A patient arrives at reception with an appointment confirmation and an old card. Reception opens a new visit. A clinician requests a service, the laboratory receives the order, and billing collects a payment. At the end of the day, reception counts one visit, the laboratory lists two requests, and the cashier cannot tell which charge belongs to the completed service. Each desk worked from a reasonable screen. The facility still needs a person to reconstruct the visit.
A hospital management system in Kenya should help the facility trace that visit from arrival to administrative closure. Begin your purchase by asking the people at each desk what they need from the preceding desk and what they owe the next one. Then test the joins. A registration page and a laboratory page can both look convincing while passing incomplete or ambiguous information between them.
The fictional outpatient visit in this guide is an operational test. It uses invented identities and events. Clinical leaders at the purchasing facility should define and validate any workflow that affects patient identification, ordering, result review or continuity of care. The purpose of the demonstration is to expose the administrative and information boundaries that buyers can otherwise miss.
Define the visit before defining modules
Write down what starts a visit in your facility. A scheduled appointment may exist days before arrival. A walk in may reach reception with little information. An existing patient may return for a different reason on the same day. Decide which records represent an appointment, a person and an encounter. Mixing those three concepts makes it difficult to explain cancellations, returns and unfinished visits.
Give the fictitious patient a stable identifier and each visit a separate reference. The facility should be able to find the right patient record without treating a phone number as a permanent identity. People change numbers, families share contact details and clerks sometimes transpose digits. Ask your clinical and records leaders to define the permitted identification checks and resolution path when staff cannot confidently match an existing record.
A queue entry is another distinct object. Someone may be registered but waiting for a room, moved between service points or sent back to reception to clarify an administrative issue. Test whether movement changes the visit reference or accidentally creates a second billable visit. A queue view should help staff act while protecting information from people who have no reason to see it. Inspect what appears on a public facing display.
Choose an endpoint for the visit. Clinical completion, fulfilment of orders, financial settlement and administrative closure can occur at different times. A result may still await authorised review after a patient leaves the building. One universal completed status conceals these distinctions. Give each responsible team a view of its open work and agree which conditions permit the final administrative closure.
Register the returning patient without creating a duplicate
Prepare two fictitious patients with similar names and different identifiers. Give one an outdated contact number. Ask an admissions clerk to find the correct record under realistic conditions, including a desk and incomplete information. Watch what the search results disclose, which distinguishing details are visible and how the clerk responds when the match remains uncertain. A fast search can increase risk if staff are encouraged to select the first plausible result.
Demonstrate the authorised correction of a spelling error. The facility may need to preserve earlier values for traceability and restrict who can update identifying details. Make a correction, then find the patient using the agreed search method. Ask where the change appears in downstream records and whether a previously issued document remains identifiable as the version produced at the time. Overwriting every historical display can obscure what staff originally saw.
Now create a suspected duplicate deliberately. The vendor should show how a trained records officer flags the pair, investigates it and applies the facility’s approved resolution process. Automatic merging based on a similar name is a poor substitute for authorised review. Check the treatment of encounters, charges, documents and outstanding orders. A mistaken merge can have consequences across several departments, so the facility needs a clear escalation and recovery procedure.
Remember the unresolved case. If reliable identification is unavailable, staff need an approved local process that allows appropriate work to continue safely. The system should support the facility’s policy and make pending verification visible to authorised staff. Ask the clinical lead and records officer to review the trial together. Their agreement matters more than a vendor’s reassurance that a search algorithm usually finds the right record.
Check the handoff from reception to the care team
Reception completes its portion and sends the visit onward. What appears on the receiving team’s work list? Include the visit identifier, necessary administrative context and the time the handoff occurred. Avoid unnecessary sensitive detail on shared displays. Have the receiving staff member acknowledge or pick up the work according to the facility’s process. Then let reception see whether the handoff has been accepted without opening clinical notes.
Test a room change. If the patient moves from one service point to another, does the original work list lose the task only after the receiving team knows about it? What if the second workstation is disconnected? A successful message on the sending screen does not prove that the receiving team can see the visit. Look for a clear state, a responsible owner and a way to detect unacknowledged work.
Test a queue entry created twice when a clerk clicks again after a slow response. Duplicate entries can create contradictory instructions, repeated services or confusing billing. The expected result should be defined by the facility and verified in both work lists. A single success banner is inadequate evidence. Compare the underlying visit reference, task count and staff view after refreshing the page and opening the record on another terminal.
Decide how staff escalate a visit that has waited unusually long. Different queues may require different oversight under clinical leadership. Administrative software can show elapsed time and ownership, while authorised professionals decide what action is appropriate. Check that escalation alerts reach someone able to act and that a shift change does not reset the wait simply because a new person opens the record.
