Understanding Hospital Technology Risks: An IT Audit Risk & Controls Perspective
From patient registration and clinical care to billing and discharge — a practitioner’s guide to understanding hospital operations, IT risks, controls, and regulatory obligations for auditors and risk professionals across Kenya, East Africa, and the continent.
Hospitals are among the most operationally complex institutions on earth. Every day, they simultaneously manage life-critical clinical workflows, financial transactions, regulated patient data, supply chains, and multi-stakeholder governance — all underpinned by increasingly interconnected information systems. For IT auditors, risk managers, and assurance professionals across Kenya, East Africa, and the wider African continent, understanding how hospitals actually function end-to-end is the essential foundation for credible, high-value assurance work.
Why Hospitals Demand a Specialised Audit Lens
The healthcare sector across Africa is undergoing rapid digital transformation. In Kenya, national programmes such as the Digital Health Act 2023 and the roll-out of the Universal Health Coverage (UHC) initiative under the Bottom-Up Economic Transformation Agenda (BETA) are driving hospitals — both public and private — to digitise patient records, integrate with the Social Health Authority (SHA), and implement electronic health record (EHR) systems at scale. Similar transformations are underway in Uganda, Tanzania, Rwanda, and Ethiopia, often supported by development finance and donor-funded ICT programmes.
Yet with this digital expansion comes a dramatically enlarged risk surface. Patient data is among the most sensitive personal information in existence. Clinical system failures can have life-threatening consequences. Billing fraud in healthcare is a continent-wide concern. And regulatory obligations — from the Kenya Data Protection Act 2019 to sector-specific Ministry of Health circulars and, for listed hospital groups, Capital Markets Authority requirements — create layered compliance obligations that most internal audit functions are ill-equipped to assess without a clear process map.
The Hospital Business Process: End-to-End
Hospital operations can be mapped across five interconnected process domains, each with distinct operational realities, IT dependencies, and risk profiles. The diagram below represents the full patient journey and the supporting business processes that run in parallel. Understanding each domain in granular operational terms is the starting point for any credible IT audit or risk assessment.
The Five Process Domains
-
Domain 1Patient Access & RegistrationFront-door operations: appointment scheduling, walk-in triage, insurance pre-authorisation, patient identity verification, and master patient index (MPI) creation.
-
Domain 2Clinical Care DeliveryThe core of hospital operations: physician consultation, nursing assessment, diagnostic ordering (laboratory, radiology), treatment administration, pharmacy dispensing, and theatre management.
-
Domain 3Clinical Documentation & RecordsElectronic health record management, clinical coding (ICD-10/11), discharge summaries, referral letters, and consent documentation — the legal and clinical record of care.
-
Domain 4Revenue Cycle & BillingCharge capture, claims generation, insurance adjudication, patient billing, collections, and SHA/NHIF reconciliation — the financial engine of the hospital.
-
Domain 5Support & Enabling FunctionsSupply chain (pharmacy, medical supplies), facilities management, HR and payroll, finance and reporting, and IT operations — the infrastructure that sustains clinical delivery.
Domain 1: Patient Access & Registration — What Actually Happens
A patient arrives at a Kenyan referral hospital or private facility. What happens operationally in the first sixty minutes determines the quality of the entire episode of care — and creates the first wave of IT risks an auditor must understand.
At the front desk, a registration clerk opens the hospital information system (HIS) — typically a locally deployed system such as KenyaEMR, OpenMRS, or a commercial product like iCliniq or Medics Premier — and searches for the patient by national ID, phone number, or SHA/NHIF number. If the patient is new, a Master Patient Index (MPI) record is created: name, date of birth, ID number, next of kin, insurance details, and contact information. This single record underpins every downstream transaction. A duplicate MPI — created because the search was skipped or the ID was mis-keyed — is one of the most common and consequential data integrity failures in East African hospitals.
For insured patients, the clerk initiates a pre-authorisation request to the insurer or SHA portal. In Kenya, since the transition from NHIF to the Social Health Authority (SHA) in late 2023, this involves real-time eligibility verification via the SHA portal — a process many hospitals are still operationally and technically adapting to. A failed or bypassed pre-authorisation means the hospital may deliver care that is ultimately not reimbursed.
