If your hospital runs patient care on software, that software now needs Digital Health Agency (DHA) certification. This article explains where the requirement comes from, how DHA assesses a system, and what a hospital should check before it signs with a vendor.

Where the requirement comes from

The Digital Health Act, 2023 established the Digital Health Agency and gave it the function of certifying digital health solutions against recognised practices and standards [1]. The Digital Health (Health Information Management Procedures) Regulations, 2025 put that function into practice. Under them, a healthcare provider or health facility may not use a digital health solution to provide healthcare services unless DHA has issued certification for it [2]. DHA certifies solutions according to its Certification Framework [2][3].

SHA has also set HMIS requirements for healthcare providers. In a notice dated 1 September 2026, SHA extended its deadline for compliance with HMIS requirements to 30 September 2026 [6]. Check sha.go.ke for the current position.

What “HMIS” covers

DHA’s registry groups systems into categories. They include Health Management Information System (HMIS), Electronic Health Record (EHR), Electronic Medical Record (EMR), Pharmacy Information Management System, Mobile Health Application, and a countrywide Health Insurance Platform [5]. A hospital-wide system usually sits under HMIS, but check the category a vendor’s certificate actually names.

Who applies, and with what

The vendor applies, not the hospital. A digital health solution provider first completes a self-attestation, then applies to DHA on Form HMIS 4 [2]. The application includes [2]:

  • the self-attestation report and certificates of incorporation
  • particulars of the health data controller
  • a system manual and requirements specification
  • evidence of registration with the Office of the Data Protection Commissioner as a data controller and data processor
  • a Data Protection Impact Assessment report
  • the vendor’s security, privacy and confidentiality policy
  • proof of payment of the certification fees
  • a back-up and recovery policy
  • a cyber security assessment report

What DHA assesses

DHA considers four things [2][3]:

  • Functionality, including system and data quality.
  • Reporting and alerts required by health sector policies and guidelines.
  • Information security, privacy and confidentiality.
  • Information exchange and interoperability with national systems.

DHA’s certification portal sets out the stages a vendor moves through [4]:

  1. Self-attestation, then the application fee and submission.
  2. Evidence upload, followed by DHA document review.
  3. Registration of the API endpoints the laboratory tests.
  4. Conformance testing by an independent accredited laboratory, with test cases generated from the vendor’s own attestation.
  5. Health information exchange validation: finding the right patient, facility and practitioner in the national registries, using national terminology, and writing to and reading back from the shared health record.
  6. SHA claims workflow validation, end to end: member eligibility, patient consent, the interventions given, pricing and claim submission.
  7. A decision: full certification, conditional certification, re-testing or rejection.

DHA notifies the vendor of the testing results, and the vendor may take corrective action on any non-compliance it identifies [2]. A vendor may ask DHA to review a decision. DHA considers the review within fourteen days, and a vendor still aggrieved may go to the High Court [2].

How long a certificate lasts

A certificate of compliance is valid for two years from issue, after which the vendor applies for re-certification [2]. DHA’s portal states that conditional certification runs for one year [4].

Certification carries ongoing duties. The vendor keeps the system updated, documents change logs and notifies DHA of changes affecting security, functionality, reporting or interoperability, which triggers a fresh audit [2]. DHA runs annual audits and may carry out ad hoc audits, including site visits [2]. Vendors and health data controllers have six months to comply with a change in the national digital health standards [2].

DHA revokes certification where the conditions on the certificate are breached, where a major security breach of health data occurs, or where a breach goes unreported to DHA [2].

Certification is not go-live

DHA’s portal separates certification of a system from approval to use it at a particular facility. Go-live approval is granted per facility, and only after the facility acknowledges the deployment, SHA acknowledges it and production credentials are issued [4]. Ask your vendor where your own facility stands in that sequence, not only whether the product holds a certificate.

Duties that stay with the hospital

Certification covers the vendor’s system. Your hospital, as a health data controller, still carries its own obligations under the same regulations [2]:

  • Notify DHA within seven days of registering with the Office of the Data Protection Commissioner.
  • Report a health data breach to DHA’s Chief Executive Officer within forty-eight hours of becoming aware of it, and report corrective measures within seventy-two hours of that notification.
  • Keep a record of the data processors you engage, with role-based access.
  • Log and review user activity, apply least-privilege access and use multi-factor authentication.

How to check a vendor on the registry

DHA keeps a public registry of systems that hold a certificate [3][5]. Each entry shows the certificate number, system name, organisation, category, certification type, status, issue date and expiry date [5]. The portal also lets anyone verify a certificate [4].

  • Search the registry for the exact product name the vendor is selling you.
  • Confirm the organisation on the entry is the company you are contracting with.
  • Check that the status is active and the expiry date falls after your intended go-live date.
  • Note the certification type: full or conditional.
  • Check the category matches how you plan to use the system.
  • Treat a vendor’s own badge or slide as a claim to verify, not as evidence.

Do this for every vendor on your shortlist, including any you already use.

Checking TibaIQ

Check the public registry for every vendor you evaluate, TibaIQ included, and ask us for our certification position during your evaluation. You can request a demo.

Sources

  1. Digital Health Act, 2023 (No. 15 of 2023), Kenya Law
  2. Digital Health (Health Information Management Procedures) Regulations, 2025 (Legal Notice 76 of 2025), Kenya Law
  3. Kenya Digital Health Certification Framework, Digital Health Agency
  4. DHA Certification Programme for Digital Health Systems, Digital Health Agency
  5. Public registry of digital health systems, Digital Health Agency
  6. Notice to Healthcare Providers: Extension of HMIS Compliance Period, Social Health Authority

This guide summarises public sources for general information. It is not legal advice; check the current text of each source before acting on it.