Philippines: HMO Letters of Authorization (LOA) and Pre-Authorization Requests Through an API, 2027 Guide for Clinics

You work with HMO (health maintenance organization) cards and letters of authorization (LOA) in the Philippines. You may want a clinic, an HMO and a health-tech team to share that data through an API. Before you link anything, read what the Philippines' own texts say about HMOs, health systems and personal data. This guide does that. It then outlines the ClinikEHR API (api.clinikehr.com) in general terms. ClinikEHR is not a PhilHealth eClaims integration.

Quick Answer

Read the Philippines' own rules before a clinic and an insurer or HMO share authorization and claims data, because choosing an API settles none of them.

• Executive Order 192 put HMOs under the Insurance Commission, which licenses them. A bill to regulate them by statute has been filed.
• The Commission's model HMO Agreement defines an LOA as the HMO's own letter to its member. A pre-authorization (PA) code is a different thing.
• PhilHealth is a different payer, and eClaims is its channel. ClinikEHR is not connected to it.
• A Department of Health and PhilHealth order on health information systems may add duties, and the Data Privacy Act of 2012 does. Their reach is for a Philippine lawyer.
• An insurer or HMO can apply for the ClinikEHR API, and a hospital chooses whether to link that insurer or HMO. The insurer's developer workspace needs the Enterprise contract plan, and the hospital needs the Enterprise plan with API access on. This guide claims nothing about ClinikEHR in the Philippines.

What Is an HMO in the Philippines, in Plain Words

A health maintenance organization (HMO) is, in the words of Executive Order 192 (explained below), an entity organized to provide or arrange health services for its enrolled members for a fixed prepaid fee. Terms used below:

• Member: the Commission's word for a person an HMO covers. The ClinikEHR API says enrollee.
• LOA: a letter of authorization, which the Commission's model defines as the HMO's letter to its member.
• Affiliated hospital: a hospital in the HMO's network.
• Pre-authorization (PA): a request that asks an HMO to agree in advance to pay. An approval gives a PA code, which goes on the claim.
• Controller and processor: a controller decides what personal data is collected and why. A processor handles it for the controller.

An LOA is not a PA code. This guide is general information, not legal advice. Ask a lawyer in the Philippines about your own case.

What This Guide Could Read, and What It Could Not

Facts here were read on 15 October 2026. Where a point is unsettled, or belongs with a lawyer, this guide says so and does not choose.

How HMOs Are Regulated in the Philippines

Executive Order 192 and the Insurance Commission

Executive Order No. 192 of 12 November 2015 moved HMO regulation and supervision from the Department of Health (DOH) to the Insurance Commission (Government of the Philippines, 2015). It lets the Commission issue rules on HMO capital, directors, reports and the registration of contracts and plans (section 4). Every HMO must get a license to operate from the Commission, and the Commission honors older Department of Health clearances to operate (section 5). The Commission's own list calls these certificates of authority.

Two definitions of an HMO

The two texts define an HMO differently. The Order says an HMO is a legal entity organized to provide or arrange agreed health services to its enrolled members for a fixed prepaid fee over a set period (section 2). The Act says it is an entity that provides, offers or covers designated health services for its plan holders or members, for a fixed prepaid premium (Government of the Philippines, 2019, section 4(m)).

A bill has been filed

The sources this guide read regulate HMOs through an Executive Order and the Commission's circulars. It did not read the Insurance Code or any court decision. Circular Letter (CL) 2025-11 of 11 April 2025 sets capital and other requirements (Insurance Commission, 2025). A bill to regulate HMOs by statute has been filed (House Bill No. 7130, file-stamped 19 January 2026) (House of Representatives, 2026). This guide did not check its status, so re-check it.

What the Commission's own lists show

The Commission's list as of 31 January 2025 shows 27 HMOs with a certificate of authority (Insurance Commission, 2025). Its later list as of 31 March 2025 shows 28 (Insurance Commission, 2025). Its performance sheet for 31 December 2024, based on unaudited submissions, covers 28 companies, one under conservatorship (Insurance Commission, 2025). The counts differ by document and date, and the Commission may have published newer ones, so check its site. This guide names no HMO.

How an HMO Card and an LOA Work at a Hospital

The Commission's model HMO Agreement is the only official source this guide found that defines an LOA. It is a set of model provisions, not a rule on how LOAs are issued.

What the model agreement is

CL 2017-19 of 11 March 2017 sets how the Commission approves HMO products and forms. An HMO Agreement must contain in substance the minimum provisions of its annexes (section 4). Annex A models an individual agreement and Annex B a corporate one (Insurance Commission, 2017). A later circular may change them, so re-check.