Follow an order through cancellation and correction
Use one fictional service order approved for the demonstration by the facility’s responsible lead. Create it from the correct visit. The receiving department should be able to distinguish the order from a generic note and see the identifiers necessary for its task. Confirm that the ordering team can tell whether the order is pending, acknowledged, completed or cancelled according to the facility’s approved workflow.
Make a deliberate correction before fulfilment. Can the authorised person withdraw or amend the instruction, and does the receiving department see the change in time? Compare the original order, the replacement and any resulting charge. Silent edits are difficult to interpret when someone has already acted on an earlier version. Preserve the relationship between the two versions and make outstanding decisions visible.
Repeat the correction after the receiving department has begun work. The appropriate response may differ from an ordinary cancellation and needs clinical and operational approval. Ask the vendor to demonstrate the configured boundary and how staff escalate an exceptional case. A button that always deletes the line is easy to explain in a sales meeting and difficult to defend when people have already used the instruction.
Check the financial side separately. Some facilities create a charge at order entry, others at fulfilment or another defined event. The accounting trigger should be explicit and reversible under an approved process. Test a cancelled order, an order that is fulfilled once after two clicks, and a completed service whose charge initially fails to post. The facility should see each exception without depending on the patient to report it.
Keep result delivery and result review distinct
A result entering the hospital system is different from the responsible professional receiving and reviewing it. Ask the clinical lead to define the appropriate handling for your facility and type of service. Then demonstrate how the software records delivery, authorised access, review status and any required follow up. The boundaries may differ by department, but they should remain understandable across shift changes.
Use an incomplete or amended result in the trial. An authorised department may need to issue a correction after a previous version has been released. The recipient needs to distinguish the amendment, identify the earlier version and follow the facility’s approved review process. Ask what the patient portal displays if one exists, who may release a result and how staff can see that a prior message referred to an older version.
Check access from another role. A cashier needing to confirm that a service occurred should not automatically gain the full result. A receptionist arranging the next appointment may need scheduling information with no clinical detail. Test both ordinary navigation and direct links to records. Include report exports and printed documents because sensitive information can leave a controlled interface through a report produced for a different purpose.
Make shift handover part of the test. A professional ending duty should be able to identify work awaiting authorised review and hand it over under the facility’s policy. The incoming person should see the relevant ownership and timestamps. Ask both participants to perform the process using the trial records. A shared screen showing all completed services cannot substitute for a list of outstanding review responsibilities.
Give billing a verifiable charge trail
Send the fictional patient to the cashier with a routine consultation charge and one fulfilled service. Add an approved discount or adjustment if your facility uses one. The cashier should be able to trace each amount to its originating event, price version and authorisation where applicable. A charge described only as miscellaneous is difficult for a patient to query and difficult for finance to reconcile.
Define which date selects a price. An appointment may be booked before a price change and attended after it. An order might be placed on one day and fulfilled on another. The purchasing team should agree how its own approved price rules apply, configure the system accordingly and test both sides of the effective date. Do not discover the answer through an argument at the cash desk.
Try a partial payment, an excess payment and a payment assigned to the wrong visit in the trial environment. Ask the cashier to explain the outstanding balance after each action. Ask the supervisor to authorise the appropriate correction and inspect the receipt history. The original receipt, replacement or reversal and remaining balance should stay linked in a form that finance can inspect without opening clinical records.
Use an invented external payer arrangement if the facility accepts one. Authorisation, service delivery, claim submission, acceptance and payment are separate events. A submitted claim is not cash received. The vendor should show how a rejected or partly settled item returns to an owner for action. Verify actual payer requirements and integration access independently before purchasing a promise that an interface is available.
Reconcile a cash desk after the patient leaves
Have a second cashier take over during the trial shift. Can finance distinguish transactions performed under each account? Shared operator credentials weaken the facility’s ability to investigate a discrepancy, while unrestricted supervisor overrides make errors difficult to attribute. Define the conditions under which a supervisor can reverse a receipt and what proof links that decision to the original transaction.
Build a closing worksheet for the fictitious shift. Include opening funds where relevant, cash received, other payment channels, refunds, reversals and amounts due to external payers. Compare physical or independently confirmed amounts to the system’s expected totals. Record discrepancies with a reason or investigation owner. A report marked balanced because the cashier typed the expected amount provides little assurance that the money was received.
Test a delayed payment confirmation. The patient may present a reference while the independently verified confirmation has not arrived. The facility needs an approved process for pending verification that staff can follow consistently. Do not let the demonstration assume every payment callback arrives promptly or only once. A later confirmation should attach to the intended transaction without producing another receipt or quietly settling a different patient’s balance.
