DHA reporting requirements in Kenya: what to ask a vendor to show

The short answer

The Digital Health Agency's current certification framework treats reporting and public health alerts as one of four assessment domains. It names notifiable diseases, IDSR weekly reporting, public health events and routine returns as the reporting scope.

For a facility, the useful test is not whether a vendor can name the reports. Ask to see one complete reporting journey: the source record, the generated return, the review and correction step, the hand-off or export, and the evidence that the activity was recorded. If the demonstration stops at a dashboard, you have not seen the reporting workflow.

What the published framework says

The DHA certification framework lists four domains: functionality, security, privacy and confidentiality, reporting and public health alerts, and information exchange and interoperability. The reporting domain is described as covering notifiable diseases, IDSR weekly reporting, public health events and routine returns.

The framework page currently displays the domain weights as 35 per cent for functionality, 30 per cent for security, privacy and confidentiality, 20 per cent for reporting and public health alerts, and 15 per cent for information exchange and interoperability. Those displayed weights differ from older summaries of the programme. Use the current published framework rather than carrying an old percentage into a procurement decision.

A domain description is not a report catalogue. It tells you the area being assessed, not that a particular vendor has met it. Ask for the current assessment criteria and the evidence expected for the system and scope being considered.

Four reporting jobs to test

1. Notifiable diseases. Ask which events are captured, who reviews them and how a possible notification is distinguished from a completed one. The vendor should show the source entry and the resulting record without using real patient data.
2. IDSR weekly reporting. Ask the vendor to show the period being reported, the facility or service scope, the values included and the correction path before a return leaves the facility. Confirm how a revised figure is labelled.
3. Public health events. Ask what happens when an event falls outside the ordinary weekly cycle. The demonstration should show escalation, review and the status of the event, not just a static alert.
4. Routine returns. Ask which operational data feeds the return, how missing values are surfaced and how the facility can retain a copy of what was reviewed or sent. A report that cannot be traced back to its source records is difficult to defend.

These are tests of workflow evidence, not a claim that every system must expose the same screens. The exact forms, frequencies and channels should be confirmed against the current DHA requirements and the facility's reporting obligations.

The vendor demonstration checklist

Give the same scenario to each vendor. Use synthetic records and ask the vendor to narrate who does each step.

1. Show where the source clinical or operational record is entered.
2. Show the reporting period and the population or service scope it covers.
3. Show validation for missing, inconsistent or out-of-range values.
4. Show the reviewer's queue and how a correction is made before finalisation.
5. Show the resulting return, export or controlled hand-off without exposing a live national credential.
6. Show what the facility retains as evidence: version, date, responsible user and status.
7. Show what happens when a source record is corrected after a return has been reviewed.
8. Explain how requirements change when the reporting specification changes, and where the facility sees that change.

Score what was shown, not what was promised. A vendor can be strong in clinical documentation without having demonstrated the reporting and public health alerts domain.

Questions behind the screen

• Which reporting requirements are supported today, and which are still configured or planned?
• Which source fields feed each return, and can a reviewer trace a value back to its record?
• What prevents an incomplete return from being treated as final?
• Can the facility correct a source record and see the effect on a return without losing the previous audit evidence?
• Who can prepare, review, approve and export a report?
• What does the system retain when a report is rejected, returned for correction or resubmitted?
• Which requirements come from DHA and which are configured for the facility's own operating process?

What this does not prove

A working report demo does not prove DHA certification. It also does not prove that a vendor has live access to a national submission environment, that a report has been accepted by a public body, or that the facility's own reporting obligations are fully covered.

Certification is a separate assessment of a declared system scope. Confirm the current position with the Digital Health Agency and request evidence in writing. Do not treat "reporting ready", "IDSR capable" or "DHA compliant" as a certificate.

Where Nanto Health fits

Nanto Health is a dialysis-specific electronic medical record and SHA claim-readiness platform for Kenyan facilities. It is not a general hospital-wide HMIS. Nanto Health does not currently claim DHA certification.

For a dialysis team, the relevant operational question is whether the clinical record is complete, reviewable and ready to support the facility's wider reporting and claim work. Nanto Health helps facilities prepare, validate and track SHA claim evidence. Direct electronic submission remains gated by facility onboarding, testing, certification and production credentials.

For the wider assessment, read DHA certification in Kenya. For the distinction between an EMR and a hospital-wide HMIS, see EMR vs HMIS in Kenya.

Common questions

What does the DHA reporting domain cover?

The current DHA certification framework describes reporting and public health alerts as covering notifiable diseases, IDSR weekly reporting, public health events and routine returns.

Is reporting a separate certification?

No. Reporting and public health alerts is one domain within the DHA assessment of a digital health system. It is not a separate certificate or a substitute for the full assessment.

What should a facility ask a vendor to demonstrate?

Ask the vendor to show the report definition, the source records, the review and correction path, the submission or export step, and the audit trail for a completed reporting cycle. A list of report names is not a demonstration.

Does Nanto Health provide a certified reporting system?

Nanto Health does not currently claim DHA certification. It is a dialysis-specific EMR and SHA claim-readiness platform, not a general hospital-wide HMIS.

Sources

Source checked on 5 September 2026: the Digital Health Agency certification framework page, published by the Digital Health Agency. The page was fetched live and its rendered application bundle was inspected for the reporting scope and displayed domain weights. The framework PDF linked by that page was also fetched live from admin.dha.go.ke. The practical demonstration questions are editorial guidance, not additional DHA requirements. Confirm current criteria, reporting channels and facility obligations with the Digital Health Agency before relying on them.