Kenya: How Private Insurers and Hospitals Can Exchange Claims and Pre-Authorization Data Through an API in 2027

You work with health insurance in Kenya, and the rules keep moving. The Social Health Authority (SHA) replaced the National Hospital Insurance Fund (NHIF), and new rules cover health data and claims systems. Section 54 of the Social Health Insurance Act, 2023 repeals the National Health Insurance Fund Act, 1998. Before an insurer and a hospital link their claim data, read what Kenya's own texts say. This guide does that, then outlines the ClinikEHR API (api.clinikehr.com) in general terms. ClinikAPI (clinikapi.com) is a separate product built around FHIR R4, a health-data standard. ClinikEHR is not an SHA integration.

Quick Answer

Read Kenya's own texts before an insurer or HMO and a hospital exchange claim data, because choosing an API settles none of them.

• The Social Health Insurance Act, 2023 created the Social Health Authority. Its Claims Management Office reviews claims and issues pre-authorizations, and the Act says all processes and services under it are to continue to be digitized through an information system.
• A law firm and the press have reported court challenges to the Acts. This guide read no judgment.
• The Data Protection Act, 2019 treats health data as sensitive and requires ODPC registration unless an exemption applies. A 2021 regulation sets a Kenya data center rule for some health care processing.
• Kenya's 2025 digital health regulations say a provider may not use an uncertified digital health solution, and that the Digital Health Agency certifies insurers' claims systems.
• An insurer or HMO can apply for the ClinikEHR API, and a hospital chooses to link it. Both sides need Enterprise, as the API section explains. This guide makes no claim about ClinikEHR in Kenya.

What Is the Social Health Authority, in Plain Words

The Social Health Authority (SHA) is the public body that manages Kenya's social health insurance. It contracts health facilities and pays them from three funds. Eight other terms recur below:

• Claim: the bill a hospital sends a payer for the payer's share.
• Pre-authorization: a payer's approval before treatment. Its code is the PA code.
• HMO: a health maintenance organization, which pays part of a member's bill.
• Enrollee: a person an insurer or HMO covers.
• ODPC: the Office of the Data Protection Commissioner, where data controllers and data processors register.
• Data controller and data processor: a controller decides why personal data is used. A processor handles it for someone else.
• Digital Health Agency: the body the Digital Health Act, 2023 set up.
• Digital health solution: a term from the 2025 procedures regulations. It includes digital health applications, digital health technology infrastructure such as telehealth systems, and electronic health information systems (regulation 2, Digital Health Agency, 2025).

This guide is general information, not legal advice. Ask a Kenyan lawyer about your own case.

What This Guide Could Read, and What It Could Not

Facts here were read on 14 and 15 October 2026. Where a point is unsettled, or belongs with a lawyer, this guide says so and does not choose.

What the Social Health Insurance Act, 2023 Changed

What the Act created

The Social Health Insurance Act, 2023 (No. 16 of 2023) creates the Social Health Authority. It was assented to on 19 October 2023 and commenced on 22 November 2023 (Government of Kenya, 2023).

The Authority registers beneficiaries, manages the Funds, and contracts and pays health care providers and facilities (section 5). Every Kenyan must register as a member of the Social Health Insurance Fund (section 26(1)). The Act repealed the National Health Insurance Fund Act, 1998 (section 54).

The Ministry of Health announced that the Authority would launch on 1 October 2024 and replace the National Hospital Insurance Fund, or NHIF (Ministry of Health, 2024). The Authority's own report counts its first 17 months of implementation from October 2024 (Social Health Authority, 2026).

The three Funds

The Act creates three Funds (Government of Kenya, 2023):

• The Primary Healthcare Fund buys primary healthcare services from health facilities (section 20).
• The Social Health Insurance Fund receives contributions, public money for indigent and vulnerable persons, and gifts and donations (section 25).
• The Emergency, Chronic and Critical Illness Fund pays for emergency treatment, and for chronic illness once the social health insurance cover is used up (section 28).

How the Authority handles claims

The Act sets up a Claims Management Office inside the Authority (Government of Kenya, 2023). It reviews, processes and validates claims from providers, appraises them against the benefit package, issues pre-authorizations and develops an e-claims management system (section 35). The Authority pays a contracted provider once the Office submits a claim (section 36(1)).

The Office may delegate claims review and appraisal to a suitable entity. That entity must be a medical insurance provider and a claim settling agent, as defined and licensed by the Insurance Regulatory Authority (IRA) (section 35(3) and (4)). This is the Authority delegating its own work. It is not an open channel for any insurer, and the sources read name no insurer or agent as contracted.