Ask finance to reconstruct the shift a week later using the stored record. Can a reviewer identify which payments were pending at close, which settled later and who approved any differences? A report recalculated from today’s balances may conceal what the cashier knew on the day. Retain the approved closing evidence and use a separate follow up list for items resolved subsequently.
Decide how pharmacy and stores join the visit
Where pharmacy is in scope, use an authorised fictional dispensing workflow defined by the facility. Check how a fulfilled issue connects to the correct encounter, authorised instruction and inventory movement. An administrative buyer should focus on identifiers, permissions, evidence and reconciliation while qualified clinical staff validate the clinical process and safety requirements.
Try an item that is recorded in packs but issued in smaller units. The operational team needs a consistent unit conversion and an agreed process for exceptions. Test the stock balance, issue record and relevant charge using simple invented quantities. A screen can display the correct patient charge while subtracting the wrong number of units from stores. Review the stock movement independently of the billing result.
Handle a partial fulfilment according to facility policy. If only part of an authorised quantity is available, staff need to distinguish what was issued from what remains open. A second fulfilment must refer to the original instruction without silently repeating the first issue. Ask which roles can amend or cancel the balance and how the system records the reason. Include a shift handover between the two events.
Check the return route with the department’s responsible lead. Returned items may require different handling depending on their condition and the facility’s procedures. A financial reversal should not automatically make an item available for use. Separate the decision about money from the decision about stock disposition, then inspect both trails. An elegant return button can be unsafe if it hides that distinction from staff.
Protect patient information across everyday work
Review privacy through the jobs people perform. The receptionist, cashier, records officer, clinician, laboratory worker, system administrator and external support technician have different reasons to access information. Build role descriptions with the facility and test actual records through each account. Kenya’s Office of the Data Protection Commissioner publishes specific guidance on processing health data and other relevant topics. Use it with the facility’s responsible advisers when determining the applicable controls. ODPC guidance library.
Watch the printer as well as the screen. A receipt or appointment slip can reveal more than its purpose requires, especially in a shared waiting area. Check print previews with a restricted user, inspect exported spreadsheets and review what appears in notification previews. Staff working quickly may copy a screenshot into a support ticket. Give them a practical alternative using a reference, time and description with only the information needed for investigation.
Test exceptional access under the facility’s approved policy. If urgent access is permitted for particular roles, it should have an identifiable user, reason, duration and review route. Ask who reviews exceptional access, when the review occurs and what evidence remains. A broad administrator password passed between shifts undermines accountability even if the software records that the administrator account opened a record.
Document the supplier’s access separately from staff access. Clarify the hosting arrangement, backup locations, subcontractors involved, support access approval and process for returning data at exit. Ask for a demonstration of a time limited support session and the evidence of its closure. Evaluate the answers against the facility’s own obligations and arrangements, including how it responds when a patient or authorised representative raises an information request.
Practise a downtime period and the return to service
Choose a realistic interruption during the fictitious visit. Reception has registered the patient, a service is ordered and a payment is pending. The facility’s designated leaders should define the safe continuity procedure for each department. Ask what staff can still access, how they identify the visit on temporary records, where those records are stored and who authorises the return to electronic processing.
A connection failure can affect one workstation, a branch, an external service or the entire application. Those failures require different responses. If the cashier loses a confirmation but the bank retains the transaction, accepting another payment can create an avoidable problem. If a department loses access to a queue while others continue sending work, orders can accumulate unseen. Rehearse both situations with fictional data.
The return to service deserves as much attention as the interruption. Define who enters activities recorded during downtime and who checks them against existing electronic entries. Use temporary references that map to the correct visit under facility policy. Avoid creating a second encounter simply because the first was unavailable on one terminal. Reconcile outstanding orders, payments, stock issues and review tasks before declaring recovery complete.
Ask the vendor to restore a backup in an isolated environment and show its timestamp and completeness. The facility still needs to establish which events happened after that recovery point and how they will be reconstructed. A successful technical restoration may leave unfinished operational work. Measure recovery until the responsible teams can account for the visit, its services and its money, under the facility’s approved continuity process.
Separate migration from starting care in the new system
List which historical records are needed in the live application, which may remain in an authorised archive and which require special treatment according to policy. Migrating every legacy field can carry forward duplicates and unclear meanings. Migrating too little can deprive authorised staff of information they need. The facility’s clinical, records, finance and privacy owners should make these decisions together.
Use a sample containing a returning patient, a corrected identifier, an unresolved payer balance and an open service order. Compare the source record with the migrated result, including dates, references and role permissions. Check whether a historical document clearly shows its origin. A scanned record labelled with the import date alone can mislead a reader about when the underlying event occurred.
Review access to the old system after cutover. If staff still need authorised historical information, specify how they reach it, which system receives new entries and how a search distinguishes the old and new records. Leaving both installations open for unrestricted editing can split a visit across two histories. Give the legacy archive an owner and a clear process for correcting or annotating historical errors.