Without robust MPI deduplication controls, hospitals accumulate thousands of duplicate records. In Kenya, studies have found duplication rates of 8–15% in major referral hospitals. Duplicates corrupt clinical history, create medication safety risks, and generate fraudulent billing opportunities.
HIS systems that allow clerks to override SHA/insurer verification steps expose hospitals to revenue leakage. Auditors should test whether pre-authorisation is enforced at system level or merely a policy requirement that staff can circumvent.
The HIS should enforce mandatory search before new record creation, with configurable match thresholds (e.g., name + DOB + ID number). Periodic duplicate detection reports should be reviewed by a data quality officer.
SHA/insurer eligibility verification should be a mandatory system step, not a manual checkbox. Interface logs should be retained and periodically audited to confirm verification occurred before service delivery.
Domain 2: Clinical Care Delivery — What Actually Happens
This is the core of what hospitals exist to do — and the domain where IT failures translate directly into patient harm. Understanding clinical workflows in operational terms is essential for auditors, who must assess controls without inadvertently disrupting care.
After registration, the patient is triaged by a nurse who records vital signs in the EHR. A physician then conducts the consultation, documents findings in a clinical note (typically SOAP format: Subjective, Objective, Assessment, Plan), and generates electronic orders for investigations. In a well-functioning Kenyan tertiary hospital, laboratory orders flow electronically via an Order Communication system to the lab information system (LIS), where specimens are tracked, results generated, and automatically returned to the EHR. In practice, many hospitals operate in a hybrid model: electronic orders are printed, carried by hand to the lab, and results phoned or handwritten back to the ward — creating gaps in the electronic audit trail that significantly complicate retrospective audit.
Pharmacy presents similar challenges. When a physician prescribes medication, the order should flow to the pharmacy management system for dispensing. However, in many East African hospitals, verbal prescriptions, handwritten scripts, and informal override mechanisms remain common — creating medication safety risks, controlled substance misuse opportunities, and billing integrity gaps.
Audit Insight — Theatre and High-Cost Procedure Controls
Operating theatres represent the highest-cost, highest-risk clinical environment in any hospital. In Kenya, the Kenya Medical Practitioners and Dentists Council (KMPDC) requires documented informed consent, anaesthesia records, and operative notes for all surgical procedures. From an IT audit perspective, the key questions are: Does the theatre management system enforce mandatory completion of pre-operative checklists before a case is marked as started? Are implant and consumable serial numbers captured at point of use and reconciled to inventory? Is the case record locked and timestamped immediately post-procedure? Weaknesses in any of these controls create pathways for phantom billing, inventory theft, and clinical liability.
Key Clinical IT Risks
Where laboratory and radiology orders are not transmitted electronically, the audit trail is broken. Results may be acted on before being formally recorded, or never recorded at all. Auditors should assess the proportion of orders placed electronically versus manually and test whether all results are captured in the EHR before patient discharge.
The electronic MAR should record every dose administered — drug, dose, time, and administering nurse. In many Kenyan hospitals, the MAR remains paper-based or is transcribed retrospectively from paper, creating medication error risks and making adverse event investigation extremely difficult. Auditors should assess whether eMAR is implemented and whether it is completed in real time.
Opioids and other controlled substances require a physical register under Kenyan pharmacy law. Many hospitals now maintain a parallel electronic system. Auditors should test reconciliation between the physical register, electronic pharmacy system, and clinical administration records — discrepancies are a significant indicator of diversion.
Mature EHR systems provide drug interaction alerts, allergy warnings, and critical value notifications. Auditors should assess whether these alerts are configured, whether they are being overridden at excessive rates (alert fatigue), and whether override reasons are captured and reviewed.
Domain 3: Clinical Documentation & Records — What Actually Happens
Every clinical encounter must be documented in the patient record. In Kenya, the Digital Health Act 2023 and supporting Ministry of Health guidelines are progressively mandating electronic health records across public facilities and setting standards for private sector compliance. The clinical record is simultaneously a clinical tool, a legal document, a billing instrument, and a dataset for population health management.
