Legal Considerations for Health Insurers and Insurtech Platforms After the SHIF Transition

Health insurers and insurtech platforms operating in Kenya are often unsure exactly how the Social Health Insurance Fund changes their business. It does not replace private cover, but it does add a mandatory contribution layer that cannot be waived by holding a private policy, a constitutional challenge that has already tested part of that mandate, and no explicit regulatory bridge yet between the products the Insurance Regulatory Authority licenses and the new public scheme. This article sets out where the law actually stands, rather than where the industry sometimes assumes it stands.

SHIF does not restrict private cover, but it also does not coordinate with it

Section 31(2) of the Social Health Insurance Act, 2023 is explicit: nothing in the Act precludes a beneficiary from taking private health insurance cover. What the Act does not contain is any coordination-of-benefits language, any subrogation mechanism, or any designation of private cover as merely “complementary” or “supplementary” to SHIF. There is no statutory rule dictating that SHIF pays first, or that a private policy only fills gaps SHIF leaves open. That silence is itself the practical point: product design around how private cover sits alongside SHIF is left entirely to the industry, employers and individuals to work out commercially, rather than following a mandated coordination scheme Parliament chose not to build.

Contribution is mandatory even for the privately insured

Section 26(1) requires every Kenyan to register as a member of the Fund, and section 27(1) extends contribution liability to every household, qualifying non-Kenyan residents, national and county government, and any other employer. Section 27(4) goes further: access to healthcare services under the Act is conditional on contributions being up to date and active. Nowhere in the Act is there an exemption for a person or employee who also holds private insurance. This is the single most important point for an insurer to walk an employer client through when designing or renewing a group medical scheme: SHIF contribution is not something a private policy can substitute for, and every employee remains liable for it regardless of what employer-provided cover they also have. On the tax side, a Kenya Revenue Authority public notice has confirmed that SHIF contributions are not currently eligible for the 15% insurance relief that applied to NHIF contributions, since the Income Tax Act’s relief provision names NHIF specifically; a legislative fix was proposed through the Tax Laws (Amendment) Bill, 2024, but had not been confirmed as enacted as of that notice, so this gap should be flagged rather than assumed away when costing a benefits package.

The mandate has already been tested in court, and has largely survived

In Aura v Cabinet Secretary, Ministry of Health & 11 others, Constitutional Petition E473 of 2023, the High Court held on 12 July 2024 that the mandatory contribution regime is constitutionally justified, while striking down sections 26(5) and 27(4) as applied to emergency care and section 38, and giving Parliament 120 days to remedy those specific provisions. The Court of Appeal stayed that judgment on 20 September 2024, allowing the SHIF rollout to continue while the appeal is pending. For an insurer, the headline is that the core mandatory-contribution model has so far survived constitutional challenge at the High Court, even though its application to emergency care remains under active legal scrutiny and the outcome on that narrower point is not yet settled.

Health insurers and insurtech face no explicit regulatory bridge yet between IRA-licensed products and SHIF

Private health insurers remain licensed under the Insurance Act, Cap 487, through the Insurance Regulatory Authority, under a distinct Medical Insurance Provider category. We were not able to locate any IRA guideline, circular, or product-approval rule that specifically addresses how a medical insurance product should be designed, priced, or marketed relative to SHIF. Insurers should not assume the IRA has quietly built SHIF into its supervisory expectations; until it issues something specific, product design around the new mandatory scheme is happening without dedicated regulatory guidance, which cuts both ways, giving more room to design a product commercially while also leaving more exposure if a design choice is later found to sit awkwardly against whatever guidance eventually follows.

Insurtech platforms face the same health-data obligations as any other processor

The Data Protection Act, 2019 and the Office of the Data Protection Commissioner’s own guidance treat health data as sensitive personal data, and that guidance expressly names health insurers and digital or eHealth platforms among the entities it covers. A digital platform handling medical scheme or health insurance data needs a lawful processing basis that meets the DPA’s stricter standard for sensitive data, a documented data protection impact assessment for higher-risk processing, and the same breach-notification and security obligations that apply to any other health data handler. On a dedicated regulatory sandbox for insurtech specifically, the IRA has been reported to be developing one, but we could not confirm this against a primary IRA document, so a new entrant should treat any such sandbox as not yet in force rather than something to rely on today.

Self-funded employer schemes are a genuine grey area

We found no Kenya-specific primary source creating a distinct legal category for a self-funded employer medical scheme, as opposed to a licensed insurance product. Given that sections 26 and 27 impose contribution duties on every Kenyan household and on employers generally, without any carve-out by scheme type, it is a reasonable reading, though not one directly confirmed in the Act’s text, that SHIF contribution remains mandatory even for employees covered by a purely self-funded scheme. An insurer or benefits consultant advising a self-insured employer should treat this as an open question worth a direct compliance check, not as settled either way.