In a major revelation in Kenya, Auditor General Nancy Gathungu found that the Sh104 billion Social Health Authority (SHA) system, which was meant to improve healthcare funding, is not owned or controlled by the government.
This announcement has caused a lot of attention, raising questions about how healthcare data and public money are managed.
Gathungu’s audit showed that the SHA system, which holds important health information for millions of Kenyans, is run by a private group that won the contract to manage it.
This means that instead of the government, a private company is in charge of a healthcare system worth Sh104 billion, and the subscriptions are in private accounts.
Many citizens and leaders are shocked by this finding and worried about the safety of health data and the possible misuse of public funds, especially in the current digital age.
The Auditor General’s report differs from what people expected, as they thought the government would be in charge of such a crucial system for universal healthcare—a major policy meant to improve the National Health Insurance Fund (NHIF).
Gathungu also noted that not having government control could put health data at risk, echoing her previous warnings about other digital platforms, like e-Citizen.
The names of the private group members are not revealed yet, but this revelation has sparked a lot of discussion online.

The private management of the SHA system means there is a profit motive involved. Gathungu mentioned that these individuals earn 2.5% of every contribution made by Kenyans.
Her report states that the SHA system, designed to handle health contributions from millions of Kenyans for universal healthcare, is mainly run by private people.
It gets more concerning knowing that these individuals take a commission from every citizen’s contribution, raising concerns about honesty and responsibility in such an important public system.
The situation with the SHA system’s private control comes at a time when Kenyans are already worried about how digital and financial systems are managed.
In 2024, Gathungu mentioned similar issues with the e-Citizen platform, pointing out risks related to vendors and lost revenue—concerns that are similar to those raised in this new audit.