Sh50 Billion Vanished: Audit Exposes Massive Looting Inside Kenya’s SHA

THE ANATOMY OF A HEIST

In the year ending June 2025, a single patient underwent open heart surgery four times in one day. All four claims were paid. In the same period, at least one woman gave birth ten times within a single calendar year. Kenya’s public health insurer paid for every delivery. These are not isolated clerical errors. They are the fingerprints of an organised plunder conducted at scale inside the Social Health Insurance Fund, the flagship health financing vehicle of President William Ruto’s Universal Health Coverage programme.

The Auditor-General Nancy Gathungu, whose office has a constitutional mandate to scrutinise the use of public funds, has now produced what amounts to the most damning forensic catalogue of the Social Health Authority’s financial conduct since its inception.

The report, covering the financial year 2024/25, flags a total of Sh49.29 billion in irregular, unsupported, or fraudulent transactions, a figure that obliterates earlier official estimates and reframes the SHA scandal as one of the most audacious raids on public resources in Kenya’s post-independence history.

The fund only raised Sh57.7 billion in total contributions during the entire year. The queried amount is more than 85 percent of everything SHIF collected. It is a figure that should shock even the most jaded observer of Kenyan public finance.

Sh26.8 billion paid without a single supporting document. That is 29.3 per cent of all SHIF payments in one year.

THE NUMBERS THAT CONVICT

The Auditor-General’s report itemises the irregularities with forensic precision. At the top of the register, dwarfing every other line item, sits Sh26.84 billion described simply as unsupported claims: payments made by SHIF to health facilities without any records to confirm that the services claimed were ever rendered to any patient. This single category represents 29.3 percent of every shilling SHIF disbursed during the year.

Beyond the unsupported payments, a further Sh7.32 billion was paid to 1,091 health facilities for services not authorised under the SHIF benefit framework.

Facilities that had not even been contracted by SHA at all received Sh1.57 billion. Another Sh4.78 billion was disbursed using service codes that have not been gazetted, a breach that strips any payment of its legal basis and opens the fund to virtually unlimited manipulation.

Some 50,045 claims had multiple service codes consolidated into single entries, generating Sh1.45 billion in overpayments.

Then there are the transfers that have simply disappeared. SHIF reported sending Sh7.3 billion to SHA, but SHA says it received only Sh3.9 billion.

The difference of Sh3.37 billion is untraced. More alarming still, Sh1.34 billion was transferred from SHIF into the bank account of the defunct National Hospital Insurance Fund between January and June 2025.

NHIF ceased to exist in law on the day SHA was established. There is no explanation on record for what the money was for or where it went.

BILLIONS QUERIED BY THE AUDITOR-GENERAL IN SHIF OPERATIONS (FY 2024/25)

Source: Auditor-General’s Report, Financial Year Ending June 2025

THE SURGICAL IMPOSSIBILITIES

The report’s most viscerally scandalous findings concern the surgical claims. Open heart surgery is, under SHIF’s own operational rules, limited to one procedure per patient per year.

The clinical basis for this is self-evident: the procedure involves stopping the heart, placing the patient on a bypass machine, and exposing the chest cavity under general anaesthesia. Recovery spans months. The idea that any patient could undergo the procedure four times in a single day is not merely implausible. It is physiologically impossible.

Yet that is what the claims records show. In total, there were 3,235 instances of unapproved or repeat surgical cases during the year, at a total approved payment of Sh445.4 million. The total amount originally claimed for these phantom repeat procedures was Sh463.8 million. The claims were processed and paid. Nobody stopped them.

The repeat birth claims tell a similar story of systematic abuse. SHIF’s auditors identified 6,392 instances where the same patient record showed multiple deliveries within a single year. One patient’s record showed ten deliveries.

The total claimed amount for these medically impossible repeat interventions was Sh161.3 million, of which Sh148.5 million was approved and paid. Gathungu’s report observes that the pattern exposes fraud at SHIF, possible data integrity issues or system abuse, all of which result in financial loss and undermine the credibility of the claims approval process.

THE SYSTEM BUILT TO FAIL

How did any of this pass through a digital claims system backed by a Sh104.8 billion technology contract? That question goes to the heart of the second scandal nested inside the first. The benefits payment system at SHIF is operated by a private consortium that includes Safaricom PLC as lead bidder, alongside Apeiro Limited and Konvergenz Network Solutions Limited.

The contract was awarded without competitive bidding, with no defined scope of work, and critically, ownership of the system was left with the contractor consortium rather than SHA. The government does not own the platform through which its citizens’ health insurance premiums are being processed.

The Auditor-General is scathing on this point. Her report states that the system was deployed before any comprehensive user requirement testing was conducted, meaning it was rolled out without SHA ever fully verifying that it met the fund’s operational needs.

She further flags the absence of IT governance structures, standard operating procedures, service level agreements with the operating consortium, and IT compliance protocols. In plain terms: a Sh104.8 billion system was handed to a private consortium, deployed without testing, and operated without any enforceable accountability framework.

COTU Secretary-General Francis Atwoli, who sits on the SHA board, made a revelation that has largely been absorbed without adequate outrage: the SHA does not control the IT systems used to verify claims.

The authority that is responsible for disbursing billions of shillings in public funds cannot independently audit, interrogate, or override the technology infrastructure through which those payments flow.

The government does not own the platform through which citizens’ health insurance premiums are processed.

THE REGULATORY INSIDE JOB

The Auditor-General’s findings on the fraud’s systemic architecture are now being corroborated by criminal prosecutions.

