An EHR runs your registration desk, wards, pharmacy, billing and SHA claims. The questions you ask before you sign tell you more than a sales presentation. This guide gives you the questions to put to every vendor, and the documents to ask for.

Start with DHA certification

A healthcare provider or health facility may not use a digital health solution to provide care unless the Digital Health Agency (DHA) has issued certification for it [1]. That makes certification the first filter, before price or features.

Check DHA’s public registry yourself for every vendor you consider [2]. Each entry shows the certificate number, system name, organisation, category, certification type, status, issue date and expiry date [2].

  • Is the exact product you are buying on the registry, under the vendor’s legal name?
  • Is the status active, and is the certificate full or conditional?
  • Does the expiry date fall after your intended go-live?
  • What does the vendor need from your facility for DHA’s facility go-live approval [5]?

SHA claims

SHA claims are lodged, processed and paid through SHA’s Centralised Digital Platform [3]. A facility lodges each claim within seven days of discharge, and specialised services designated by SHA need online pre-authorisation [3]. DHA’s certification process includes a SHA claims workflow validation covering eligibility, consent, interventions, pricing and submission [5].

Ask each vendor to show you, on a test patient:

  • checking a member’s eligibility at registration
  • requesting pre-authorisation and recording the decision against the visit
  • building a claim from the clinical record and bill, without retyping
  • tracking each discharge against the seven-day lodging window
  • handling a claim SHA returns for amendment, and a rejection
  • reconciling SHA payments against the claims they settle

eTIMS and M-Pesa

Billing touches tax and payments as well as SHA. Ask vendors to show the full flow, not a screenshot.

  • How does the system submit invoices to KRA’s eTIMS, and what happens when a submission fails?
  • Which M-Pesa payment flows does it support: paybill, till, customer prompts?
  • How are M-Pesa receipts matched to patient bills, and who resolves unmatched payments?
  • How do cash, card, M-Pesa, insurance and SHA balances appear on a single patient bill?

Working when the connection drops

The SHA regulations require contracted facilities to keep computers and phones with a working internet connection available, so staff can verify beneficiaries [3]. Connections still fail.

  • Which functions keep working offline: registration, triage, clinical notes, dispensing, billing?
  • How does offline work sync once the connection returns, and how are conflicts resolved?
  • What does staff see when an online-only step, such as an eligibility check, cannot run?

Data ownership, location and export

Health data is yours, and patients have rights over it. A data subject has the right to receive their personal data in a structured, commonly used and machine-readable format, and to have it moved to another controller where technically possible [4].

  • Does the contract state that your hospital owns its data?
  • Can you export complete records, including clinical notes, results, bills and audit logs, in a documented, machine-readable format, at any time and without a fee?
  • Where are the servers and backups, and can the vendor show evidence?
  • What happens to your data, and in what format do you receive it, if the contract ends?

Data protection and security

Where a hospital uses a vendor to process data, the Data Protection Act requires a written contract binding the processor to act only on the hospital’s instructions [4]. The DHA regulations set out security measures including multi-factor authentication, role-based access on least privilege, and tamper-proof audit trails of user actions [1].

  • Ask for a draft data processing agreement before you negotiate price.
  • Ask to see role set-up, multi-factor sign-in and the audit log for one patient record.
  • Ask how the vendor notifies you of a breach. A data processor notifies the controller without delay and, where reasonably practicable, within forty-eight hours [4]. Your hospital then reports to the Data Commissioner within seventy-two hours [4], and a health data controller reports to DHA within forty-eight hours [1].
  • Ask for the vendor’s back-up and recovery policy, and when it last tested a restore.

Implementation and training

Ask how the vendor takes your hospital from contract to go-live.

  • Who migrates your existing patient records, and how do you check the result?
  • How long does set-up take, and what does your team need to do at each stage?
  • Who trains clinicians, nurses, pharmacy, billing and records staff, and in what format?
  • What support is available at night and on weekends, and how do you reach it?
  • Who configures SHA, eTIMS and M-Pesa, and who tests them before go-live?

Ask for evidence

For each answer, ask for a document or a live demonstration. Keep a written record of each vendor’s responses, so you compare them on the same terms.

Evaluate TibaIQ the same way

Put these questions to TibaIQ as well, and ask us for our DHA certification position during your evaluation. You can request a demo.

Sources

  1. Digital Health (Health Information Management Procedures) Regulations, 2025 (Legal Notice 76 of 2025), Kenya Law
  2. Public registry of digital health systems, Digital Health Agency
  3. Social Health Insurance Regulations, 2024 (Legal Notice 49 of 2024), Kenya Law
  4. Data Protection Act, 2019 (No. 24 of 2019), Kenya Law
  5. DHA Certification Programme for Digital Health Systems, Digital Health Agency

This guide summarises public sources for general information. It is not legal advice; check the current text of each source before acting on it.