DHA HMIS Certification & SHA Claims Integration: What Every Kenyan Health Facility Must Know
In 2023, Kenya enacted the Digital Health Act, legislation that established the legal and institutional foundation for a fully connected national health data system. Since then, the Digital Health Agency (DHA) has been building the infrastructure, setting the standards, and creating the certification framework that will determine which health systems are part of Kenya's digital future and which ones are left outside it.
The DHA-led Kenya Digital Health Superhighway is operational. The Social Health Authority's Provider Portal is closing. Facilities without a DHA-certified HMIS integrated into the national Health Information Exchange face a hard deadline of 1 September 2026, after which they cannot process SHA claims, cannot get new SHA contracts, and risk being locked out of the national health financing system entirely.
This blog explains what DHA has built, what it requires of health facilities and their HMIS vendors, and what it means in practice for every hospital and clinic contracted with SHA.
What Is the Digital Health Agency and Why Does It Matter?
The Digital Health Agency (DHA) is a government body dedicated to transforming healthcare delivery through the integration of cutting-edge digital technologies. Its mandate is to develop, operationalize, and maintain the Comprehensive Integrated Health Information System (CIHIS) - the national digital health backbone - to manage core digital systems and the infrastructure required for seamless health information exchange.
DHA establishes registries, creates single sources of truth for clients, health facilities, healthcare providers, health products and technologies, and ensures health data portability while facilitating collection and analysis of data to inform policy and research in the health sector.
DHA is the technical authority behind Kenya's national health data infrastructure. Everything that connects - patient records, insurance claims, drug registries, facility registries, lab results - connects through DHA's systems. And critically, DHA's mandate includes certifying digital health solutions based on best practices and standards, and supporting development of enhanced interoperability standards.
That certification function is now at the centre of every private health facility's immediate compliance obligations.
The Kenya Digital Health Superhighway: What's Actually Been Built
DHA's architecture is a live operational system with multiple components already running. Understanding what it includes helps explain why HMIS certification requirements are as specific as they are.
The Health Information Exchange (HIE) is the backbone of Kenya's digital health ecosystem - a dynamic, standards-based platform facilitating secure and seamless data sharing among diverse healthcare systems. It is built on FHIR standards for real-time, bi-directional data exchange and hosts critical registries including client, health worker, facility, and drug registries. It integrates with national platforms including KEMSA and SHA.
Within the HIE, several specific registries are now live:
The Kenya Client Registry is a centralized, authoritative database ensuring unique patient identification across the healthcare system, with unique patient identifier generation, comprehensive demographic data validation, and advanced search with deterministic and probabilistic matching. This is the system that will eventually ensure every Kenyan has one health record, recognized anywhere.
The National Shared Health Record (SHR) is a centralized repository aggregating patient health data from multiple sources -EMRs, laboratories, pharmacies - using FHIR and SNOMED CT standardization, with role-based access and patient consent mechanisms for real-time clinical data retrieval.
The Electronic Health Insurance Claims Platform revolutionizes claims processing for SHA with automated claim submission, tracking, and settlement, AI/ML-based fraud detection and risk scoring, real-time monitoring and analytics, and secure payment gateway integration.
The Health Interoperability Services Layer (ISL) is the central coordinating hub enabling seamless data routing and transformation between health systems, with message routing to HIE components, HL7/FHIR message transformation, and national-level scalability
This is the technical environment your HMIS needs to connect to, it is an integration with a layered national platform that has specific standards, security requirements, and certification prerequisites for every system that touches it.
The DHA Certification Mandate: What It Is and What It Requires
DHA operates an official certification program for digital health systems in Kenya, ensuring safety, interoperability, and compliance with Ministry of Health standards for healthcare technology. The certification covers EMR systems, HIS platforms, laboratory systems, pharmacy systems, and diagnostic systems.
The certification is not optional. Under the Digital Health Act 2023 and the DH (Data Exchange) Regulations 2025, only certified solutions may connect to the national CIHIS Enterprise Service Bus. Uncertified solutions cannot legally exchange data with national health systems. For a health facility, this translates directly: if your HMIS is not DHA-certified, it cannot integrate with SHA for claims, cannot pull from national registries, and cannot participate in the emerging national Shared Health Record environment.
What DHA Certification Actually Requires
The DHA Certification Framework sets out six criteria that every HMIS vendor must demonstrate:
1. Self-Attestation Report - an internal compliance review and gap analysis against the Certification Framework, submitted on Form HMIS 4. The vendor assesses their own system against the full standard before applying.
2. ODPC Registration - the vendor must be registered with the Office of the Data Protection Commissioner as both a data controller and data processor. Kenya's Data Protection Act (Cap. 411C) makes this a legal requirement for any entity processing personal health data.
3. Data Protection Impact Assessment (DPIA) - a formal DPIA conducted under the Data Protection Act, demonstrating specific risk identification and documented mitigation measures. This must be conducted by a qualified assessor and completed before submission.
4. Security, Privacy & Confidentiality Policy - a documented, enforceable policy governing exactly how patient health data is protected within the solution.
5. Backup & Recovery Policy - documented system backup procedures, tested recovery time objectives, and verified disaster recovery protocols. The emphasis is on tested: having a backup strategy isn't sufficient; you must demonstrate it works.
