Egypt: How Health Insurers and Hospitals Can Exchange Claims and Pre-Authorization Data Through an API in 2027

You handle claims between an insurer and a hospital in Egypt, and two bodies of law shape your choices: Universal Health Insurance and the Personal Data Protection Law. An API settles neither. This guide sets out what Egypt's own texts say, then outlines the ClinikEHR API (api.clinikehr.com) in general terms. ClinikAPI (clinikapi.com) is a separate product built around FHIR R4, a health-data standard. ClinikEHR is not a Universal Health Insurance integration.

Quick Answer

Read Egypt's own texts before an insurer or HMO and a hospital exchange claim data, because choosing an API settles none of them.

• Law No. 2 of 2018 created Universal Health Insurance (UHI) as a compulsory system. It is rolling out by governorate, and the sources read give no firm finish date.
• The Financial Regulatory Authority licenses and supervises insurers and the companies that manage healthcare programmes. This guide treats them as market context only.
• The Personal Data Protection Law (Law No. 151 of 2020) treats health data as sensitive. It sets licence, consent, breach-notice and cross-border duties.
• Some points are unsettled, including the end date of the grace period. Check the current date with the Personal Data Protection Center (PDPC).
• An insurer or HMO can apply for the ClinikEHR API, and a hospital chooses to link it.

What Is Universal Health Insurance, in Plain Words

Universal Health Insurance (UHI) is Egypt's compulsory health insurance system. A public authority finances it, and separate providers deliver care. These entries recur below:

• Claim: the bill a hospital sends a payer for the payer's share.
• Pre-authorization: a payer's approval before treatment. Its code is the PA code.
• HMO: the term this guide uses for the kind of insurer organization the ClinikEHR API calls an insurer or HMO. Egypt's Law uses other terms, explained below.
• Enrollee: a person an insurer or HMO covers.
• Governorate: one of Egypt's regions, and the unit of the UHI rollout.
• Controller and processor: a controller decides why personal data is used. A processor handles it for someone else.
• Sensitive personal data: a class of data the Law protects more strongly. Health data is in it.
• Licence and permit: two kinds of permission the Personal Data Protection Center issues. The Law defines a licence as lasting three years and as issued to a legal person, and a permit as temporary, for up to a year, and issued to a natural or legal person.
• TPA: a third-party administrator, the press term for a company that manages healthcare programmes.

This guide is general information, not legal advice. Ask an Egyptian lawyer about your own case.

What This Guide Could Read, and What It Could Not

Facts here were read in October 2026. Egypt's laws are published in Arabic, so the English in this guide is a plain summary, not a translation. This guide treats a bilingual copy of Law 151 hosted by Privacy Laws and Business, 2020 as an unofficial translation.

How Universal Health Insurance Works for a Hospital

What the Law created

Law No. 2 of 2018 promulgates the Universal Health Insurance system law. It was printed in Official Gazette issue 2 bis (b) on 11 January 2018 (Government of Egypt, 2018, the Gazette copy hosted by the Universal Health Insurance Authority). Article 1 of the promulgating law says it applies compulsorily to citizens resident in Egypt, and optionally to Egyptians working abroad and those living abroad with their families.

Article 2 of the Law itself calls the system compulsory and solidarity-based, with the family as the main unit of cover. It rests on separating financing from the provision of care, and it bars the Authority from providing treatment itself (Government of Egypt, 2018, the full text via a legal portal).

The three bodies

The same text creates three bodies (Government of Egypt, 2018):

• The Universal Health Insurance Authority (UHIA) manages and finances the system.
• The General Authority for Healthcare, which the State Information Service writes as the Egypt Healthcare Authority, provides services.
• The General Authority for Healthcare Accreditation and Regulation (GAHAR) accredits and supervises.

Where private hospitals fit

The Law lets private hospitals provide services under the system once they are qualified to the stated standards. Private primary-care units may do so if they are accredited and under contract with the Authority. The Authority finances services by contracting with providers. Public and private facilities must obtain accreditation within three years of their governorate coming into the system (Government of Egypt, 2018).

The UHIA's own provider pages list the papers needed to contract, including a price list of the services the facility offers (Universal Health Insurance Authority, 2026, the Authority's provider-contracting page, in Arabic). The pages read do not describe a claims data format. No UHI data-exchange specification for insurers or hospitals was found in the sources read.

This guide also does not say how UHI treats a patient who holds private cover. The sources read do not settle it. ClinikEHR is not connected to any UHI system.

Where the Rollout Stands, as the Government Describes It

The Law applies gradually by governorate, guided by a table of six phases (Government of Egypt, 2018). The table is not the schedule. It lists Minya in phase four, for example, while the government describes Minya as the first governorate of the second phase.

The State Information Service, reporting a Cabinet media-centre publication, gave this account in April 2026 (State Information Service, 2026):

• The system was launched in Port Said in 2019.
• Phase one covers six governorates: Port Said, Ismailia, Luxor, South Sinai, Suez and Aswan.
• The government says more than six million citizens are registered. That is the government's figure about its own system.
• Phase two will cover five governorates: Minya, Matrouh, Damietta, Kafr El Sheikh and North Sinai. Alexandria's inclusion is under consideration.

On 1 August 2026 the State Information Service reported that the board of the Egypt Healthcare Authority approved the handover of Minya healthcare assets. It called this a milestone in preparations for the Minya rollout (State Information Service, 2026). This guide gives no start date for any governorate and no completion year, because the sources read give different ones.