Section 47 says all processes and services under the Act, including notification and preauthorization, claims management and settlement of claims, are to continue to be digitized through an information system. That digitization must conform to the Data Protection Act. So SHA claims and pre-authorizations sit with the Authority's own Claims Management Office, which may delegate review and appraisal as described above.

What Has Been Reported About the Court Challenges

No judgment text could be read for this guide. Everything below was reported by a law firm or the press. Re-check the court record before you rely on any of it.

• 12 July 2024. Anjarwalla and Khanna, a law firm, reported (via Legal500, 2025) that a three-judge High Court bench found three Acts were enacted without sufficient public participation. They are the Social Health Insurance Act, the Digital Health Act and the Primary Health Care Act. Parliament was directed to amend the provisions it found unconstitutional, and to hold public participation, within 120 days. Otherwise the Acts would cease to have effect.
• 20 September 2024. The same report says the Court of Appeal stayed that judgment pending the appeal, so the three Acts stayed operational at the time of that report.
• 19 March 2026. The Star, 2026 reported that the High Court affirmed that sections 20, 25 and 28, which create the three Funds, are constitutional. It found the 1 October 2024 rollout unreasonable and gave the Ministry 90 days to align the system with constitutional requirements and to file an affidavit. Kenyans.co.ke, 2026 reported that the court declined to suspend the rollout.
• 7 May 2026. Capital FM, 2026 reported a new petition at the High Court in Kiambu. Among other things, it seeks a declaration that the Authority and other public bodies cannot carry out insurance, underwriting or claims settlement unless the law expressly authorizes it.

Three points are unsettled. No report of a final decision on the Court of Appeal appeal was found. It was not found whether the Ministry filed the March 2026 affidavit, or how the May 2026 petition ended. The safe summary is that the Authority has operated since 1 October 2024 and the Acts have faced court challenges.

Where Private Insurers Sit Beside the Authority

Section 35 lets the Claims Management Office delegate claims review and appraisal to a licensed medical insurance provider and claim settling agent, as described above. The Kenya Times reported on 18 August 2025 that private insurers will extend cover beyond the Authority's basic package and share the cost of managing chronic illnesses. It also reported that insurers will be linked to the Authority's digital claims system (The Kenya Times, 2025). MEIR reported on 21 August 2025 that the Health Ministry and the insurance industry agreed that insurers may offer plans beyond the Authority's cover (MEIR, 2025).

That link describes a plan. No source read shows that it exists, and ClinikEHR has no such link.

What the Data Protection Act, 2019 Says About Claims Data

Health data is sensitive personal data

The Data Protection Act, 2019 (No. 24 of 2019) commenced on 25 November 2019. It defines health data as data related to a person's physical or mental health. That includes health records, data collected when registering for or providing health services, and data that ties a person to specific health services. The Act lists health status among sensitive personal data (ODPC, 2019).

Who may process health data

Section 46(1) deals with personal data relating to a person's health. That data:

may only be processed — (a) by or under the responsibility of a health care provider; or (b) by a person subject to the obligation of professional secrecy under any law

ODPC, 2019, section 46(1)

Section 46(2) says the condition in subsection (1) is met in two cases. One is processing that is necessary for reasons of public interest in the area of public health. The other is processing carried out by another person who in the circumstances owes a duty of confidentiality under any law (ODPC, 2019).

How section 46 applies to a private insurer or a software provider is not settled by the sources read. This guide sets out the text and does not apply it. Ask a Kenyan lawyer.

Registration with the ODPC

Section 18(1) of the Data Protection Act says no one may act as a data controller or data processor unless registered with the Data Commissioner (ODPC, 2019). The 2021 registration regulations exempt an organization with annual turnover or revenue below five million shillings and fewer than ten employees (regulation 13(2)). The exemption does not apply to processing for the purposes in the regulations' Third Schedule, a list attached to them (regulation 13(4)). Item 5 of that list is health administration and provision of patient care. The list has 12 purposes and does not name insurance (ODPC, 2021).

The ODPC's FAQs page lists purposes that stay non-exempt whatever the size, and its list includes insurance administration and undertakings. That list is longer than the Regulations' schedule, so read each as its own document. The FAQs also say a controller or processor outside Kenya must register if it processes the personal data of people resident in Kenya. A certificate lasts 24 months (ODPC, 2026).