6. Interoperability & Standards Compliance - conformance with national health data standards and demonstrated capability to interface with CIHIS via the Enterprise Service Bus. This includes ICD-11 coding, FHIR-based data exchange, and national product catalogue code alignment.
The Five-Step Certification Process
Applications are submitted at certification.dha.go.ke. The process moves through five structured stages:
Step 1 - Self-Attestation: Complete the internal compliance review, conduct the gap analysis, and prepare the formal attestation report.
Step 2 - Application Submission: Submit Form HMIS 4 online with all required supporting documentation and proof of fee payment.
Step 3 - DHA Technical Review: DHA reviews all documentation and may test the solution in a certified lab environment for interoperability compliance. This is where the FHIR integration and standards conformance are actually verified against the national platform.
Step 4 - Outcome Notification: DHA notifies the vendor within 30 days of completing their review. If a vendor disagrees with the outcome, they can appeal to the DHA Complaints Committee.
Step 5 - Certificate Issued: Certified systems are listed on the DHA public registry and can connect to the national CIHIS. Certifications are subject to periodic renewal.
What the DHA Ecosystem Means for Your Patient Data
Beyond the compliance and claims angle, it is worth understanding what DHA's national infrastructure is designed to do for patient care - because that is ultimately why this transition is happening.
The Patient Portal - Afya Yangu - is a secure, intuitive platform designed to empower Kenyan citizens by placing them at the heart of the healthcare ecosystem. It enables self-registration and agent-based registration with biometric integration, appointment scheduling, bill payments and prescription management, a consent management system for data control, and SHA integration for insurance claims and pre-authorization.
This means a patient who has visited your facility can, through Afya Yangu, see their health record, manage their SHA insurance interactions, and - with consent - share their data with another facility they visit. When your HMIS is integrated into the national HIE, your facility becomes part of this ecosystem. A patient presenting to your casualty with no physical history becomes traceable. A referral from your facility arrives at the receiving hospital with clinical context already in the system.
DHA's National Telemedicine Platform empowers citizens with virtual access to healthcare services, bridging geographical barriers, with high-quality audio and video for seamless consultations, and integration with the Patient Portal and HIE for real-time data access.
The Data Lake and Analytics Platform provides a powerful solution for collecting, processing, and analyzing healthcare data for actionable insights, including predictive analytics, NLP, and automated reporting. It is GDPR and HIPAA compliant with interactive dashboards.
When your HMIS sends structured, standards-compliant data into the national system, that data feeds the analytics platform - which informs national health planning, disease surveillance, resource allocation, and ultimately the funding decisions that determine what SHA pays for and what it prioritizes.
Facilities that are connected and sending quality data become visible in national health intelligence. Facilities that aren't connected are invisible, which means their patient populations and care patterns don't inform the decisions that affect their funding.
Why Certification Matters Beyond Just Claims
The DHA certification requirement isn't only about whether your HMIS can submit SHA claims. The slides from the June 2026 stakeholder engagement were explicit about a broader set of consequences:
Patient data safety: Certification ensures sensitive health data is protected under the Data Protection Act (Cap. 411C) and the Digital Health Act, reducing breach liability for your facility. An uncertified HMIS that experiences a data breach while processing patient health data exposes the facility - not just the vendor - to regulatory action.
Market access and trust: DHA's certification function establishes that certified digital health solutions are those onboarded onto the digital health superhighway. As insurers, county governments, and national procurement bodies increasingly require DHA certification as a baseline, facilities running uncertified systems will find themselves excluded from tenders, referral networks, and health scheme panels.
UHC contribution: Private sector participation in the certified ecosystem is essential to achieving Kenya's Universal Health Coverage targets across all 47 counties. The facilities that are part of the certified national system are contributing to and benefiting from the national UHC infrastructure
Where MedicentreV3 HMIS Stands on DHA Certification and SHA Integration
We want to be transparent with the facilities we serve about exactly where MedicentreV3 HMIS currently stands in this process.
MedicentreV3 is actively undergoing DHA certification. We have completed our internal compliance assessment against the Certification Framework and are engaged with the DHA technical process. This is a formal process - not a registration waitlist - and we are progressing through it systematically.
On SHA integration through AfyaConnect: the integration is done. We have completed the technical connection to SHA's national platform via the AfyaConnect API gateway. We are currently in the testing phase with the DHA technical team - running workflows, validating claims data exchange, and verifying that the integration meets the live production environment standards before go-live approval is issued.
We are sharing this because we believe facilities deserve to know where their HMIS vendor stands, not a vague assurance that things are "in progress," but a specific, honest update on where we are in the process. When certification is issued and go-live approval is granted, we will communicate that clearly and immediately to all deployed facilities.
The Bigger Picture
DHA's mission is to enhance healthcare accessibility, improve patient outcomes, and ensure data security by developing and maintaining a comprehensive digital health ecosystem across Kenya
Every facility that completes DHA certification and integrates with the national HIE becomes part of an ecosystem where patient records are portable, insurance claims are verified against clinical data, fraud is detectable, and health planning is grounded in real numbers
The deadline is 1 September 2026 for private facilities. The work to meet it starts now.