What the model says an LOA is

Letter of authorization duly issued by [the HMO] to, and signed by, the Member which shall serve as the authority of the latter to avail of the medical services.

Insurance Commission, 2017, Annex A, definitions. The model prints a placeholder where the HMO's name goes.

So the LOA is the HMO's letter to its member. The member signs it, and it serves as the member's authority to use medical services. It is the HMO's document, not a code.

Where the model puts the LOA

For a hospital stay that is not an emergency, an affiliated physician recommends it and the HMO's authorized representative approves it before it starts. As proof, the HMO issues the requisite LOA and other documents. The model's out-patient clause has no LOA sentence, so this guide states no LOA rule for out-patient visits (Insurance Commission, 2017, Annex A, Benefit Provisions, items 1 and 3).

Emergencies follow a separate provision. If a member needs a stay after emergency treatment at a non-affiliated hospital, the member or a representative must notify the HMO within 24 hours of admission. The model extends that period when the member's condition prevents the member or a representative from notifying the HMO. The model makes notice a condition of in-patient cover. It is a notice the member gives, not a promise that anyone will reply within 24 hours (Insurance Commission, 2017, Annex A, Benefit Provisions, item 2).

How the model treats the claim

The member reports to the HMO first, unless it is an emergency. Before discharge, the member fills in the claim form and pays what the agreement does not cover. The HMO settles the covered part directly with the hospital or attending physician. The direct-settlement sentence carries no clock. The model's one payment-time sentence sits among the member's reimbursement terms, and this guide does not read it as a term between an HMO and a hospital. Ask Philippine counsel. The model also keeps PhilHealth apart: the HMO deducts PhilHealth entitlements and is not responsible for filing PhilHealth claims (Insurance Commission, 2017, Annex A, Availment and Claims Procedure, IV.1.c, and the PhilHealth provision, VII).

What the sources do not settle

• Speed. This guide found no Commission rule on how fast an HMO must issue or refuse an LOA.
• Duration. It found no primary source that says how long an LOA lasts. Ask each HMO in writing.
• Meaning. As reported by the law firm Respicio & Co., a commentary describes an LOA in other terms (Respicio & Co., undated).

PhilHealth eClaims: A Different Payer and a Different Channel

PhilHealth is the Philippine Health Insurance Corporation. Its accredited health facilities send it claims through eClaims, its electronic claims system. An HMO is a different payer, and the model agreement keeps the two apart.

PhilHealth announced that electronic claims for All Case Rates were to go only through eClaims version 3.0 from 1 April 2026 (PhilHealth, 2026). A later advisory said that from 1 July 2026 only version 3.0 would be operational (PhilHealth, 2026). Both dates have passed, so check PhilHealth's site for newer advisories.

Software suppliers that connect to eClaims are certified through PhilHealth's own process (PhilHealth, 2024). ClinikEHR makes no claim to any PhilHealth certification, and it is not connected to eClaims. The advisories this guide read do not mention HMOs or LOAs.

The Health-Information Rules a Buyer Is Told to Meet

Two Philippine texts ask providers and insurers to run a health information system (HIS). Section 36 of the Universal Health Care Act describes it as covering enterprise resource planning, human resource information, electronic health records and an electronic prescription log. This guide reports them and applies neither.

The Universal Health Care Act says all health service providers and insurers shall each maintain one, consistent with DOH standards and uploaded regularly through interoperable systems. The same section says the system is to be developed and funded by the DOH and PhilHealth. Patient privacy must be upheld (Government of the Philippines, 2019, section 36).

Joint Administrative Order No. 2021-0001 of the DOH and PhilHealth, titled Guidelines on the Implementation and Maintenance of an Integrated Health Information System and dated 21 April 2021, puts this into guidelines (Department of Health and PhilHealth, 2021). It defines insurers to include HMOs that hold certificates of authority from the Commission. It says providers and insurers shall register their systems and put them through validation, with three years from its effectivity to comply. It also says that providers and insurers may be allowed by the DOH and PhilHealth to develop, adopt or maintain their own system (part V.C). On replacing a system, it says:

Existing HIS cannot be supplanted by another HIS from external developers or vendors, or any equivalent, without appropriate validation and certification.

Department of Health and PhilHealth, 2021, Joint Administrative Order No. 2021-0001, part VI.A. HIS means health information system.

