An opinion on Kenya’s Digital Health Act 2023: where the Digital Health Agency came from, how it reaches every provider, and the risks in the drafting.

Kenya has quietly built the most ambitious health data project in the region, and most of the people it governs could not name it. If you run a hospital, a clinic, a laboratory or a chemist, or if you are registered with any health regulator in this country, the Digital Health Agency now sits between you and the things that keep you in business. Your licence. Your claims. Your ability to prove you are who you say you are.

I think the project is broadly right and I would not want to go back. I also think some of what has been written into law deserves more argument than it has had. Both of those can be true.

First, the name

Almost everyone calls it the Digital Health Authority. Search engines are full of that phrase, and it is an easy mistake to make when the Social Health Authority sits next to it in every speech.

The statute says otherwise. Section 5 of the Digital Health Act, 2023 establishes "an Agency to be known as the Digital Health Agency." Its own website carries the same name across the masthead. If you are writing to them, filing something, or citing the law, use Agency.

Where it comes from in law

The Digital Health Act, 2023 is Act No. 15 of 2023. It was assented to on 19 October 2023, commenced on 2 November 2023, and was published in the Kenya Gazette on 24 November 2023. Six sections are worth knowing by number, because they explain almost everything that has happened since.

Section 3 sets the objects: establish the Agency, build a comprehensive integrated health information system, promote safe use of technology in care, regulate the e-health data lifecycle, provide for privacy and security of health data, set standards for m-health and telemedicine, regulate e-waste, and provide for safe transfer of records in and out of the country.

Section 4 states the guiding principles, and the first of them is the sentence the whole Act turns on: health data is a strategic national asset.

Section 5 establishes the Agency as a body corporate. Section 6 lists its functions, and two of them have reshaped the sector. Section 6(b) requires it to establish registries, in consultation with other statutory authorities, to create a single source of truth for clients, health facilities, healthcare providers, and health products. Section 6(m) empowers it to certify digital health solutions.

Section 8 constitutes the Board: a non-executive chairperson appointed by the President, the Principal Secretaries for Health, the National Treasury and ICT, the Data Commissioner, one private sector representative appointed by the Cabinet Secretary, three nominees of the Council of County Governors, and the Chief Executive Officer as an ex officio member.

Sections 15 to 18 establish the comprehensive integrated health information system itself. Section 16(e) lists its shared components, and reading that list is the fastest way to understand the platforms you are being asked to log into: the national health data dictionary, client registry, facility registry, health worker registry, product catalogue, interoperability layer, logistics management information services, shared health records, and finance and insurance services.

Then two provisions that get far less attention than they deserve. Section 22 is one line long: "The Agency shall be the custodian for all health data in Kenya." Section 25 requires data in the system to be kept for a minimum of twenty years.

The part most coverage leaves out

The Act is not resting on settled ground.

On 12 July 2024, in Constitutional Petition E473 of 2023 (Aura v Cabinet Secretary, Ministry of Health), the High Court held the Digital Health Act unconstitutional alongside the Social Health Insurance Act and the Primary Health Care Act, for want of adequate public participation. The Court found the notice period too short for the public to read three Bills, process them, and contribute meaningfully, and ordered Parliament to go back and do it properly.

The Cabinet Secretary appealed. The Court of Appeal granted a stay, which is why everything described in this article is running today.

So the honest position is this. The Agency operates under a stay of a judgment that found its founding statute constitutionally defective on process. That is not the same as the Act being void, and it is not a reason to ignore your obligations. It is a reason to be careful about anyone who tells you the legal position is finished. Confirm the current status before you rely on it in a contract or a dispute.

What it is actually trying to fix

Before you can argue about the Agency, it helps to remember what it replaced.

Kenya had health data in 47 counties, in a few hundred unconnected systems, in exercise books, and in the heads of people who had worked somewhere a long time. A patient treated in Kisumu arrived in Nairobi with nothing. A licence could be verified only by whoever answered the phone at the regulator. Nobody could tell you, on any given day, what had actually been dispensed nationally against what had been prescribed.

The Agency's answer is the Kenya Digital Health Superhighway: registries that act as the single source of truth, an interoperability layer that lets systems talk to each other, and shared health records underneath it all.

Look at that right hand column, because it is the whole argument in one picture. SHA is not a separate project that happens to be digital. SHA rides on this. So does KEMSA. So do the regulators. Once you see that, the rest of the rollout stops looking like a series of unrelated circulars and starts looking like one plan being delivered in pieces.