In late February 2026, Director of Public Prosecutions Renson Ingonga approved charges against eight hospital owners and one regulatory official following investigations by the Directorate of Criminal Investigations covering the period between January 28 and February 24, 2026.

The official is Harun Liluma, a senior employee of the Kenya Medical Practitioners and Dentists Council, the state body responsible for licensing health facilities.

Liluma faces over 40 counts spanning conspiracy to defraud, unauthorised access to KMPDC’s computer systems, abuse of office, and computer fraud under the Computer Misuse and Cybercrimes Act.

He is accused of using his access to KMPDC’s registration systems to fraudulently facilitate the licensing of eight medical facilities, none of which met statutory requirements, so that they could receive payments from SHA.

The eight facilities named in the charges include Danaba Care Hospital, Kamishawa Medical Centre, Kaafi Nursing Home, Mama Nerbeel Nursing Home, Alati Nursing Home, Julun Nursing Home, Adfaal Kids Care Medical Centre, and Dimtu Nursing Home Limited.

In one documented case, a facility was approved by the Ministry of Health before it was even incorporated as a legal entity. It was registered with KMPDC before it existed on paper, began receiving SHIF payments, and only later appeared in the company registry.

Critics, including the Rural and Urban Private Hospitals Association of Kenya, have posed the structural question that the prosecution of eight individuals does not answer: how did unlicensed facilities access the SHA payment system if the same facilities must be accredited by KMPDC before being empanelled by SHA? Whether the KMPDC registry communicates with the SHA registry at all remains, publicly, unanswered.

A SYSTEM BLEEDING DRY

The audit’s findings on SHIF’s financial sustainability are as alarming as the fraud disclosures. The fund collected Sh57.7 billion in contributions during the year but spent Sh96.1 billion on claims and operations, leaving it operating in a Sh38.3 billion deficit.

The SHA management’s own figures show that benefits paid out amounted to 158 percent of contributions collected. The fund is paying out one and a half times what it is taking in.

The structural problem is compounded by the contribution base. Formal sector workers raised Sh51.99 billion, representing 90 percent of everything SHIF collected, from an informal sector that comprises the overwhelming majority of the population.

Of 27 million registered SHA members, 20.7 million in the informal sector contributed nothing at all during the year. The fund that was sold to Kenyans as Universal Health Coverage is in practice a levy on the employed few, with those contributions now being systematically looted before reaching the patients who need them.

St Mary’s Hospital in Mumias is on the edge of closure because SHA has not paid its admitted debt of Sh180 million. Paid-up contributors across the country have had legitimate claims rejected.

Meanwhile, a hospital that does not legally exist can be registered, empanelled, and paid Sh12.2 million in a single month. The contrast is not incidental. It is the operational logic of the fraud.

ACCOUNTABILITY DEFERRED

Health Cabinet Secretary Aden Duale and SHA Chief Executive Officer Dr Mercy Mwangangi did not respond to the Nation’s inquiries on the day the Auditor-General’s findings were published. For months, neither official has disclosed the full quantum of losses, despite having forwarded thousands of files to the DCI for review.

Duale had previously stated that SHA lost approximately Sh11 billion to fraud, but subsequently walked back that figure, characterising it as claims rejected before payment was made rather than money actually lost.

Mwangangi confirmed that the rejected claims represented 12.1 percent of total claims processed, and that the irregularities were escalated to investigative agencies.

Both positions are now rendered untenable by the Auditor-General’s report. The Sh26.8 billion in unsupported payments alone exceeds the Sh11 billion figure by a factor of two and a half. The question is no longer whether fraud occurred. The question is why the official narrative has been so systematically narrow.

Former Chief Justice David Maraga captured the public mood in August 2025 when he accused state officials of presiding over systemic failures that allowed billions of taxpayer funds to be siphoned to ghost hospitals while ordinary Kenyans continued to suffer.

He called for an independent forensic audit of all SHA funds, a demand that has gained new urgency with the publication of Gathungu’s findings. His demands remain unmet.

At the KAMMP Iftar dinner in Nairobi on March 8, 2026, CS Duale confirmed that multiple facilities had been shut down and cases forwarded to the ODPP for prosecution.

He welcomed a statement by the Kenya Association of Muslim Medical Professionals condemning fraud as haram and as a crime under law. He said the Ministry was committed to safeguarding SHA’s integrity. He did not address the Sh49.29 billion.

The charges approved by the DPP in February 2026 are a beginning, not a reckoning. Fewer than 40 prosecution recommendations have emerged from the 1,188 investigation files that DCI received from SHA in September 2025.

The facilities now in the dock received a combined total of roughly Sh22 million in irregular payments. Against the backdrop of Sh49.29 billion in queried transactions, the legal process has so far addressed less than 0.05 percent of the financial exposure.

What the DPP’s action has confirmed, however, is the structure of the conspiracy.

It runs from hospital ownership through facility registration at KMPDC, through the SHA empanelment process, through a payment system that the government does not own, and out through transfers that disappear into accounts of institutions that no longer legally exist. Every layer of institutional oversight failed, and in at least one case, a regulator is accused of actively facilitating the fraud.

The Social Health Insurance Act, 2023, was passed as the legal architecture for a new era of public health financing in Kenya. Section 2(1) and Section 6 of its First Schedule are now cited in the Auditor-General’s report as provisions violated by the transfer of Sh1.34 billion to the defunct NHIF.

The law was written. The regulations were gazetted. The technology was procured. The fund was capitalised. And then, while the architecture was being admired, Sh50 billion went missing.

The case against Harun Liluma and the eight facility owners is set for mention on March 12, 2026 at Milimani Law Courts.