# Electronic Medical Records for Kenyan Facilities > One patient record that follows the patient across every department, with access control and an audit trail that satisfies the Data Protection Act. Source: https://www.afyaconnect.africa/solutions/electronic-medical-records-kenya Publisher: AfyaConnect HMS (Neurobyte Technologies), Nairobi, Kenya --- One patient record that follows the patient across every department, with access control and an audit trail that satisfies the Data Protection Act. ## What's included - One longitudinal record per patient across every department and visit - Structured vitals, diagnoses, allergies and medications — searchable, not scanned images - Clinical notes with templates per department, editable but never silently overwritten - Access control by role and department, with every record view logged - Data Protection Act 2019 aligned audit trail and retention handling - Works offline and syncs, so a clinic keeps running through an outage The argument for electronic records in a Kenyan facility is usually made on efficiency, and efficiency is the least interesting part of it. The interesting part is that a paper file room cannot answer questions. Which patients on this drug need recalling after a safety alert? How many diabetics have not been seen in six months? Who read this patient's file last Tuesday? A file room cannot answer any of those. An EMR answers all three in seconds — and the third one is a legal requirement now, not a nice-to-have. ## One record, not one record per department The failure of most part-digitised facilities is that the clinic has a system, the lab has a book, and the pharmacy has a till, so the patient has three partial records and no complete one. The clinician sees their own notes and not the dispensing history; the pharmacist sees the dispensing history and not the allergy. In AfyaConnect the record is one object. Consultation notes, admissions, ward observations, lab results, imaging, dispensed medication and billing all attach to the same patient. The allergy recorded at reception is visible at the point of prescribing, which is the only place it does any good. ## Structured, not scanned A PDF of a scanned note is a photograph of a record, not a record. It cannot be searched, audited, counted or acted on. Vitals, diagnoses, allergies and medications are captured as structured data. That is what makes recall lists, drug interaction checking, and reporting possible at all. Free-text notes still exist — clinicians need prose — but the things that need to be queried are captured as fields. ## Access control and the audit trail Under the Data Protection Act 2019 you need to know who accessed a record and be able to show it. Every view is logged with the user and timestamp. Access is scoped by role and department, and tighter for sensitive services: the mental health module deliberately restricts access more narrowly than the facility default, because "any clinician in the building" is not an appropriate audience for those notes. Our guide on [Data Protection Act compliance for Kenyan hospitals](/resources/data-protection-act-kenya-patient-data) covers the obligations that fall on you rather than on the software. ## Getting off paper The migration question is not technical, it is editorial: what is worth carrying across. Almost nobody should retype ten years of historical notes. Most facilities bring demographics and active problems for current patients, keep the paper archive as an archive, and go forward electronically from a chosen date. [Moving from paper or Excel to a hospital management system](/resources/switching-from-paper-excel-to-hospital-software-kenya) walks through how facilities actually sequence this without a chaotic go-live week. ## Frequently asked questions ### What is the difference between an EMR and an HMS? An EMR is the clinical record — history, diagnoses, medications, results. A hospital management system is the EMR plus everything operational around it: billing, claims, pharmacy stock, bed management, scheduling. AfyaConnect includes the EMR as its clinical core; you can think of the EMR as the part clinicians touch and the HMS as the whole facility. ### Is it safe to put patient records in the cloud in Kenya? The relevant risk is rarely the cloud. A paper file room has no access log, no backup and no way to tell who read a record — a cloud record has role-based access control, an audit trail of every view, encryption in transit and at rest, and a backup that survives a fire. What you must get right is the legal side: lawful basis, consent, retention and a data processing agreement, which our Data Protection Act guide sets out. ### What happens when the internet goes down? The system installs as a PWA and keeps working. Records created or updated during the outage are queued locally and synchronised when the connection returns. This is not an edge case in Kenya, which is why it was designed in rather than added later. ### Can we migrate our existing paper or Excel records? Yes. Spreadsheets import directly. Paper is a decision rather than a technical problem: most facilities enter demographics and active problems for current patients and leave the historical files as paper, because retrospectively typing ten years of notes costs more than it returns. We help scope which subset is worth carrying across. ### Who can see a patient record? Access is controlled by role and department, and narrower again for sensitive services — the mental health module, for example, restricts access more tightly than the facility default. Every view of a record is logged with the user and the timestamp, so an inappropriate access is detectable rather than invisible.