Where it touches you, by part of the sector

Hospitals and clinics

This is the sharpest edge. SHA claims are moving off the old provider portal and onto facilities' own hospital management information systems, and those systems must be certified by the Digital Health Agency and integrated with the national exchange. Taifa Care is the system public facilities are being moved onto. Level 4 public hospitals were required to submit claims exclusively through it from the end of June 2026.

The consequence of not getting there is not a fine. It is exclusion from contracting, contract renewal, and continued participation in SHA funded schemes. For a facility whose revenue is substantially SHA, that is the business.

The deadline has moved more than once. It was reported as 1 September 2026, then 30 September 2026, then extended again into October 2026 to give facilities more time. By early October the Ministry reported 6,427 public Level 2 to 4 facilities transitioned, 38 of 518 faith based facilities, and 28 private HMIS platforms certified. Do not plan against a date you read in an article, including this one. Confirm the current deadline with SHA and the Agency directly.

Practitioners, every cadre

In August 2025 the Cabinet Secretary ended OTP based authorisation for SHA. Approvals now go through biometric identification or the Practice 360 app, which is geo-tagged and geo-fenced specifically to stop practitioners sharing codes with people who are not where they claim to be.

I want to be fair about why that exists. Code sharing was real, and it was being used to bill for care that never happened. A geo-fence is a blunt instrument, but it is a response to a genuine problem, and the people it most protects are the honest practitioners who were competing against phantom claims.

Pharmacies and pharmaceutical premises

The Pharmacy and Poisons Board has moved its regulatory services onto the same platforms. Practice360 handles registration, licensing and continuing professional development for pharmacists and pharmaceutical technologists. Facility360 handles premises licensing, inspection and compliance monitoring.

PPB has urged all licensed professionals and establishments to complete onboarding by 31 October 2026, ahead of the 2027 licensing cycle. That is the one hard, dated obligation in this whole article, and it is weeks away. Our guide to PPB product traceability sets out exactly what documents you need for both.

Laboratories, imaging and allied providers

The same certification logic reaches you through section 6(m) and the 2025 regulations. If your system holds patient data or touches a claim, the expectation is that it conforms to national standards, exchanges data through the interoperability layer, and is registered appropriately. Certification criteria published for HMIS vendors include registration with the Office of the Data Protection Commissioner as controller and processor, a data protection impact assessment, documented security and backup policies, and conformance with FHIR standards.

Community health

eCHIS is the point of care system for community health promoters, feeding the same spine from the household level through the Primary Health Care Networks. This is the part of the architecture I am most optimistic about, because community level data has historically been the thinnest and the slowest to arrive anywhere useful.

Patients

Afya Yangu is the patient facing portal: self registration, appointments, bills, prescriptions. Section 36 of the Act gives a person the right, on request, to examine and receive a copy of their own personal health information. That right is real and it is new in this form, and almost nobody knows they have it.

What I think it gets right

A verifiable register destroys a real fraud market. When a licence can be checked by anyone with a phone, the trade in borrowed credentials and photocopied certificates becomes much harder. That trade kills people. I have very little sympathy for arguments that slow this down.

Portable records are worth the trouble. The patient who arrives at a referral hospital with a plastic bag of papers and no history is a permanent feature of Kenyan medicine. Fixing that is worth a great deal of inconvenience to the rest of us.

Traceability makes falsified medicine harder to move. Section 17(h) puts tracking and tracing of health products into the objectives of the system itself, which is the legal hook under the national track and trace work the Board is doing with the Agency.

Policy gets to argue with evidence. Procurement, workforce planning and budget allocation in this country have been made on estimates for decades. Real dispensing and utilisation data changes the quality of those arguments permanently.

What worries me

Section 22 concentrates everything in one place. Making one agency the custodian of all health data in Kenya is clean on an organogram and dangerous in practice. It is a single point of failure for availability, and a single very attractive target. A breach here is not one hospital's problem. Paired with the twenty year minimum retention in section 25, the blast radius of one bad day is enormous.

Privacy responsibility sits in a political office. Section 24(1) makes the Cabinet Secretary responsible for the confidentiality, privacy and security of all sensitive personal data held in the system. Not the Agency, which runs it. Not the Data Commissioner, who is the independent regulator and sits on the Board. I would rather that duty sat with an office insulated from the political cycle, and I do not think that is a radical position.

