Introduction
The DHA certification deadline is only a few days away, yet many health system providers are still working to complete the certification process. For some organizations, the challenge is not a lack of willingness to comply. It is the complexity of getting through the process itself. Various challenges have been raised by providers trying to achieve certification. These range from the fees involved, challenges around accessing the testing laboratory, understanding the applicable technical requirements and standards, and preparing the different documents and evidence that are mandatory throughout the process. For an organization that has already invested significant time and resources into developing or deploying a digital health system, these challenges can create another layer of pressure. And as the deadline approaches, that pressure becomes even greater.
But there is an important distinction that digital health providers need to make. Moving quickly is not the same as being ready. The certification process has several stages, and some of those stages depend on the quality and completeness of what an organization submits before moving forward. Where documentation is incomplete, evidence is missing, technical requirements have not been addressed, or the system is not adequately prepared for testing, organizations can find themselves going back and forth to address issues that could have been identified earlier. This is why, perhaps more than ever, DHA certification readiness has become just as important as the certification itself.
This is the DHA moment
Every industry eventually reaches a point where something that has been discussed for months or years suddenly becomes immediate. For Kenya's digital health ecosystem, DHA certification is reaching that point. Digital health providers can no longer treat certification as something that will be dealt with later. The conversation is moving from awareness to implementation. That is what makes this a Tick-Tock moment for digital health. Not a countdown designed to create panic, but a moment of visibility and action. The digital health providers that recognize this moment early have an opportunity to approach certification differently. Instead of waiting for the assessment process to expose gaps, they can identify those gaps themselves. Instead of discovering that a document is incomplete when it is requested, they can have the documentation reviewed beforehand. Instead of finding cybersecurity weaknesses during the certification journey, they can assess and remediate them before testing.
The objective is not to make the DHA process appear faster than it is. The objective is to reduce avoidable delays within the process.
Certification is more than submitting an application
One of the biggest mistakes an organization can make is viewing DHA certification as an application that simply needs to be submitted. The reality is more involved. The DHA certification framework requires organizations to demonstrate their systems through a combination of documentation, evidence and technical assessment. The process includes self-attestation, submission of evidence, document review, preparation of a testing environment and a final certification decision.
That means readiness has several dimensions. A system may be technically strong but have weak documentation. An organization may have good documentation but discover that some of its security controls are not adequately implemented. A provider may have strong cybersecurity controls but lack sufficient evidence to demonstrate how those controls operate. Another organization may have addressed security and privacy but still have questions around interoperability and information exchange.
The documentation challenge
Documentation is likely to be one of the areas where organizations can lose valuable time.
It is easy to underestimate the amount of work involved because organizations often assume that having a document somewhere in the organization means that the requirement has been addressed. But certification readiness is not simply about having documents. The documents need to be relevant, current, consistent with the actual system and supported by evidence.
Consider a system manual. Does it accurately describe the system currently being deployed? Has the system changed since the manual was written? Do the documented features correspond with what users actually have access to?
What about the requirements specification. Does it clearly explain what the system is designed to do? The same applies to security and privacy policies. A policy may have been approved two years ago, but does it reflect the current environment.
The DPIA presents another important consideration. It should not simply exist because it is required. It should provide an accurate picture of the personal and health information being processed, where that information goes, who has access to it, what risks exist and what safeguards have been implemented.
The question is not whether you have a document. The question is whether the document can withstand scrutiny.
Security cannot be treated as a checkbox
The cybersecurity component of DHA certification deserves particular attention. Digital health systems process some of the most sensitive information an organization can hold. Patient records, medical histories, laboratory results, prescriptions, identification information and other health-related information require appropriate protection. Consequently, cybersecurity should not be something an organization tries to demonstrate at the last minute. It should be part of the system's readiness from the beginning. Has the system undergone appropriate vulnerability assessment and penetration testing? And the identified vulnerabilities have they been addressed? These questions matter because there is a significant difference between having a security control and being able to demonstrate that the control works. Strong Security Policies
Data protection and DHA readiness must move together
There is another area that organizations should not treat as separate from DHA certification: data protection. Digital health systems are deeply connected to the processing of personal and health data. This makes privacy governance an important part of overall readiness. ODPC registration and DPIA requirements are specifically reflected in the DHA certification framework.
But compliance should not stop at obtaining a certificate or preparing a DPIA document. Organizations need to understand the full lifecycle of the information they process.
Then comes the technical test
Perhaps one of the most important questions for a digital health provider is whether its system is genuinely ready to be tested. A system can look ready on paper and still encounter challenges when someone actually starts testing it. Testing can expose issues that may not be obvious during normal operations. It may reveal problems with access controls, data validation, APIs, logging, authentication, interoperability, system performance or specific technical workflows.
The team should understand what environment will be tested, who will support the process, what evidence will be required, how issues will be documented and how quickly technical teams can respond when gaps are identified.
Interoperability is becoming increasingly important
Digital health is no longer about individual systems operating in isolation. The future of healthcare depends increasingly on systems being able to exchange information securely and reliably. An EMR may need to interact with other healthcare systems. Laboratory information may need to move between platforms. Pharmacy systems may need to exchange relevant information. Healthcare providers may need to interact with national digital health infrastructure.
This makes interoperability more than an IT feature. It becomes part of the organization’s overall digital health readiness. Organizations therefore need to understand their APIs, data structures, authentication mechanisms, integration architecture and applicable interoperability standards.
The cost of discovering gaps too late
Imagine an organization reaches the testing stage and discovers that a required technical control has not been implemented. The technical team now has to investigate the issue.
Developers may need to make changes. Security teams may need to conduct additional testing.
Documentation may need to be updated. Evidence may need to be recreated.
Management may need to allocate additional resources. The certification process may consequently involve additional back-and-forth. None of these activities are necessarily impossible. But they are much easier to manage when the gaps are discovered before the organization reaches the point where they become blockers.
At South-End Tech, we work with organizations across cybersecurity, data protection and technology risk to identify gaps and prepare for regulatory and technical requirements.
For organizations preparing for DHA certification, a readiness engagement can help bring together the different pieces — from documentation and data protection to cybersecurity, technical controls, testing preparation and evidence.
The goal is to help you understand where you stand, what is missing, and what needs to be addressed before the next stage of the process.
📞 Telephone: +254 728223333
📧 Email: cybersecurity@southendtech.coke | info@southendtech.co.ke | dataprotection@southendtech.co.ke
South-End Tech Limited — Helping businesses build visible and Cyber-resilient Enterprises.