SHA: Flaw on newly launched biometric system forces hospitals to password verification
Social Health Authority (SHA) signage at Mutuini Hospital in Dagoretti South Sub-County, Nairobi, on August 27, 2025.
Last Wednesday, Nancy* visited a Level Six hospital in Nairobi for her final clinic appointment.
Instead of scanning her fingerprints as she had done previously, she was prompted to approve payment through a one-time password (OTP) sent to her phone. Only after entering the code from the Social Health Authority (SHA) was she able to access services. Upon discharge, she again had to use OTP verification to clear her bill.
The incident came barely three weeks after Health Cabinet Secretary (CS) Aden Duale unveiled a biometric verification system, designed to replace the OTP method introduced in October 2023 when SHA was rolled out.
On Tuesday this week, however, hospitals countrywide received a directive instructing them to revert to OTP after a nationwide failure of the biometric system. The outage caused delays in patient treatment and discharges.
A notice from the Digital Health Agency—the body mandated to oversee the technology—confirmed the breakdown: “We are experiencing a nationwide downtime affecting biometrics. Due to this, the verification process has been reverted to OTP as our technical team works on a resolution.”
The agency was established last year under the Digital Health Act, 2023 to develop and manage a comprehensive digital ecosystem aimed at improving healthcare delivery. By yesterday morning, the biometric system had been restored, according to Bungoma-based healthcare provider Mr Mohamud Amin.
Less secure
But he warned that reliance on OTP is far from ideal.
“The challenge with OTP is that the system sometimes gets overwhelmed, forcing patients to wait for codes before they can access care. This is disastrous in emergency cases,” he said.
Dr Amin further noted that OTP is less secure than biometrics: “Anyone can authorise payment for another person using OTP. Biometrics, on the other hand, require the patient’s physical presence and reduce fraud significantly.”
Health Cabinet Secretary Aden Duale during a press briefing at Afya House in Nairobi on August 25, 2025.
The defunct National Health Insurance Fund (NHIF) system also relied on biometric verification. However, when SHA replaced NHIF in 2024, the government temporarily introduced OTP technology. Mr Duale later reinstated biometrics, describing them as “smoother and more secure.”
During the biometric launch at Kenyatta University Teaching, Research and Referral Hospital (KUTRRH), Mr Duale also unveiled several digital innovations, including the Health Professional App (Practise360), the National Product Catalogue, and the Health Information Exchange (HIE). He praised biometrics as a safeguard against fraud and wastage of public resources.
“It will eliminate fraud, reduce paperwork, shorten queues, and ensure more time is spent on patient care,” he said.
Despite such assurances, concerns persist over the Sh104 billion system that facilitated the transition from NHIF to SHA. In March, Auditor-General Nancy Gathungu told a Senate watchdog committee that the government does not own the platform.
“Ownership of the system, system components, and all intellectual property rights remain with the consortium,” she revealed, raising doubts about State control and oversight. The revelations have fuelled criticism from healthcare providers. Dr Brian Lishenga, chairperson of the Rural and Urban Private Hospitals Association of Kenya (RUPHA), said the SHA digital system has consistently underperformed.
The Rural Private Hospitals Association of Kenya chairman Brian Lishenga.
“We are in a mess. The government has been shifting blame but does not seem to understand what is happening,” he told Nation. Dr Lishenga warned that the consortium managing the system must be scrutinised more closely: “One year down the line, they have lost Kenyans’ money and probably cost lives because of missed care.”
He further cautioned that, should the inefficiencies persist, hospitals may be forced to limit their reliance on SHA. “We may soon have to advise patients that SHA cover cannot be relied on for treatment,” he said, adding that some facilities may not survive the ongoing crisis. For patients like Nancy, the uncertainty has already become a lived reality. Each visit to hospital now depends on the reliability of a system still struggling to stabilise.
