Free DHA Readiness Check
Free self-assessment for Kenyan HMIS vendors: score your readiness for the penetration test and vulnerability assessment reports DHA certification marks Required, and get a prioritised gap list.
About this tool
Kenya's Digital Health Agency certification portal lists two security documents under its Compliance category and marks both Required: a Penetration Testing Report covering results from within the last 12 months, and a Vulnerability Assessment Report carrying evidence that the findings were remediated. They are separate uploads, and an application cannot be completed without both. This free check scores how ready your health information system is for that testing before you commission it, so the assessment finds a system that is prepared rather than one that is not.
The questions are not generic security hygiene. They are the things a penetration test of a health system actually looks for, weighted by what would genuinely fail a certification: whether an anonymous caller can reach patient data, whether a user at one facility can read another facility's records, whether authorisation is enforced in the data layer rather than only in the interface, and whether your FHIR and REST endpoints refuse unauthenticated requests. Four items are flagged separately as submission blockers, because they correspond to Required uploads the portal will not let you complete without, and no amount of strength elsewhere compensates for a missing one.
Everything runs in your browser. Nothing you enter is transmitted, logged or stored, which matters because the answers describe weaknesses in a live clinical system. Use it as a gap list before an assessment, or as a preparation checklist if you are working towards a deadline. It is a readiness indicator rather than a test: only an actual assessment produces the evidence DHA asks you to upload.
Frequently asked questions
Is a penetration test mandatory for DHA certification in Kenya?
Yes. The DHA certification portal lists a Penetration Testing Report under the Compliance category and marks it Required, described as recent penetration testing results from within the last 12 months. A Vulnerability Assessment Report is a separate Required upload in the same category, described as recent vulnerability assessment and remediation evidence. Both must be present. The confusion arises because the published applicant manual, version 1.0 of February 2026, does not mention either document in its checklist. The live portal is what reviewers work from.
Does this tool replace a penetration test?
No, and it is important to be clear about that. This is a self-assessment: you answer questions about your own system and it weights and ranks the gaps. It produces no evidence and it cannot be uploaded to the DHA portal. Only an actual vulnerability assessment and penetration test, carried out against the running system, produce the reports the portal requires. Use this to find out where you stand and what to fix before that assessment begins.
What counts as remediation evidence?
The portal asks for a recent vulnerability assessment and remediation evidence, which is more than a scan. A scanner export listing open findings shows that you looked and did nothing. What satisfies the requirement is an assessment, a prioritised remediation cycle your developers work through, and a verification retest that records each finding as closed. The retest depends on your engineering team and is usually the longest part of the work, so plan backwards from it.
How recent does the penetration test report need to be?
Within the last 12 months, as stated in the portal. That makes security testing an ongoing annual obligation rather than a one-time submission: a report older than a year is stale on its face, and a certified system whose evidence has expired is exposed at recertification. Vendors who handle this well also re-test after material releases, particularly changes to authentication, the authorisation model or the tenancy design.
Can we submit our own internal penetration test?
You can submit it, but understand its standing. A test performed by the vendor against its own system is not independent, and DHA files the Penetration Testing Report under Compliance rather than Technical, which is ordinarily where independence matters. The safer position is a report from an external assessor, with internal testing continuing between annual cycles. If you do submit internal testing, state plainly on the report that it is internal rather than leaving a reviewer to infer it.
Why does the tool weight cross-facility isolation so heavily?
Because in a multi-tenant hospital system it is the flaw that causes mass disclosure of clinical records, and it is close to invisible to automated scanning. Nothing about the request is malformed: the caller is authenticated and the query is valid, they are simply entitled to a different facility's data. It also fails silently, so it can persist for years without an error being raised. It should be tested directly, against real data from two or more facilities, because an isolation test with only one tenant's records present cannot fail and therefore proves nothing.
Is my data safe when I use this tool?
Yes. The assessment runs entirely in your browser. Your answers are never sent to a server, never logged and never stored, and closing the tab discards them. That is deliberate: the answers amount to a list of weaknesses in a live clinical system, which is exactly the kind of information that should not sit in someone else's database.