The ODPC's guidance on insurers

The ODPC's December 2023 guidance note covers health insurance providers. It says an insurer should collect only the personal data needed to decide eligibility for cover and to process claims, and use it only for insurance purposes. The note also restates section 46(1) (ODPC, 2023). It is the regulator's guidance, not the text of the Act; ask a Kenyan lawyer what weight it carries.

Transfers, and processing in Kenya

Section 48 sets conditions for sending personal data to another country, including proof to the Data Commissioner of appropriate safeguards. Section 49(1) allows processing of sensitive personal data outside Kenya only with the person's consent and confirmation of appropriate safeguards. Section 50 lets the Cabinet Secretary require some processing to go through a server or data center in Kenya. The grounds are strategic state interest or protection of revenue (ODPC, 2019).

Regulation 26 of the 2021 General Regulations uses that power:

(a) process such personal data through a server and data centre located in Kenya; or (b) store at least one serving copy of the concerned personal data in a data centre located in Kenya

ODPC, 2021, regulation 26(1)

It applies to processing for the purposes in regulation 26(2). Item (f) is the provision of primary or secondary health care for a data subject in the country. The rule binds a data controller or data processor, not only a provider. Whether an insurer's or a claims platform's work counts under item (f) is not settled by the sources read. Take legal advice on what regulation 26 means for you.

The Digital Health Act has a related rule. Section 47 says personal health information may only be shared with any person outside Kenya for the purposes of health tourism. The Act defines health tourism as a patient traveling across international borders to receive medical treatment (Government of Kenya, 2023). How section 47 sits beside sections 48 and 49 of the Data Protection Act is not settled by the sources read.

What Kenya's Digital Health Rules Say About Claims Systems

The Digital Health Act, 2023

The Digital Health Act, 2023 (No. 15 of 2023) commenced on 2 November 2023. It sets up the Digital Health Agency and a comprehensive integrated health information system. The system's shared resources include a client registry and finance and insurance services (section 16(e)) (Government of Kenya, 2023). The Data Exchange Regulations below call the client registry the single source of reference for identifying people who seek health services (regulation 13(1), Parliament of Kenya, 2025).

The Data Exchange Regulations, 2025

The Digital Health (Data Exchange Component) Regulations, 2025 (Legal Notice No. 77) were published on 11 April 2025 (Parliament of Kenya, 2025). A health data controller already using a digital health solution was to be onboarded into the national system within six months (regulation 5(2)). By this guide's arithmetic, that period ended in October 2025. Whether it was extended or enforced was not found.

To use the national enterprise service bus (the data exchange the regulations set up), a controller applies to the Agency. The application must include proof of ODPC registration, a data protection impact assessment report and a valid certificate for the solution. Section 31 of the Data Protection Act requires a data protection impact assessment before processing that is likely to result in high risk. It assesses the risks to people's rights and freedoms (ODPC, 2019). The Agency does not onboard a controller without a certified solution (regulation 6).

Insurers are named. A health insurance provider must make sure all its clients are registered in the client registry (regulation 13(5)). Its claims management system must reference that registry to identify clients who get care (regulation 21(2)). The Agency also certifies those systems:

assess and certify the claims management systems of health insurance providers

Parliament of Kenya, 2025, regulation 21(3)(a)

The Health Information Management Procedures Regulations, 2025

The Digital Health (Health Information Management Procedures) Regulations, 2025 (Legal Notice 76 of 2025) cover providers (Digital Health Agency, 2025). A healthcare provider or health facility may not use a digital health solution to provide care unless the Agency has certified it (regulation 37(1)). A certification application includes evidence of ODPC registration, a data protection impact assessment report and a cyber security assessment report (regulation 38(3)). A certificate is valid for two years (regulation 41(1)). Health data controllers in the system must also keep audit logs for at least twenty years, and keep data encrypted while stored and while sent (regulation 12).

What this guide does and does not claim

This guide makes no claim that ClinikEHR meets any of these rules. It claims no certification, Agency approval, ODPC registration, Kenyan hosting or Kenyan customers. ClinikEHR is not an SHA integration and is not connected to the Social Health Authority or to Kenya's digital health systems.

What an Insurer or Hospital Team Can Do Before Choosing a Claims System

None of these steps is a ClinikEHR feature, and this list is not a legal checklist. The texts above decide what you must do. The steps turn them into records you can show a regulator, a lawyer or a buyer.

Step 1: List each payer and how its claims travel

Make one row per payer: the Authority, each private insurer and any other payer you bill. Note the contract, the channel the claim travels by, and who owns it at your organization.