Three points are unsettled. The copy this guide read does not show when the order was published, so it cannot give the date the three years end. This guide could not confirm whether the order is in force, enforced or amended, or find the separate validation issuance it promises. A Philippine lawyer can say where this stands.

This guide makes no claim that ClinikEHR holds any validation, registration or relationship with the DOH, PhilHealth or the Philippine Health Information Exchange. This guide makes no claim about any of them. It gives no view on whether a hospital in the Philippines can use the ClinikEHR API. That is for the hospital and its counsel to decide.

What the Data Privacy Act of 2012 Says About Health Data

The Act and its Commission

Republic Act No. 10173, the Data Privacy Act of 2012, was approved on 15 August 2012. It created the National Privacy Commission (NPC) to administer the Act and receive complaints (section 7) (Government of the Philippines, 2012).

Health data is sensitive personal information

The Act's Implementing Rules of 2016 (the Rules) list information about a person's health as sensitive personal information (Supreme Court E-Library, 2016, section 3). Section 13 of the Act prohibits processing it except in listed cases (Government of the Philippines, 2012, section 13). They include consent specific to the purpose, medical treatment by a medical practitioner or a medical treatment institution, and the protection of legal rights in court proceedings or legal claims. Which case covers a given flow is for each organization's own counsel. This guide does not say which one applies to an HMO, a hospital or a supplier.

Who is responsible

A personal information controller is a person or organization that controls the collection, holding, processing or use of personal information. A processor is one to which the controller outsources processing (Government of the Philippines, 2012, section 3). The Rules say there is control if a body decides what information is collected, or the purpose or extent of its processing (Supreme Court E-Library, 2016, Rules, section 3). The sources do not say which role an HMO, a hospital or a supplier has in a given claims flow.

The controller must use reasonable and appropriate organizational, physical and technical measures. It must make sure third parties processing for it do the same (section 20). The Rules say the outsourcing contract sets out the geographic location of the processing (Rules, section 44).

Reporting a breach

The Act says the controller shall promptly notify the Commission and affected people of a breach that meets its test (Government of the Philippines, 2012, section 20(f)). The Rules set the clock:

within seventy-two (72) hours upon knowledge of, or when there is reasonable belief [...] that, a personal data breach requiring notification has occurred

Supreme Court E-Library, 2016, Implementing Rules, section 38

The Rules allow delay only as far as needed to find the scope of the breach, stop further disclosures or restore reasonable integrity to the information and communications system (Supreme Court E-Library, 2016, Rules, section 40). The Commission's breach circular (NPC Circular No. 16-03) and its Advisory No. 2026-02 of 11 May 2026 were not read for this guide. A law-firm digest reports that the advisory refers to a full breach report within five days of discovery (DivinaLaw, 2026). Read both before you write a breach plan.

Registering a data processing system

The Rules say an organization that employs fewer than 250 persons need not register unless its processing is likely to pose a risk to people's rights and freedoms, is not occasional, or includes sensitive personal information of at least 1,000 individuals (Supreme Court E-Library, 2016, Rules, section 47). The Commission's registration circular (NPC Circular No. 2022-04) was not read. Check the Commission's current rule. This guide does not say that any insurer, HMO, hospital or supplier must register or has registered.

Processing outside the Philippines

The Act can reach processing outside the Philippines that relates to a Philippine citizen or resident, where the entity has a link to the country (Government of the Philippines, 2012, section 6). This guide found no rule in the texts it read that requires private health data to stay in the Philippines. A search that finds nothing proves nothing, so ask counsel. A 2026 order on government data, Executive Order No. 119, says it does not apply to the private sector or commercial data owned by private entities, but it applies to government data that private entities process or store on an agency's behalf, as the implementing guidelines may define (section 2) (Government of the Philippines, 2026). Whether it reaches any system you use is for counsel. This guide claims nothing about where any system, ClinikEHR included, stores data. It explains the Act and certifies nobody.

What a Clinic, Insurer or Health-Tech Team Can Do Before Choosing a Claims System

These steps are a buyer's checklist, not a ClinikEHR feature, and they are not a legal checklist. The Philippine texts above, and your lawyer, decide what you must do.

Step 1: List each payer and how its claims travel

Make one row per payer: PhilHealth, each HMO and any other payer you bill. Note the document each issues before care, the channel its claims use, and who owns it.

What you need: each HMO's agreement or provider terms, and PhilHealth's advisories.

How you know it worked: every payer has a row with a named channel, taken from a document.

The mistake to avoid: assuming one HMO's terms apply to all.

