A Social Health Authority (SHA) claim depends on steps a hospital controls: a signed contract, a pre-authorisation where one is needed, a claim lodged on time and a claim that matches the patient record. This checklist sets out what the law and SHA’s published guidance require, in the order a claim moves through a private hospital.

It is a summary, not legal advice. The regulations have been amended more than once, so check the current consolidated text on Kenya Law before you rely on any time limit.

Before the first claim: empanelment and contracting

SHA pays healthcare providers and facilities that are empanelled and contracted under the Act [1]. Empanelment starts with the body responsible for accreditation for quality of care, which submits its list of licensed providers to SHA [1][2]. Once that list appears on the SHA website and in the Kenya Gazette, SHA may contract the listed facilities within thirty days [1][3].

Contracting happens on SHA’s e-contracting portal, where the facility signs the contract electronically in the signatory and witness sections [3]. A contracted facility is then onboarded onto SHA’s Centralised Digital Platform [2]. SHA has announced a contracting cycle running from 1 October 2026 to 30 June 2029 [4].

  • Confirm your facility appears on the published empanelment list.
  • Sign and fully execute the contract on the e-contracting portal [3].
  • Hold the public liability, professional liability and equipment insurance cover the regulations require for the contract period [2].

Every day at the front desk

The regulations set out duties a contracted facility owes on every visit, several of them operational [2]:

  • Keep computers and mobile phones with a working internet connection available at all times, so staff can verify beneficiaries and their account status on the Centralised Digital Platform [2].
  • Use and verify the beneficiary data SHA provides [2].
  • Deliver services according to the benefits package that applies to the patient, and within its limits [2].
  • Tell the patient and SHA when a patient is close to a financial limit. Do not withhold accident and emergency treatment for financial reasons [2].
  • Maintain an adequate system for collecting, storing and retrieving beneficiaries’ records, and keep those records in a readily accessible format [2].

Pre-authorisation for specialised services

For specialised services that SHA designates, the facility sends an online pre-authorisation request with the beneficiary’s details, the facility’s details and the service required [2]. SHA’s Claims Management Office decides immediately, and no later than seventy-two hours after receipt. Pre-authorisation does not apply to emergency services [2].

  • Keep SHA’s current list of services that need pre-authorisation where clinicians and billing staff can see it.
  • Record the pre-authorisation decision against the patient’s visit before the service is billed.

Lodging the claim

All claims are lodged, reviewed, processed and paid through the Centralised Digital Platform [2]. The facility lodges each claim within seven days of the patient’s discharge [2]. The claim includes, among other information, the patient’s SHA number, the hospital registration number, the patient’s name, date of birth, gender, address and contact details, the clinical details and the amount claimed [2].

  • Close the clinical record and the bill together at discharge, so the claim draws on the same data.
  • Track every discharge against the seven-day window.
  • Check that the services claimed fall within the benefits package and your facility’s contracted scope.

After submission

When the Claims Management Office reviews a claim, three outcomes are possible [2]:

  • Approved. The claim goes to SHA for payment within ninety days of approval.
  • Incomplete or containing errors. The claim returns to the facility with reasons, for amendment.
  • Rejected. SHA notifies the facility, with reasons, no later than fourteen days after the rejection.

If SHA pays the wrong amount on a claim, the facility may request an adjustment [2]. SHA may also refer pre-authorisation requests and claims to an independent, anonymised panel. A claim the panel finds non-compliant goes unpaid, or the facility refunds it if SHA has already paid. A facility may ask for a review, with new evidence, within seven working days [2].

What SHA does not pay

The regulations list claims that SHA’s funds do not cover [2]. They include claims from a revoked or suspended provider, unauthorised referrals, services outside the benefits package, costs beyond a beneficiary’s annual limits, and interest on delayed reimbursement.

Billing conduct that ends contracts

SHA may terminate a contract where a facility bills for a service the beneficiary does not need, bills outside its level of care or professional scope, bills for services or medicine not provided, falsifies information to defraud SHA, or submits separate claims for the same service [2]. Under the Act, a provider that knowingly falsifies information to defraud SHA faces a fine of up to two million shillings, suspension, or removal from the register of empanelled and contracted providers [1].

  • Reconcile what was dispensed and done with what was billed.
  • Block duplicate claims for the same service.
  • Keep an audit trail of who changed a clinical or billing record, and when.

Your hospital system

The Act requires SHA’s processes, from member identification and pre-authorisation to claims management and settlement, to run through an information system [1]. The Digital Health (Health Information Management Procedures) Regulations, 2025 also bar a healthcare provider or health facility from using a digital health solution to provide care unless it holds Digital Health Agency (DHA) certification [5]. SHA set a deadline for providers to comply with its HMIS requirements and, in a notice dated 1 September 2026, extended it to 30 September 2026 [6]. Check sha.go.ke for the current position.

DHA’s certification process includes a SHA claims workflow validation: the system is tested end to end on member eligibility, patient consent, the interventions given, pricing and claim submission [7].

  • Check that your system appears on DHA’s public registry, with an active certificate.
  • Ask your vendor how the system handles pre-authorisation, the seven-day lodging window and returned claims.

See it in practice

To see how TibaIQ handles the SHA steps in this checklist, request a demo.

Sources

  1. Social Health Insurance Act, 2023 (No. 16 of 2023), Kenya Law
  2. Social Health Insurance Regulations, 2024 (Legal Notice 49 of 2024), Kenya Law
  3. Onboarding Facilities, Social Health Authority
  4. Notice on New Contracting Cycle, Social Health Authority
  5. Digital Health (Health Information Management Procedures) Regulations, 2025 (Legal Notice 76 of 2025), Kenya Law
  6. Notice to Healthcare Providers: Extension of HMIS Compliance Period, Social Health Authority
  7. DHA Certification Programme for Digital Health Systems, Digital Health Agency

This guide summarises public sources for general information. It is not legal advice; check the current text of each source before acting on it.