Social Health Authority (SHA) – Biometric Health Identification for Patient Verification at Health Facilities (Kenya)
Overview
The Social Health Authority (SHA) Biometric Health Identification (BHI) system is a government-deployed AI-enabled biometric verification system used to authenticate members of Kenya's Social Health Authority at health facilities prior to authorising medical services and processing insurance claims. The system was officially launched on 4 August 2025 by Health Cabinet Secretary Hon. Aden Duale at Kenyatta University Teaching, Research and Referral Hospital (KUTRRH) in Nairobi, replacing the previous One-Time Password (OTP) verification method that had proven vulnerable to fraud and operational shortcomings (Ministry of Health, 2025, Biometric Health Identification launch press release; Willow Health Media, 2025).
The BHI system uses fingerprint-based biometric identification to verify patient identity at the point of care. When a patient presents at a SHA-accredited health facility, their fingerprint is captured and matched against records held in government databases. The eCitizen Health ID platform, which underpins the biometric eKYC (electronic Know Your Customer) process, performs biometric capture with liveness checks and interacts with the National Registration Bureau (NRB) for matching against the national biometrics database (eCitizen, 2025). This automated biometric matching process constitutes the AI-enabled component of the system, using algorithmic comparison of biometric templates (fingerprint and, in the eKYC context, facial biometrics) to confirm identity before healthcare services are authorised.
The system operates under Regulation 38 of the Social Health Insurance Regulations, 2024, and is implemented as part of a broader digital health transformation strategy anchored in the Social Health Insurance Act (2023), the Primary Health Care Act, the Digital Health Act (2023), and the Data Protection Act (2019) (Kenya Law, 2023; Willow Health Media, 2025). The Social Health Authority was established to replace the defunct National Health Insurance Fund (NHIF) and operates as Kenya's mandatory social health insurance scheme, with over 25 million Kenyans registered by August 2025 and nearly 10,000 health facilities contracted nationwide, including public, private, and faith-based institutions (Ministry of Health, 2025, registration milestone; Willow Health Media, 2025).
The biometric verification system was introduced specifically to address widespread fraud that had plagued both the predecessor NHIF and the early SHA operations using OTP-based verification. A month-long forensic audit by SHA's digital health system uncovered multiple fraudulent practices including upcoding (claiming for more expensive procedures than performed), falsification of medical records to inflate claims, conversion of outpatient visits to inpatient care for billing purposes, multiple billing, and ghost patients created through collusion between facilities (Ministry of Health, 2025, 40 facilities suspended). The Ministry of Health suspended 40 health facilities across Kenya and withdrew SHA platform access rights from eight doctors and four clinical officers linked to the fraud, forwarding their names to the Directorate of Criminal Investigations for prosecution (Ministry of Health, 2025, 40 facilities suspended). Health Cabinet Secretary Duale described the fraudulent practices as a 'grave threat' to the sustainability of Kenya's universal health coverage agenda.
The BHI deployment is accompanied by several complementary digital tools. The Practise360 mobile application is a geo-tagged, geo-fenced tool that restricts pre-authorisation codes to doctors physically present within their assigned facilities, preventing the sharing of authorisation codes that had facilitated previous fraud. A National Product Catalogue ensures only approved, quality-assured medicines reach patients. A Health Information Exchange (HIE) enables real-time secure data exchange between facilities. Additionally, 24 counties are transitioning to Hospital Management Information Systems (HMIS) for real-time patient tracking, with full digitalisation of all public hospitals planned by November 2025 (Ministry of Health, 2025, BHI launch; Willow Health Media, 2025).
Biometric registration became operational at all Level 4, 5, and 6 public health facilities (sub-county hospitals, county referral hospitals, and national hospitals), with KUTRRH alone deploying 29 biometric devices at launch and reporting that 99 percent of walk-in patients were already registered under SHA (Ministry of Health, 2025, BHI launch). Expansion to Level 2 and 3 facilities is planned. However, the system experienced significant technical difficulties shortly after launch, with hospitals countrywide receiving a directive to revert to OTP verification after a nationwide failure of the biometric system in late August 2025, indicating operational fragility in the early deployment phase (Daily Nation, 2025).
The anti-fraud strategy extends beyond biometric verification. In August 2025, the Ministry of Health convened a bilateral meeting with Chief Executive Officers of medical insurance companies to establish a Joint Anti-Fraud Action, agreeing on measures including biometric verification, joint audits, and a shared database of fraudulent providers (Ministry of Health, 2025, joint anti-fraud action). The meeting also agreed on complementary coverage arrangements, shared claims and data platforms linked to SHA's centralised claims system for real-time verification, and aligned empanelment standards across public and private insurers.
