If your NGO runs or supports a clinic, dispensary or health programme in Kenya, you have until September 30, 2026 to get a Digital Health Agency (DHA)-certified Health Management Information System (HMIS) connected to the national health data platform — or your facility risks losing the ability to bill the Social Health Authority (SHA) for patient care at all. The Social Health Insurance Fund now reaches roughly two in three Kenyans, so for a community-run clinic already stretched by the post-USAID funding squeeze, this is not a paperwork afterthought. It is a survival issue.
What Exactly Is the SHA HMIS Deadline?
SHA originally set 1 September 2026 as the cut-off for every contracted and prospective healthcare provider to have a certified HMIS meeting DHA’s technical integration standards. On 1 September, SHA Chief Executive Officer Dr Mercy Mwangangi announced a one-month extension to 30 September 2026, giving providers extra time to finish system configuration. SHA was explicit about the stakes: facilities that miss the revised deadline “will not be eligible for contracting, contract renewal, or continued participation in SHA-funded schemes during the 2026/28 contracting cycle.”
This isn’t a minor administrative tweak. SHA is actively phasing out its old Provider Portal — Level 4 facilities already shifted claims processing to the new Taifa Care HMIS on 29 June 2026 — and every facility, public or private, is expected to follow.
Why This Hits NGO-Run Clinics Harder Than Most
Large hospital chains have IT departments and budget for compliance software. A community dispensary run by a faith-based organisation or a small health NGO usually doesn’t. Many of these facilities depend on SHA reimbursements to stay financially viable at all, especially now that USAID-funded health programmes have pulled back across the sector. Losing SHA billing rights on top of an already-thin donor pipeline could force some NGO-run facilities to scale back services or close entirely — not because of a policy failure on their part, but because nobody flagged the certification requirement in time.
What Does DHA Certification Actually Require?
DHA runs certification under the Digital Health Act, 2023 and the Digital Health (Data Exchange) Regulations, 2025. Only certified systems may legally connect to Kenya’s national Comprehensive Integrated Health Information System (CIHIS). The framework sets six requirements:
- Self-Attestation Report — an internal gap analysis against the certification standard, submitted on Form HMIS 4.
- ODPC registration — registration with the Office of the Data Protection Commissioner as both a data controller and a data processor.
- Data Protection Impact Assessment (DPIA) — a formal risk assessment conducted by a qualified assessor before you apply.
- Security, Privacy & Confidentiality Policy — a written policy on how patient data is protected.
- Backup & Recovery Policy — documented, tested disaster-recovery procedures (not just a plan on paper).
- Interoperability & standards compliance — FHIR-based data exchange, ICD-11 coding, and the ability to connect to CIHIS via its Enterprise Service Bus.
How Does the Certification Process Work?
Applicants register a Business Account on the DHA Portal, then move through five steps: submit the self-attestation, upload supporting documents with proof of fee payment, undergo DHA’s technical review (which can include lab testing for interoperability), receive an outcome within 30 days, and — if approved — get listed on DHA’s public certified-systems registry. Certification is renewed periodically, not granted once and forgotten.
If your facility already uses commercial HMIS software, check directly with your vendor whether their system has completed DHA certification and SHA integration — several vendors serving Kenyan clinics were still in the final stages of this process as of September 2026, so “we use System X” is not the same as “our system is certified.” Facilities with no HMIS at all should contact DHA Technical Support directly; DHA has said it will provide systems and support to providers that don’t yet have one.
What About SHA’s New Three-Year Contracting Cycle?
Separately, SHA issued a public notice on 17 September 2026 opening a nationwide contracting exercise (Specially Permitted Procurement Procedure No. SPPP/SHA/002/2026-2027) for facilities to apply for three-year service contracts covering the Primary Healthcare Fund, the Social Health Insurance Fund, the Emergency, Chronic and Critical Illness Fund, and the Public Officers Medical Scheme Fund. This is a separate process from HMIS certification, but the two are linked: SHA will only contract facilities that are eligible, verified and compliant, and an uncertified HMIS will count against you at the verification stage.
| Requirement | Key detail |
|---|---|
| HMIS compliance deadline | 30 September 2026 (extended from 1 September) |
| Consequence of missing it | No contracting, renewal, or participation in SHA schemes for 2026/28 cycle |
| Certification body | Digital Health Agency (DHA), under the Digital Health Act, 2023 |
| New contracting exercise | Opened 17 September 2026, SPPP/SHA/002/2026-2027, three-year contracts |
| Documents needed for contracting | Registration certificate, operating licence, county permits, KRA tax compliance certificate, SHA compliance certificate |
| Help available | DHA Technical Support (system configuration); SHA county offices (manual contracting where e-systems are unavailable) |
What Should Your NGO Do Before September 30?
- Confirm, in writing, whether your current HMIS vendor holds DHA certification — don’t assume.
- If you have no HMIS, contact DHA Technical Support this week; certification review alone can take up to 30 days, and the clock is already tight.
- Check your organisation’s ODPC registration status as both data controller and processor — this is a prerequisite most small NGOs overlook.
- Gather your compliance documents now (registration certificate, operating licence, KRA tax compliance certificate, SHA compliance certificate) so you’re ready to apply under the new three-year contracting cycle.
- If your facility is part of a larger network (a diocese, a county partnership, an umbrella NGO), ask whether compliance can be coordinated centrally rather than duplicated facility by facility.
Frequently Asked Questions
What happens if my NGO’s clinic misses the September 30 deadline?
SHA has said non-compliant facilities won’t be eligible for new contracts, contract renewals, or continued participation in SHA-funded schemes for the 2026/28 cycle — in practice, you would not be able to bill SHA for patient care until you become compliant.
Does every NGO health facility need its own DHA certification?
The certification applies to the HMIS system itself, not each individual facility. If several of your facilities share one HMIS platform and that platform is DHA-certified, all connected facilities benefit — but you should confirm this directly with DHA or your vendor rather than assume it.
What if we can’t afford commercial HMIS software?
DHA has stated it will provide the necessary systems and support to healthcare providers that don’t currently have an HMIS. Contact DHA Technical Support to find out what’s available before assuming certification is out of reach.
Is this the same thing as registering for SHA’s new three-year contracts?
No. HMIS/DHA certification is a technical and data-compliance requirement. The three-year contracting cycle announced on 17 September 2026 is a separate procurement process for becoming (or remaining) an SHA-contracted provider. You need to satisfy both.
Where can NGO clinics get help if they’re behind on this?
DHA’s Technical Support team is the first point of contact for system-configuration issues. For contracting questions, SHA said it may process applications manually through county offices where its electronic contracting platform isn’t accessible.
By the NGOs.ke Editorial Team.
For more on how Kenya’s NGOs are navigating regulatory change this year, see our guides on PBO deregistration in Kenya, our coverage of community health workers, and our guide to mental health NGOs in Kenya. For the official compliance framework, see the Social Health Authority’s official website.
Leave your comment