Discharge documentation is where many hospitals struggle operationally. The attending physician must complete a discharge summary that includes: the principal diagnosis (coded to ICD-10), procedures performed, medications prescribed, follow-up instructions, and the reason for each clinical decision. In high-throughput public hospitals like Kenyatta National Hospital or Mulago in Uganda, discharge summaries are frequently incomplete, delayed, or missing — creating clinical risk for the receiving provider and undermining revenue cycle processes dependent on accurate coding.
Clinical coding is the translation of clinical documentation into ICD-10 (or increasingly ICD-11) codes used for billing and national health statistics. In many East African hospitals, coding is performed by administrative staff with limited clinical training, leading to systematic undercoding or upcoding errors that affect both revenue and regulatory reporting. SHA reimbursement in Kenya is tied directly to coded diagnoses; incorrect coding is a direct revenue integrity risk.
HIS systems should generate automatic alerts for incomplete discharge summaries beyond a defined threshold (e.g., 48 hours post-discharge). Completion rates should be reported to clinical governance committees monthly.
A random sample of coded records should be reviewed by a qualified clinical coder or physician monthly. Systematic coding errors should trigger staff training and, where intentional, be escalated as a fraud concern.
Any amendment to a finalised clinical record must be logged with the user identity, timestamp, original content, and reason for amendment. Retrospective alterations without an audit trail are a significant medico-legal and regulatory risk.
Informed consent records — particularly for surgical procedures and research — must be retained in the EHR or as scanned documents. Auditors should verify that consent documentation is complete and that the consent date precedes the procedure date.
Domain 4: Revenue Cycle & Billing — What Actually Happens
The revenue cycle is where clinical activity is translated into financial claims — and where the highest concentration of financial risk and fraud opportunity exists. For IT auditors in East Africa, this domain demands the most rigorous attention. Billing fraud in the healthcare sector is a well-documented and growing problem: inflated claims, phantom services, unbundling, and upcoding are reported across both public and private sectors.
Operationally, revenue cycle management begins at the point of care and ends when a claim is settled. When a physician orders a test or procedure, the HIS should automatically generate a charge capture entry. In hospitals with strong charge capture controls, this is instantaneous and system-enforced — the test cannot be ordered without triggering a charge. In weaker control environments, charges are captured manually by billing staff after the fact, creating opportunities for omission, amendment, or fabrication.
Claims for insured patients are then assembled, reviewed, and submitted to the insurer or SHA. In Kenya, the transition to the Social Health Authority has introduced a new claims portal and reimbursement model that many hospitals are still adapting to technically. Claims that fail SHA validation are returned for correction — and the adequacy of the hospital’s claims management process (resubmission tracking, denial root cause analysis) directly determines revenue recovery.
Services billed to insurers without corresponding clinical documentation or charge capture entries. This is the most common form of healthcare fraud in East Africa. Auditors should reconcile billing records against clinical orders, procedure notes, and pharmacy dispensing records.
Services delivered but not billed result in revenue leakage. In Kenyan hospitals, this is most common in high-throughput departments (A&E, outpatient clinics) where manual charge capture is overwhelmed by volume. System-enforced charge triggers are the primary control.
Intentional miscoding of diagnoses or procedures to attract higher reimbursement. Auditors should use data analytics to identify patterns inconsistent with clinical norms — for example, unusually high rates of complex procedure codes from a specific clinician or department.
The same service billed twice — to two insurers, or twice to the same payer. HIS billing modules should enforce duplicate claim detection. Auditors should run duplicate detection analytics across the billing dataset, particularly at period-end when claims volumes are high.
Consolidated IT Risk Register for Hospital Operations
Drawing the five domains together, the following risk register represents the most material IT risks for hospital environments in the East African context. This structure maps directly to standard audit programme design and can be used as the basis for risk-rated audit planning.
Unplanned downtime of the HIS or EHR forces clinical staff into manual paper-based fallback procedures. In the absence of tested downtime procedures, care continuity is compromised, and data captured on paper is frequently never reconciled back into the electronic record. For Kenyan public hospitals on thin infrastructure, this is a daily operational reality. Auditors should assess Business Continuity Plans, recovery time objectives, and downtime reconciliation procedures.
Hospitals routinely grant overly broad access rights to clinical staff, often justified by operational urgency. Break-the-glass access — emergency override of normal access controls — is frequently used and rarely reviewed. Auditors should assess role-based access control (RBAC) implementation, review privileged user access logs, and test whether terminated staff access is revoked promptly.