Plan for people who join duty during migration week. A night shift clerk and a relief cashier may miss a daytime training session. Supply a brief workflow guide, access to a trial record and a named route for support. Have each shift demonstrate the handoffs it owns before expanding the rollout. Training attendance shows who was in the room. A completed fictional visit shows what the team can actually do.
Give managers reports they can interpret
A daily activity return should identify what it counts. Reception may report registered encounters. A department may count individual services, including several for one encounter. Finance may report receipts, which can arrive on a different day. These figures need not match. Ask each manager to name the decisions the report supports and the event that enters its count. Put the date basis and scope where the reader can find them without consulting the analyst who built the report.
Try a visit that begins before midnight and closes after midnight under the facility’s chosen reporting convention. Determine which reporting date receives the registration, service and payment. Repeat the example with a service cancelled the next morning. The original day’s operational snapshot and a later revised activity report can both be valid. Give the two views distinct names and define which one each meeting uses. Otherwise a manager can interpret a change in past figures as evidence that an operator altered yesterday’s cash.
Make a manager explain the waiting time report. Does the clock start at appointment time, arrival, completed registration or entry into a departmental queue? Does it stop when a room is assigned or when the receiving professional acknowledges the visit? Averages can hide a small group that waited much longer. Ask for a view of the distribution and the number of observations, subject to privacy safeguards, rather than comparing two branches on a single unexplained number.
Small counts can disclose information when combined with other facts. A specialist service at a small branch might see only one patient in a period. Sharing detailed breakdowns more widely than their purpose requires can reveal information indirectly. Ask the privacy owner to review the report audience, permitted filters and exports. Use a fictional manager account to test what happens when several filters narrow a nominally aggregate view down to one identifiable visit.
Budget for the desks where work happens
Walk the proposed route through the facility with the people who use it. A printer placed behind a closed finance office may be unavailable to a night cashier. A registration desk with one power outlet may not support the planned devices without preparation. A workstation facing the waiting area may reveal details on screen. Add these practical constraints to the quote so the project budget reflects the environment staff will actually use.
Calculate demand around peaks rather than an average day. Several appointments might arrive together while a cashier closes a shift and a department printer fails. Ask the supplier which parts of that situation it can reproduce in a test environment. Measure whether users receive an intelligible status when work takes time. A slow request that clearly remains pending is easier to handle than a blank screen that encourages staff to submit the same instruction again.
Assign ownership of terminal replacement. A spare workstation is useful only when an authorised person can configure it, connect the correct printer, sign in under their own account and reach the necessary records. Test the replacement using the fictional visit. Check that downloaded files from the failed machine were handled under the facility’s arrangements and that a replacement device cannot inherit the previous operator’s permissions simply by taking the same desk.
Budget for forms during an interruption as well as devices during normal operation. Approved temporary records, secure storage and a route for returning documents to the right department may appear inexpensive, yet someone must maintain them and train new staff. Include a periodic rehearsal in the operating plan. During the exercise, ask a relief staff member to locate the current instructions without relying on a supervisor remembering which cupboard contains last year’s folder.
Bring these practical costs back into the supplier comparison. One proposal may assume the facility provides reliable connectivity, suitable terminals and trained administrators. Another may include setup and onsite preparation. A price difference can represent different responsibilities rather than a difference in product quality. Have each supplier annotate the same desk inventory and implementation schedule so the facility can compare the actual work it will receive.
Compare proposals using a witnessed visit
Give shortlisted suppliers the same fictional visit and ask them to show it in the configuration they propose to deliver. Record whether each handoff works today, needs configuration, requires development or depends on an external party. A demonstration based on a mature product elsewhere can be informative, but the facility needs a written statement of what its own price and implementation include.
Price the work around interfaces and operating hours. Does the proposal cover migration of relevant history, departmental training, downtime rehearsal, support during shift changes and testing of external connections? Who supplies devices, printers and network readiness? Who pays when the facility adds another service point or changes a price schedule? Ask for first year and recurring costs under a sample workload representative of your facility.
Weight acceptance decisions according to consequence. A missing colour preference is a minor inconvenience. An untraceable amended order, exposed clinical result or duplicate patient merge needs a decision from the responsible leaders before rollout. Record the owner and evidence required for closure. Allow qualified people to decide whether a workflow is safe and usable rather than treating a generic sales checklist as facility approval.
The purchasing team can leave the room with a concrete account of the trial. One patient arrived, one visit connected the departments, responsible people could see their outstanding work, and finance could explain the money without reading private notes. Where that account breaks, you have found the next requirement to negotiate. Explore further operational buying guides on the ZamaCore blog.