Step 2: Ask counsel about the health information and privacy rules

Take section 36 of the Universal Health Care Act, the joint order, the Act's sections 13 and 20 and the Rules' section 47 to a Philippine lawyer. Ask whether the order is in force and applies to you, whether you must register, which section 13 case covers each claim flow, and who is controller and processor in it.

What you need: the texts, a list of the systems you run, and a list of your claim flows.

How you know it worked: you hold a dated, written opinion, and each flow has one line naming the controller, any processor and the section 13 case.

The mistake to avoid: treating the order as settled either way, or copying roles from a supplier's contract.

Step 3: Ask every claims-system vendor the same questions

Put these questions to every vendor you consider. This guide answers none of them for ClinikEHR.

What you need: the vendor's documents, not its sales pages.

How you know it worked: each of the seven questions has a dated document on file.

The mistake to avoid: accepting a promise in place of a document.

Step 4: Write the breach plan around the Rules' words

Write who tells whom, and by when. The Rules put the controller's notice to the Commission and affected people at 72 hours from knowledge, or reasonable belief, that a breach requiring notification has occurred. The Commission's own circular and advisory may add steps, so read them first. Add any contract clocks you hold, and treat each clock as separate.

What you need: contacts at the Commission, your supplier contracts and an incident log.

How you know it worked: a one-page plan names one person for each clock.

The mistake to avoid: assuming that telling a supplier is telling the Commission.

What the ClinikEHR API Does for an Insurer or HMO and a Hospital That Link It, in General Terms

The ClinikEHR API serves the ClinikEHR app, and it reaches a hospital's records only through a connection the hospital approves for your organization (below, hospital also means clinic). It covers the claims a hospital submits, the pre-authorization requests it sends, and the enrollees and plans an insurer has agreed with it. The route detail is in the HMO claims tutorial and the pre-authorization guide, both written for Nigeria for the same API, and in the API documentation. The ClinikEHR API (api.clinikehr.com) is not ClinikAPI (clinikapi.com), a separate FHIR R4 product with its own site and keys.

What a linked insurer or HMO can do

• Enrollee lookup. Look up members the hospital has recorded, by the number the patient presented. It reads the hospital's own record, so it is not live eligibility.
• Claim adjudication. Read a submitted claim and decide it line by line. It cannot approve more than was billed, and a decision moves no money.
• Pre-authorization. Approve a request with a PA code or deny it with a reason. A request is decided once.
• Payment advice. Send the hospital a message saying what was paid. Hospital staff record the money themselves.

The LOA exchange beside a pre-authorization, as an analogy only

A pre-authorization has the same shape as the first half of an LOA exchange: a request, then the HMO's answer. The table sets each step of the model beside the API step with that shape.

This table maps shapes only. An HMO's agreement built on the model binds the HMO and its member. The API creates, prints and signs no letter, and no API step is said to meet any Philippine rule.

Who can use it

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data, and a ClinikEHR reviewer decides, with no stated timeline. Two Enterprise requirements form a pair. The insurer's or HMO's developer workspace is on the Enterprise contract plan, which ClinikEHR sets on request. The hospital is on the Enterprise plan with API access switched on.

The hospital's owner sets Insurance to Outside the US under Settings, General. That is a setting, not a place. The owner then approves the connection and records a legal basis, and an owner or manager links the insurer.

A health-tech team that is not an insurer or HMO is a developer in the API's terms. It can submit claims and pre-authorization requests for patients a hospital has linked to it. It cannot read an insurer's data or act as one.

The organization accepts a data-protection addendum with Bettar Platforms, Inc. It has no Philippines-specific terms, and its one country clause is for organizations established in Nigeria.

The insurance routes have no sandbox data. A sandbox is a practice area with invented data. Trying the routes takes a live key and a linked hospital.

How you know it worked

• The hospital's owner has approved your connection.
• An owner or manager has linked your organization to the hospital's record of your insurer.
• Your live key lists the hospital and the permissions it granted.

What This Guide Does Not Claim

• It claims no ClinikEHR customers, hosting, registration, certification, validation or approval in the Philippines.
• ClinikEHR is not connected to PhilHealth eClaims, the Philippine Health Information Exchange or any national or scheme system.
• It does not say that any insurer, HMO or hospital is live, approved or onboarded on the ClinikEHR API, or that the API meets any Philippine rule described here.

Mistakes to Avoid

1. Quoting one HMO's LOA terms as the rule for every HMO.
2. Treating a PA code as an LOA.
3. Reading a commentary or a filed bill as law. Neither is the text in force.
4. Assuming a registered supplier is a validated one.
5. Expecting a lookup to find a member the hospital never recorded. It reads the hospital's own record.