Modern hospitals operate networks of connected medical devices — infusion pumps, patient monitors, imaging equipment, and diagnostic instruments. In East African hospitals, these devices are frequently acquired from multiple vendors over many years, creating heterogeneous, unpatched device estates. Device compromise can result in patient harm, data exfiltration, or ransomware propagation across the hospital network.
Hospital HIS environments typically integrate with laboratory systems, pharmacy systems, imaging archives (PACS), insurer portals, and government registries (SHA, KMPDC). Each integration is a potential attack surface and a data integrity risk. Auditors should map all active integrations, assess data validation controls at each interface, and evaluate third-party access management practices.
Patient data loss is irreversible and potentially life-threatening. Auditors should verify that backup schedules, retention periods, and recovery procedures meet minimum standards — and crucially, that recovery has been successfully tested within the preceding twelve months. Backup integrity testing is consistently one of the most commonly failed controls in East African hospital IT audits.
Key IT Controls by Process Domain
For each process domain, effective IT audit requires testing of controls at three levels: preventive (stop the risk from materialising), detective (identify when the risk has occurred), and corrective (restore normal operations and remediate the impact). The following framework provides a control testing structure for hospital IT audits.
Preventive Controls
Each user role should have the minimum access rights necessary for their clinical or administrative function. Segregation of duties must be enforced between clinical staff who document care and billing staff who generate claims.
Diagnostic orders, procedures, and medication dispensing should automatically trigger charge entries in the billing system without manual intervention. This prevents omission and reduces the risk of fraudulent manual additions.
The HIS must enforce a patient search before allowing new record creation. Match algorithms should be configured to flag probable duplicates for review before admission proceeds.
For insured patients, SHA or insurer pre-authorisation should be a mandatory system step with an interface-verified approval code required before the system marks the patient as admitted.
Detective Controls
Automated log analysis should flag unusual access patterns: after-hours record access, bulk downloads, access to records of deceased or discharged patients, and repeated failed login attempts. Logs should be retained for a minimum of seven years in Kenya.
Monthly data analytics across billing records should flag statistical outliers: claim rates significantly above specialty benchmarks, service combinations inconsistent with ICD coding, and claims submitted for services on days when the relevant clinician was not rostered.
Daily and monthly reconciliation between clinical orders, pharmacy dispensing, and billing charges should be performed and reviewed by a senior finance officer. Unreconciled items should be escalated within 48 hours.
Automated dashboards should monitor EHR data completeness rates: discharge summaries, clinical coding completeness, consent documentation, and MPI integrity scores. These should be reported to clinical governance committees monthly.
Regulatory & Framework Mapping
Hospital IT audit in East Africa must be grounded in an understanding of the applicable regulatory and standards frameworks. The following mapping provides a structured reference for audit programme design, evidence gathering, and finding classification.
Applicable Regulatory & Standards Frameworks — East African Hospital Context
- Kenya Data Protection Act 2019 & Regulations 2021
- Digital Health Act 2023 (Kenya)
- Social Health Authority Act 2023 (Kenya)
- Kenya Medical Practitioners and Dentists Council (KMPDC) Standards
- Kenya Pharmacy and Poisons Board Act
- Communications Authority of Kenya — Cybersecurity Guidelines
- ISACA COBIT 2019 — IT Governance Framework
- ISO 27001:2022 — Information Security Management
- ISO 27799 — Health Informatics Security Management
- HL7 FHIR — Health Data Interoperability Standards
- ICD-10/ICD-11 — Clinical Coding Standards (WHO)
- NIST Cybersecurity Framework 2.0 — Risk Management
- East African Community — Health Data Governance Guidelines
- WHO Africa Digital Health Strategy 2023–2030
The Kenya Data Protection Act 2019 is the most immediately applicable legislation for hospital IT audits. Health data is classified as sensitive personal data under the Act, attracting the most stringent processing obligations. Data Protection Officers (DPOs) must be appointed, data protection impact assessments (DPIAs) conducted for high-risk processing activities, and breach notifications filed with the Office of the Data Protection Commissioner (ODPC) within 72 hours of discovery. Many Kenyan private hospitals have yet to fully operationalise these obligations — creating significant audit and regulatory risk.
