The Digital Health Agency is linking health systems so records can follow patients. What the Digital Health Act requires, where the real preparation sits, and how to get your data ready.
Anyone who has worked in a busy hospital will recognise the scene. A patient is referred from one facility to another and arrives carrying a bundle of paper: old results, a discharge note, a prescription, a scan report. The receiving team pieces the story together as best it can, and anything missing from the bundle is simply unknown. As one industry leader put it recently, without integration a patient has to carry large amounts of paper to prove what has happened to them (Capital FM).
Kenya is working to change that. The Digital Health Agency, established under the Digital Health Act, is linking health information systems across the country so that patient records can be shared between facilities and move with the patient rather than in their hands. Historical records, including paper files, are expected to be migrated into electronic systems, and those involved have been candid that some data could be lost in the process (Capital FM, 15 September 2026).
This guide explains what the Act requires, what certification does and does not cover, and where we expect organisations to find the work hardest. That last part draws on our experience at Jonda Health, where our work is turning health records from many different sources into structured, standardised information that clinicians and systems can actually use.
The Digital Health Act, 2023 was signed in October 2023 alongside the Primary Health Care Act, the Facility Improvement Financing Act and the Social Health Insurance Act, as part of Kenya's plans for universal health coverage (KICTANet). It is one of the first Kenyan laws to treat health data as an asset to be governed, rather than a by-product of care.
The Act makes the Digital Health Agency the custodian of health data in Kenya. Among its functions, the Agency sets standards for the integration, interoperability and exchange of health data, keeps a national health data dictionary up to date, sets standards for and conducts routine data quality checks, and requires health data controllers and processors to report designated health data in approved formats (Digital Health Act, Kenya Law).
A High Court decision had declared aspects of the Act unconstitutional, but the Court of Appeal stayed that decision, so the Act continues to operate while the appeal is determined. The Agency is working toward the Comprehensive Integrated Health Information System, which brings together government, healthcare providers and financial services. To join it, organisations are expected to format their records so that coding and terminology are consistent across their own platforms and the Agency's (Clyde & Co, March 2026).
A few further obligations are worth noting. Health data controllers must retain health data for at least 20 years. Breaches must be reported to the Agency within 48 hours, with details of corrective measures to follow within 72 hours, alongside notification to the Data Protection Commissioner. Records are also expected to be transferred to national and county health data banks within timelines set in the regulations. There is also some uncertainty about how the Act's provisions on cross-border transfers of health information will be interpreted, so organisations using systems or services hosted outside Kenya should take local advice (Clyde & Co).
The Agency's certification programme, the Digital Health Certification for Safer Healthcare, evaluates digital health solutions against set criteria and rates them on a scale from compliant to future ready (Clyde & Co). Draft regulations describe a process of self-attestation, document review, testing, certification, and then re-certification and audit, including a check of each solution's capacity to exchange information under the national interoperability framework.
Certification is an important safeguard, and it will help protect patient information. It is worth being clear, though, about what it is designed to test. It assesses whether a system can store, secure and exchange data correctly. It does not, on its own, make the years of records already inside that system consistent, complete or coded to the national standards. A certified system can still carry inconsistent test names, missing values, and results that were typed in by hand.
Kenya's data protection regime is moving from policy to enforcement. The Office of the Data Protection Commissioner has reported handling over 9,000 complaints and issuing 184 compensation orders, alongside administrative fines, enforcement notices and mandatory corrective action plans. Regulators now expect demonstrable operational alignment, documented governance and board-level accountability for health data compliance (Clyde & Co).
For organisations handling health data, that means good intentions are no longer enough. Knowing what data you hold, where it sits and how it flows has become a practical requirement, not only a good habit.
Much of the discussion around Kenya's digital health reforms focuses on systems and infrastructure. Both matter. In our experience, though, the part organisations most often underestimate is the condition of the data those systems will carry.
In the records we work with across Asia and Africa, the same patterns appear again and again. Laboratory tests are named in several different ways across facilities, with different units and reference ranges. Results arrive as PDFs, scanned pages or photographs of printed reports. Medications are recorded under brand names, generic names and local codes. Diagnoses are often free text. Many institutions maintain their own internal code sets, which need careful mapping rather than a one-size-fits-all conversion. And a large share of history sits on paper, where migration is most likely to lose detail. None of this reflects poor practice; it is simply how clinical data is created in busy settings, across systems that were never designed to speak to each other.
AI can do a great deal of this work at speed, and we use it extensively ourselves. The lesson we have learned is that speed alone is not enough in a regulated setting. Without clinical review and quality checks, errors pass silently into systems other clinicians will rely on, and a national exchange is only as trustworthy as what goes into it. That is why we argue that healthcare AI will not work without trusted data infrastructure.
At Jonda Health, we have spent years working through this problem across languages, formats and health systems, and we know how much of it only becomes visible once the work begins. Depending on where your organisation is today, there are three ways we can help.
The Digital Health Act, 2023 sets the legal framework for how digital health systems are deployed, governed and used in Kenya. It established the Digital Health Agency, which coordinates digital health systems, sets standards for interoperability and data exchange, and acts as custodian of health data.
Yes. A High Court decision had declared aspects of the Act unconstitutional, but the Court of Appeal stayed that decision, allowing the Act to operate while the appeal is determined.
Certification assesses digital health solutions against set criteria, including security and the capacity to exchange information. Organisations still need the records inside those systems to be consistent, complete and coded to the required standards.
Health data controllers are required to retain health data for at least 20 years.
The Digital Health Agency must be notified within 48 hours of becoming aware of a breach, with details of corrective measures within 72 hours of that notification. The Data Protection Commissioner must also be notified within 72 hours under the Data Protection Act.
Sources: Digital Health Act, 2023 (Kenya Law); Clyde & Co, Health Data Protection in Kenya (17 March 2026); Capital FM, Digital Health Agency Pushes Interoperability Across Kenya (15 September 2026); KICTANet; Ministry of Health, draft Digital Health (Use of e-Health Applications and Technologies) Regulations, 2024. This article is for general information and is not legal advice.
Suhina Singh is a physician, the Founder and CEO of Jonda Health, and a health data strategist working at the intersection of artificial intelligence and clinical information systems.