Frequently Asked Questions

What is an HMO in the Philippines, and who regulates it?

Executive Order No. 192 describes an HMO as an entity organized to provide or arrange health services for its enrolled members for a fixed prepaid fee. The Order, dated 12 November 2015, moved HMO regulation from the Department of Health to the Insurance Commission. Every HMO needs a license to operate from the Commission. The Order and the Universal Health Care Act define an HMO in different words. The sources this guide read regulate HMOs through an Executive Order and the Commission's circulars, and a bill to regulate them by statute has been filed. This guide did not check the bill's status or read the Insurance Code.

What is a letter of authorization, and does the law require one?

The Insurance Commission's model HMO Agreement (Circular Letter 2017-19, 11 March 2017) defines a letter of authorization. It is a letter the HMO issues to its member, signed by the member, that serves as the member's authority to use medical services. For hospital confinement, the model says the HMO issues the LOA as proof that its conditions are met. The model is a set of minimum provisions for HMO agreements, not a rule on LOA practice, so this guide does not say the law requires an LOA. It found no Commission rule on how fast an HMO must issue or refuse one.

Is PhilHealth eClaims the same as an HMO claim?

No. PhilHealth is the Philippine Health Insurance Corporation, and accredited health facilities send claims to it through eClaims. An HMO is a different payer. The Commission's model agreement keeps PhilHealth benefits apart: the HMO deducts them and is not responsible for filing PhilHealth claims. PhilHealth announced that from 1 July 2026 only eClaims version 3.0 would be operational. The advisories this guide read do not mention HMOs or letters of authorization.

What does the Data Privacy Act of 2012 say about health data?

The Act, Republic Act No. 10173, created the National Privacy Commission. Its Implementing Rules list information about a person's health as sensitive personal information. Section 13 prohibits processing sensitive personal information except in the cases it lists, such as consent specific to the purpose, or medical treatment by a medical practitioner or institution. Which case covers a given flow is a question for each organization's own counsel. This guide explains the Act and is not legal advice.

Must a hospital or insurer register with the National Privacy Commission, and how soon must a breach be reported?

The Implementing Rules say an organization that employs fewer than 250 persons need not register unless one of three things is true. Its processing is likely to pose a risk, it is not occasional, or it includes sensitive personal information of at least 1,000 individuals. The Commission's registration circular was not read, so check the current rule. For breaches, the Act says to notify the Commission and affected people promptly. The Rules say within 72 hours of knowledge or reasonable belief that a breach requiring notification has occurred. Ask a Philippine lawyer how this applies to you.

What does the ClinikEHR API do for an insurer or HMO and a hospital that link it?

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data, and a ClinikEHR reviewer decides. Its developer workspace needs the Enterprise contract plan. The hospital must be on the Enterprise plan with API access switched on, and its owner sets Insurance to Outside the US, approves the connection and records a legal basis. An owner or manager then links the insurer. The API lets the insurer look up the members the hospital recorded, decide claims line by line, approve or deny pre-authorizations and send payment advices. The insurance routes have no sandbox data.

Does the API issue a letter of authorization, move money or check live cover?

No to all three. A pre-authorization decision is approved with a PA code or denied with a reason, and it is decided once. It is not the HMO's letter of authorization, which stays the HMO's own document. A payment advice is a message, and hospital staff record the money themselves. Enrollee lookup reads the record the hospital holds, so it is not a live cover check. The API does not compare claim lines with the price list agreed with the HMO, and it does no fraud scoring.

Is ClinikEHR connected to PhilHealth eClaims or any national system in the Philippines?

No. ClinikEHR is not a PhilHealth eClaims integration. It is not connected to the Philippine Health Information Exchange or to any national or scheme claims or health-information system. This guide makes no claim about ClinikEHR in the Philippines and does not say ClinikEHR meets any rule it describes. Ask any vendor for its own documents, using the questions in this guide.

Conclusion

The Philippines' own texts set the frame for any exchange of authorization and claims data. The Commission regulates HMOs, and its model agreement shows what an LOA is. PhilHealth eClaims is a separate channel. The Data Privacy Act adds duties, a health information order may, and several points belong with a Philippine lawyer.

An API can carry pre-authorization and claims data, but it does not answer those texts for you. To ask how access works, contact the team or see the developer portal. The pricing page lists the plans, including Enterprise.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)
• Building a Health-Insurance Startup for Emerging Markets: What Your Hospital Integration Must Do (2027 Developer Guide)

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.