What you need: each signed contract, including your Authority contract.

How you know it worked: every payer has a row with a named channel, taken from a document.

A mistake a team can make: assuming one process fits every payer.

Step 2: Check where you stand on ODPC registration

Registration is required unless you are exempt. Compare your turnover or revenue, headcount and purposes with the exemption rules above. Ask a Kenyan lawyer to confirm in writing, and note the end date of any certificate.

What you need: your turnover or revenue, your headcount and a list of purposes.

How you know it worked: you hold a current certificate, or a written opinion on why you are exempt.

A mistake a team can make: relying on the small-size exemption without reading the carve-out.

Step 3: Ask each claims-system vendor the same questions

These questions are for any vendor. This guide gives no answers for ClinikEHR.

What you need: the vendor's documents, not its sales pages.

How you know it worked: each question has a dated document in your file.

A mistake a team can make: accepting a promise in place of a certificate.

Step 4: Write the breach plan with the three clocks

Under section 43 of the Data Protection Act, a controller tells the Data Commissioner without delay, and within 72 hours of becoming aware of a breach. This applies where there is a real risk of harm to the person. A processor tells the controller without delay and, where reasonably practicable, within 48 hours (ODPC, 2019). A health data controller of a digital health solution also tells the Agency's chief executive within 48 hours. It then reports the fix within 72 hours of that notice (Digital Health Agency, 2025, regulation 11(2)). Write down who tells whom, and by when.

What you need: contacts for the Commissioner and the Agency, and your processor contracts.

How you know it worked: a one-page plan names a person for each clock.

A mistake a team can make: using one 72-hour clock for every notice.

How an Insurer or HMO and a Hospital Exchange Claim Data Through the ClinikEHR API

The ClinikEHR API is the API of the ClinikEHR app, and it reaches a hospital's records only through a connection the hospital approves for your organization. It sits on top of the hospital's HMO billing. It carries the claims the hospital submits, the pre-authorization requests it sends, and the enrollees and plans an insurer has agreed with it.

What the API does

• Enrollee lookup. An insurer or HMO can look up the members a hospital has recorded by insurance number. It reads the hospital's own record, so it is not a live cover check.
• Claim decisions. It can read a claim with its lines and decide it line by line. It cannot approve more than was billed, and a decision moves no money.
• Pre-authorization. It can approve a request with a PA code or deny it with a reason. A request is decided once.
• Payment advices. It can send the hospital a message saying what was paid. Hospital staff record the money themselves.

Here is an illustrative claim file. The amounts are invented, and the table is not data.

Who can use it

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data, and a ClinikEHR reviewer decides, with no stated timeline. Two Enterprise requirements form a pair. The insurer's or HMO's developer workspace is on the Enterprise contract plan, which ClinikEHR sets on request. The hospital is on the Enterprise plan, with API access switched on.

The hospital's owner sets Insurance to Outside the US under Settings, General. It is a setting, not a place. The owner then approves the connection and records a legal basis, and an owner or manager links the insurer. Hospitals cannot simply invite insurers: each needs its own workspace and approval first. Each insurer or HMO has one way of receiving claims, and the hospital chooses it once on that insurer's record. If it chooses the ClinikEHR API, a submitted claim becomes available to the linked organization. HMO billing inside ClinikEHR is separate and is available on any plan once that setting is on.

The organization accepts a data-protection addendum with Bettar Platforms, Inc. It includes a clause based on the Nigeria Data Protection Act for organizations established in Nigeria, and has no Kenya-specific terms. An insurer's duties under the Kenyan texts above stay its own.

The insurance routes have no sandbox data, so trying them needs a live key and a linked hospital. This is a private link between one hospital and one insurer or HMO. It is not a route to the Social Health Authority.

How you know it worked

• The hospital's owner has approved your connection with the insurance permissions.
• An owner or manager has linked your organization to the hospital's record of your insurer.
• Your organization's connection list shows the hospital and the permissions granted.

The route-by-route detail is in the HMO claims tutorial and the pre-authorization guide. Both are written for Nigeria and describe the same API. See also the API documentation and the insurance routes page.

Mistakes to Avoid

1. Treating a press plan as a working link. Ask for the Authority's own document first.
2. Assuming the Registration Regulations name insurers. Their Third Schedule does not. Only the ODPC's FAQ list does.
3. Treating guidance as the Act. The ODPC's health-data note shows the regulator's view. The Acts and regulations are the legal texts.
4. Treating the Act's commencement as the launch. Cite the date that matches your question.
5. Calling an enrollee lookup a cover check. It reads the hospital's own record.