The disclosure gateways are drafted around consent being absent. Read section 24(2) carefully. It permits disclosure of sensitive personal data to a third party where the data subject is unable to give informed consent and someone authorised gives it instead, where written law or a court order authorises it, where care is being given without consent as authorised by law, in emergencies, where failure to treat would create serious public health risk, or where delay could cause death or irreversible harm. Those are defensible exceptions. What is strange is the shape of the provision: it reads as a list of circumstances in which consent is bypassed, rather than a rule that disclosure requires consent, with narrow exceptions. Section 61 does require everyone processing personal data under the Act to comply with the Data Protection Act, which helps. But the drafting signals a posture, and the posture is not consent first.

The penalties land on the wrong people. Section 35 makes it an offence to tamper with health data, abuse a privilege, improperly dispose of sensitive data, lose data, steal data, or share sensitive personal data with an unauthorised party. The penalty is a fine of up to one million shillings or imprisonment for up to fifteen years, or both. Fifteen years. Read that list again and picture who it actually catches: a records clerk, a locum, a night nurse who loses a tablet. It does not catch the people who designed a system that made losing a tablet catastrophic. If your facility has not briefed its staff on section 35, do it this month, and make sure your device and access policies are written down.

Certification cost is not distributed fairly. A referral hospital absorbs a certified HMIS, data protection impact assessments, ODPC registration and tested backup policies as a line item. A three room clinic in a market town, a single doctor practice, a small laboratory or a single branch chemist absorbs the same obligations against a fraction of the revenue. The predictable outcome is consolidation, and consolidation in small town healthcare usually means the nearest provider gets further away.

Uptime is now a licensing and revenue risk. This is the quiet one. When your claim, your authorisation and your licence all depend on a national platform, somebody else's outage becomes your lost day. While researching this piece on 8 October 2026 I could not reach practice360.kenya-hie.health at all. But it is a useful illustration of a structural fact: the sector has taken on a dependency it does not control and cannot route around, and the fallback procedures for a long outage have not been spelled out anywhere I can find.

And the public participation finding still stands behind all of it. The High Court said the public was not properly consulted on a law that makes every Kenyan's health data a strategic national asset. That finding has been stayed, not answered.

What I would actually do

Onboard now, whoever you are. If you are a pharmacy or a pharmacist, Facility360 and Practice360 before 31 October 2026. If you run a facility that bills SHA, get your HMIS certified and integrated, and chase your vendor this week rather than next month. The deadlines keep moving, which is exactly why you should not be the one still moving when they stop.

Name a person. Not a department. One named individual who holds your registry logins, knows your certification status, and is accountable for it. The commonest failure I see is not refusal, it is that everybody assumed somebody else had done it.

Write down your paper fallback. One page. What your staff do when the platform is down: what they record, on what form, who authorises, and how it gets entered afterwards. You will need it, and the middle of an outage is a bad time to invent it.

Brief your team on section 35. Fifteen years is not a detail to leave in a statute nobody has read. Devices, passwords, what leaves the building.

Do not buy against specifications that have not been published. Where the technical detail is still unclear, scanners and third party compliance tools bought today are bought blind.

Claim your own record. Section 36 gives you the right to a copy of your own health information. Use it once, just to see how well the system you are being asked to trust actually works.

Where this leaves us

I would not undo any of this. A country that cannot tell you what medicine it dispensed last month cannot plan, cannot budget, and cannot protect anyone from a counterfeit supply chain. The Agency is solving real problems that cost real lives, and the people building it are doing something genuinely difficult.

But a system this centralised earns scrutiny rather than being exempted from it, and the scrutiny it was supposed to get at the Bill stage is exactly what the High Court found missing. The argument is not whether to digitise. That is settled and it should be. The argument is about custody, consent and who carries the risk when it goes wrong, and on current drafting the answer to that last one is you.

Get onboarded. Then start asking the harder questions, because nobody is going to ask them on your behalf.

---

Disclaimer. This article is an opinion piece. The views expressed are those of the author personally and do not represent the views, position or policy of Afiacity, its directors, its staff or its clients, nor those of the Digital Health Agency, the Pharmacy and Poisons Board, the Social Health Authority, the Ministry of Health or any other body named in it. Nothing here is legal advice. Statutory references are to the Digital Health Act, 2023 as published by Kenya Law and were current when this was written on 8 October 2026. Deadlines in this sector have changed repeatedly, so please verify every date and requirement directly with the relevant authority before acting on it. If you spot an error, tell us and we will correct it.

If you would like help working out what your facility actually needs to do before the next deadline, book a consultation.