contact the DHA for technical support if you are stuck. It offers assistance to facilities.
How to Choose an SHA-Ready Vendor
- Is the exact product and version DHA-certified, and can you verify it publicly?
- Which SHA functions are live in production for other Kenyan facilities today?
- Who is responsible when SHA or DHA specifications change, and what does that cost?
- How are patient data hosted, backed up, and restored, and can they show a recent restore test?
- What is the implementation timeline for a facility of your size and level?
- What does it cost? See our pricing page for a country-adjusted estimate by module.
For the technical foundation behind exchanges like this, read our HL7 and FHIR interoperability guide. For the wider Africa picture, see our guide to hospital software for African healthcare.
What to Do After You Are Certified or Contracted
- Keep your evidence in one place. Store the certificate reference, your data protection registration, the DPIA, and the tested recovery record where an auditor can find them.
- Watch for specification changes. Agree with your vendor who monitors DHA and SHA updates and how changes are delivered and priced.
- Train on the rejection workflow. Most lost income comes from claims that are rejected and never worked, so give billing staff a daily rejection queue and a target for clearing it.
- Reconcile monthly. Compare SHA payments against submitted claims and follow up every difference.
Common Mistakes to Avoid
- Assuming that a vendor's brochure claim is the same as a DHA certificate. Verify it on the registry.
- Leaving certification to the last week. Documentation, policies, and testing all take time.
- Treating backup as a checkbox. The policy has to be tested and the test recorded.
- Ignoring connectivity. Plan how claims and verification continue when the link is slow or down.
- Letting one person hold every registration, coding, and claims permission. Separate the roles.
Final Thoughts
The move from NHIF to SHA turned health insurance in Kenya into a data exchange problem. Facilities that can verify patients, authorise services, and submit clean electronic claims from a certified system will be paid and contracted. Those that cannot will struggle, however good their clinical care is. Use the checklist, verify every vendor's certification yourself, and ask for answers in writing. Talk to us about your facility and timeline.