The system raises important accessibility concerns for vulnerable populations. An estimated 2.2 million Kenyan citizens with disabilities may face difficulties providing fingerprints due to amputation or medical conditions, and visually impaired users may struggle to navigate digital platforms. The system also assumes a level of technological literacy that may be lacking in rural areas (Willow Health Media, 2025). Furthermore, a previous iteration of the biometric system was abandoned after discovery that fraudulent actors had exploited it through stolen biometrics, causing the state to lose billions of shillings (Biometric Update, 2025).
As of August 2025, SHA had disbursed Ksh 47.5 billion under the Social Health Insurance Fund and an additional Ksh 6.9 billion under the Primary Healthcare Fund, with healthcare providers having served 1.2 million Kenyans and claims processed amounting to Ksh 45 billion (Ministry of Health, 2025, registration milestone; Willow Health Media, 2025). The implementing agencies are the Ministry of Health and the Social Health Authority, with the Office of the Data Protection Commissioner providing regulatory oversight for data protection compliance under the Data Protection Act (2019) and the Data Protection (General) Regulations (2021).
Classification
AI Capabilities
Use Cases
Social Protection Functions
| SP Pillar (Primary) | Social insurance |
Programme Details
| Programme Name | Social Health Authority (SHA) – Universal Health Coverage through Biometric Health Identification |
| Programme Type | Health Insurance |
| System Level | Implementation/delivery chain |
Kenya's Social Health Authority (SHA) is the mandatory social health insurance scheme established under the Social Health Insurance Act (2023) to replace the defunct National Health Insurance Fund (NHIF). SHA provides universal health coverage through contributory social health insurance, with over 25 million Kenyans registered and nearly 10,000 health facilities contracted nationwide. The Biometric Health Identification (BHI) system authenticates members at the point of care using fingerprint verification before authorising medical services and processing claims.
Implementation Details
| Implementation Type | Hybrid |
| Lifecycle Stage | Integration and Deployment |
| Model Provenance | Not documented |
| Compute Environment | Not documented |
| Sovereignty Quadrant | Not assessed |
| Data Residency | Not documented |
| Cross-Border Transfer | Not documented |
| Hybrid Components | Fingerprint-based biometric verification at point of service plus separate fraud and anomaly detection workflows around claims review and provider monitoring. Public sources do not disclose the exact algorithmic approach for either component. |
Risk & Oversight
| Decision Criticality | High |
| Human Oversight | HOTL |
| Development Process | Mix of in-house and third-party |
| Highest Risk Category | Data-related risks |
| Risk Assessment Status | Not assessed |
Documented Risk Events
Previous biometric system abandoned after fraudulent actors exploited it through stolen biometrics, causing state losses of billions of shillings (Biometric Update, 2025). Nationwide failure of newly launched BHI system in late August 2025 forced reversion to OTP verification (Daily Nation, 2025). 40 health facilities suspended and 12 healthcare workers referred to DCI for prosecution over fraudulent claims under OTP system (MoH, 2025).
Risk Dimensions
Data-related risks
Governance and institutional oversight risks
Market, sovereignty and industry structure risks
Model-related risks
Operational and system integration risks
Impact Dimensions
Autonomy, human dignity and due process
Equality, non-discrimination, fairness and inclusion
Privacy and data security
Systemic and societal
Safeguards
Deployment & Outcomes
| Deployment Status | Operational Deployment (Limited Rollout) |
| Year Initiated | 2025 |
| Scale / Coverage | Operational at all Level 4, 5, and 6 public health facilities nationwide; over 22 million Kenyans registered; nearly 10,000 facilities contracted; expansion to Level 2 and 3 facilities planned |
| Funding Source | Government of Kenya (SHA contributory social health insurance fund); Ksh 47.5 billion disbursed under Social Health Insurance Fund as of August 2025 |
| Technical Partners | No primary source identifies the biometric hardware or software vendor(s) for the facility-side BHI system. The eCitizen Health ID eKYC platform provides biometric matching against National Registration Bureau records. The Practise360 mobile application is geo-tagged and geo-fenced for pre-authorisation management. No commercial cloud or AI model vendor publicly documented. |
Outcomes / Results
Biometric verification introduced August 2025 to replace OTP system; 40 health facilities suspended over fraudulent claims; SHA registrations surpassed 25 million by August 2025; Ksh 45 billion in claims processed; 1.2 million Kenyans served through contracted providers; Joint Anti-Fraud Action agreed with private insurers including biometric verification, joint audits, and shared database of fraudulent providers.