Frequently Asked Questions

What is the Social Health Authority, and what did it replace?

The Social Health Authority (SHA) is the body created by the Social Health Insurance Act, 2023, which commenced on 22 November 2023. The Act repealed the National Health Insurance Fund Act, 1998. The Ministry of Health announced that the Authority would launch on 1 October 2024 and replace the NHIF. It manages three funds: the Primary Healthcare Fund, the Social Health Insurance Fund and the Emergency, Chronic and Critical Illness Fund.

Are the Social Health Authority laws still being challenged in court?

Court challenges have been reported, and this guide read no judgment. Anjarwalla and Khanna reported a July 2024 High Court ruling on three Acts. It found they were enacted without sufficient public participation. The Acts are the Social Health Insurance Act, the Digital Health Act and the Primary Health Care Act. They also reported that the Court of Appeal stayed it on 20 September 2024. The Star reported a March 2026 High Court judgment that faulted the October 2024 rollout. Capital FM reported a further petition in May 2026. No final outcome was found, so check the court record.

Do private insurers still have a role next to the Authority?

The Act lets the Authority delegate claims review and appraisal to a medical insurance provider and claim settling agent licensed by the Insurance Regulatory Authority. The Kenya Times and MEIR reported in August 2025 that the Health Ministry and insurers agreed insurers may offer plans beyond the Authority's cover. The Kenya Times also reported that insurers will be linked to the Authority's digital claims system. That is a reported plan, and this guide found no source showing that such a link exists.

Must an insurer or hospital register with the Office of the Data Protection Commissioner?

Section 18(1) of the Data Protection Act, 2019 says no one may act as a data controller or data processor unless registered with the Data Commissioner. The 2021 registration regulations exempt an organization with annual turnover or revenue below five million shillings and fewer than ten employees. The exemption does not apply to processing for the Third Schedule purposes, which include health administration and provision of patient care. Ask a Kenyan lawyer how this applies to you.

Can claims data be processed outside Kenya?

The sources set limits and leave questions open. The Data Protection Act sets conditions for transfers abroad in section 48. It requires consent and safeguards for sensitive personal data processed outside Kenya in section 49(1), and lets the Cabinet Secretary require some processing in Kenya in section 50. Regulation 26 of the 2021 General Regulations lists the provision of health care among the purposes that need processing in a Kenyan data center or a serving copy there. Whether it covers an insurer's or a claims platform's work is not settled by the sources read, so take legal advice.

What do Kenya's 2025 digital health regulations say about claims systems?

They say a healthcare provider may not use a digital health solution unless the Digital Health Agency has certified it. They also say the Agency assesses and certifies the claims management systems of health insurance providers. Those systems reference the client registry, and an insurer must have its clients registered there. The Data Exchange Regulations gave controllers already using a digital health solution six months from 11 April 2025 to be onboarded. Whether that period was extended or enforced was not found.

How can an insurer or HMO and a hospital exchange claim and pre-authorization data through the ClinikEHR API?

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data, and a ClinikEHR reviewer decides. Its developer workspace needs the Enterprise contract plan, and the hospital must be on Enterprise with API access switched on. The hospital's owner sets Insurance to Outside the US and approves the connection, and an owner or manager links the insurer. The API then lets the insurer look up the members the hospital recorded, decide claims line by line, approve or deny pre-authorizations and send payment advices. No money moves through it, and the insurance routes have no sandbox data.

Is ClinikEHR connected to the Social Health Authority?

No. ClinikEHR is not an SHA integration. It is not connected to the Authority or to Kenya's digital health systems. This guide makes no claim about ClinikEHR in Kenya, and it does not say ClinikEHR meets any rule described here. Ask any vendor for its own documents, using the questions in this guide.

Conclusion

Kenya's texts set the frame for any claims link. The Act gives the Authority its own Claims Management Office. The Data Protection Act limits how health data is processed and moved. The 2025 digital health regulations ask for certified solutions and certified insurer claims systems. Some points are unsettled, and some belong with a Kenyan lawyer.

An API can carry claim and pre-authorization data between an insurer or HMO and a hospital. It does not answer those texts for you. To ask how access to the ClinikEHR API works, contact the team. The pricing page lists the plans, including Enterprise.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)
• Building a Health-Insurance Startup for Emerging Markets: What Your Hospital Integration Must Do (2027 Developer Guide)

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.