The Digital Health Act 2023 establishes Kenya’s first comprehensive legal framework for electronic health records, digital health product certification, and health data sharing. It mandates interoperability standards and establishes the Kenya Health Information Exchange (KHIE) as the central infrastructure for health data exchange. For auditors, the Act creates new compliance requirements around EHR certification, data localisation, and patient data portability rights.
Audit Committee Questions: Hospital IT Governance
- Has the hospital appointed a Data Protection Officer as required by the Kenya Data Protection Act 2019, and has a data protection impact assessment been conducted for the EHR system?
- What is the hospital’s tested Recovery Time Objective (RTO) for the core HIS system, and when was the last successful recovery test conducted?
- What proportion of clinical orders are placed and received electronically, and what manual fallback procedures exist for system downtime?
- Has an independent billing audit been conducted in the last 12 months, including data analytics across the full claims dataset?
- What is the process for revoking access rights for terminated clinical and administrative staff, and how quickly is this enforced at system level?
- Are connected medical devices inventoried, patched, and segmented on a separate network from the core clinical IT systems?
Emerging Trends: Digital Health in Africa
The hospital IT risk landscape in East Africa is evolving rapidly. Auditors and risk managers must maintain awareness of the following trends, which are reshaping the risk profile of healthcare institutions across the continent.
The transition from NHIF to the Social Health Authority in Kenya is the most significant operational change facing Kenyan hospitals in a decade. Real-time eligibility verification, pre-authorisation, and claims processing via the SHA portal are technically demanding, and many hospitals are operating in hybrid analogue-digital states. Auditors should assess interface reliability, claims reconciliation completeness, and SHA portal access management as priority areas.
Increasingly, Kenyan and East African hospitals — particularly smaller private facilities — are adopting cloud-based EHR platforms rather than on-premise deployments. This shifts risk towards cloud configuration management, data sovereignty concerns (under the Kenya Data Protection Act, health data must be stored within Kenya or in jurisdictions with adequate protection), and third-party vendor due diligence.
Post-COVID, telemedicine has become a permanent feature of East African healthcare delivery. Platforms handling video consultations, remote prescribing, and electronic referrals create new data protection risks, consent management challenges, and clinical liability questions. Kenya’s KMPDC telemedicine guidelines and the Digital Health Act 2023 set minimum standards, but enforcement and audit focus remains limited.
AI tools for radiology image interpretation, pathology analysis, and sepsis prediction are being piloted at leading East African institutions including Aga Khan University Hospital Nairobi and Moi Teaching and Referral Hospital. These tools introduce algorithm bias, explainability, and liability questions that are not yet addressed by existing regulatory frameworks — but which audit functions should begin incorporating into their risk assessments now.
African healthcare institutions have become increasingly attractive targets for ransomware operators, as documented in Interpol’s Africa Cyberthreat Assessment. Hospitals are particularly vulnerable: clinical systems cannot easily be taken offline, patient safety pressure creates urgency to pay, and the sensitivity of health data strengthens extortion leverage. Auditors should assess ransomware preparedness as a mandatory component of every hospital IT audit, including offline backup integrity, incident response planning, and staff phishing awareness.
Conclusion: Building a Risk-Intelligent Hospital Audit Practice
Mapping the hospital business process end-to-end is not merely an academic exercise. For IT auditors and risk professionals across Kenya, East Africa, and the broader continent, it is the foundation of every credible finding, every risk-rated recommendation, and every boardroom conversation about technology governance in healthcare.
The hospitals of East Africa are at an inflection point. Digital transformation is arriving at scale — through SHA, through the Digital Health Act, through cloud EHR adoption, and through AI-assisted care. The risk implications of this transformation are not being matched by equivalent investment in audit capacity, governance frameworks, or regulatory oversight. This is the gap that experienced IT auditors and assurance professionals must fill.
At Sentinel Assurance Partners, we work with hospital boards, audit committees, and management teams across Kenya and East Africa to build risk-intelligent assurance frameworks that match the operational complexity of modern healthcare delivery. The most impactful hospital IT audit is one that the clinician recognises as understanding their world — and that the board trusts to protect it.