Challenges
Nationwide biometric system failure in late August 2025 forced reversion to OTP verification. Previous biometric system exploited through stolen biometrics. Accessibility concerns for 2.2 million citizens with disabilities who may struggle to provide fingerprints. Assumptions of technological literacy may exclude rural populations. No documented fallback or escalation protocol for biometric failure at facility level.
Sources
- SRC-008-KEN-001 Biometric Update (2025). Kenya Re-introduces Biometric Patient Verification to Curb Insurance Fraud. Available at: https://www.biometricupdate.com/202508/kenya-re-introduces-biometric-patient-verification-to-curb-insurance-fraud (Accessed 24 Mar 2026).
https://www.biometricupdate.com/202508/kenya-re-introduces-biometric-patient-verification-to-curb-insurance-fraud - SRC-001-KEN-001 Kenya Law (2023). Social Health Insurance Act, No. 16 of 2023. Nairobi: National Council for Law Reporting. Available at: https://new.kenyalaw.org/akn/ke/act/2023/16 (Accessed 31 Oct 2025).
https://new.kenyalaw.org/akn/ke/act/2023/16 - SRC-002-KEN-001 Ministry of Health (2025). Over 22 Million Kenyans Now Registered Under Social Health Authority. Nairobi: MoH. Available at: https://www.health.go.ke/over-22-million-kenyans-now-registered-under-social-health-authority (Accessed 31 Oct 2025).
https://www.health.go.ke/over-22-million-kenyans-now-registered-under-social-health-authority - SRC-003-KEN-001 Ministry of Health (2025). 40 Health Facilities Suspended Over Fraudulent Claims to SHA. Nairobi: MoH. Available at: https://health.go.ke/40-health-facilities-suspended-over-fraudulent-claims-social-health-authority (Accessed 31 Oct 2025).
https://health.go.ke/40-health-facilities-suspended-over-fraudulent-claims-social-health-authority - SRC-004-KEN-001 Ministry of Health (2025). Ministry of Health, Insurers Agree on Joint Anti-Fraud Action. Nairobi: MoH. Available at: https://www.health.go.ke/ministry-health-insurers-agree-joint-anti-fraud-action (Accessed 31 Oct 2025).
https://www.health.go.ke/ministry-health-insurers-agree-joint-anti-fraud-action - SRC-006-KEN-001 Ministry of Health (2025). Ministry of Health Launches Biometric Health Identification, Advances Digital Health Transformation. Nairobi: MoH. Available at: https://www.health.go.ke/ministry-health-launches-biometric-health-identification-advances-digital-health-transformation (Accessed 24 Mar 2026).
https://www.health.go.ke/ministry-health-launches-biometric-health-identification-advances-digital-health-transformation - SRC-005-KEN-001 Office of the Data Protection Commissioner (2021). The Data Protection (General) Regulations, 2021. Nairobi: ODPC. Available at: https://www.odpc.go.ke/wp-content/uploads/2024/03/THE-DATA-PROTECTION-GENERAL-REGULATIONS-2021-1.pdf (Accessed 31 Oct 2025).
https://www.odpc.go.ke/wp-content/uploads/2024/03/THE-DATA-PROTECTION-GENERAL-REGULATIONS-2021-1.pdf - SRC-007-KEN-001 Willow Health Media (2025). From Passwords to Fingerprints: Kenya's Healthcare Goes Biometric. Available at: https://willowhealthmedia.org/from-passwords-to-fingerprints-kenyas-healthcare-goes-biometric/ (Accessed 24 Mar 2026).
https://willowhealthmedia.org/from-passwords-to-fingerprints-kenyas-healthcare-goes-biometric/ - SRC-009-KEN-001 eCitizen (2025). Health ID – Next-Generation Biometric eKYC. Nairobi: Government of Kenya. Available at: https://ekyc.ecitizen.go.ke/ (Accessed 31 Oct 2025).
https://ekyc.ecitizen.go.ke/
How to Cite
DCI AI Hub (2026). 'Social Health Authority (SHA) – Biometric Health Identification for Patient Verification at Health Facilities (Kenya)', AI Hub AI Tracker, case KEN-001. Digital Convergence Initiative. Available at: https://socialprotectionai.org/use-case/KEN-001