The text read is the 2018 enactment. In October 2025 the State Information Service, in a story bylined MENA, reported that the Health Minister had presented proposed amendments to the Law at a meeting chaired by the Prime Minister (State Information Service, 2025). Parlmany reported in August 2026 that a 2026 law amended it (see below). This guide read no amended text.

Private Insurers and the Financial Regulatory Authority (Market Context)

Who licenses and supervises insurers

Unified Insurance Law No. 155 of 2024 was printed in Official Gazette issue 27 bis (c) on 10 July 2024. Article 1 of the promulgating law gives the Financial Regulatory Authority (FRA), alone, the power to establish, license, supervise and control the bodies that carry on insurance. That includes its related activities (Government of Egypt, 2024, the Gazette file via a legal portal). The parliamentary news site Parlmany reported on 4 August 2026 (Parlmany, 2026) a separate 2026 law with the same number, which amends the UHI Law. This guide read no Gazette text of it. It is a different text from the 2024 law.

Two of the Law's categories are close to this guide's subject:

• A specialised medical insurance company is licensed by the FRA and limited to medical insurance.
• A company that manages healthcare programmes handles the administrative work on medical-insurance policies that insurers issue. It acts as a third party between the insurer and the client. It needs an FRA licence and a place in a register, and it may not carry insurance risk.

The Law's text does not use the words HMO or TPA. This guide treats both categories as market context only, and does not say that a company in either can apply to the ClinikEHR API or connect to it.

What the FRA's rules say about an administrator's claims role

The FRA's Decision No. 229 of 2025 sets rules for companies that manage healthcare programmes (Financial Regulatory Authority, 2025, an Internet Archive copy of the FRA's own file, which says the electronic copy is not valid for circulation, so check the printed Gazette). The rules describe such a company as a third party that reviews providers' claims before passing them to the insurer. It checks that the service is covered by the policy and pays providers within the period the contract sets. It must also keep clients' data confidential.

That is the FRA's description of a role. It does not say any such company connects to a hospital system, and it gives no claims-speed figure. This guide found no FRA rule on the format or timing of claims between a private insurer and a hospital.

What Law 151 of 2020 Says About Health Data

The Law and its regulations

The Personal Data Protection Law is Law No. 151 of 2020, issued on 13 July 2020. It applies to personal data of natural persons processed electronically in whole or in part (Government of Egypt, 2020, the Arabic text via a legal portal). Its executive regulations are Decision No. 816 of 2025 of the Minister of Communications and Information Technology. They were printed in Al-Waqa'i Al-Misriyya, the Egyptian Gazette, issue 244 (A), on 1 November 2025, and take effect the day after publication (Ministry of Communications and Information Technology, 2025, a copy in a law firm's library).

Health data is sensitive

The Law defines sensitive personal data to include data that reveals a person's mental, physical or genetic health. Collecting, moving, storing or processing it needs a licence from the Personal Data Protection Center (PDPC). Unless the law allows otherwise, it also needs the person's explicit written consent (articles 1 and 12, Government of Egypt, 2020). This guide does not say which licence category a hospital or an insurer needs, or whether any of them holds one.

Licences, permits and the officer

A controller or processor needs a licence or a permit from the PDPC to deal with personal data (articles 4 and 5 of the Law: article 4 for a controller, article 5 for a processor). The Law defines a licence for a legal person as lasting three years, renewable, and a permit as lasting up to a year (article 1). A legal entity that is a controller or processor must also appoint a data-protection officer and enter that person on the PDPC's register (article 8) (Government of Egypt, 2020). The regulations set fee tables. This guide states no fee and no tier.

The breach clock

A controller or processor that knows of a breach must tell the PDPC within 72 hours, or immediately where national security is involved. It must tell the affected person within three working days of the date of that report (article 7). The regulations add that the report goes through the PDPC's electronic portal or hotline (article 5) (Government of Egypt, 2020; Ministry of Communications and Information Technology, 2025).

A contract between parties may set another clock. The ClinikEHR data-protection addendum, which an insurer or HMO accepts before it receives patient information through the API, has its own 72-hour contract term. That is a contract clock, not Egyptian law, and it does not replace the Law's duty.

Moving or storing data outside Egypt

Article 14 prohibits transferring, sharing or storing personal data in a foreign country unless two things hold. The destination must offer protection not below the Law's, and the PDPC must have issued a licence or permit. The regulations say the PDPC assesses the destination, the person's consent is needed, and the PDPC keeps a list of countries it finds adequate (article 16). This guide could not retrieve that list or any PDPC guidance on transfers (Government of Egypt, 2020; Ministry of Communications and Information Technology, 2025).

Read articles 14, 15 and 16 whole. Article 15 begins "by way of exception to article 14" and lists limited cases where the data subject's explicit consent can justify a transfer to a country without the protection level in article 14. This guide does not say whether a licence or permit is still needed in those cases. That is a question for an Egyptian lawyer. The texts read contain no rule that private health data must stay in Egypt. The government's Cloud First Policy applies to government institutions and calls for localising data related to national security (Ministry of Communications and Information Technology, 2024).

For breaching the cross-border rules, article 42 sets imprisonment of at least three months and a fine of 500,000 to 5,000,000 pounds, or one of the two (Government of Egypt, 2020).

The grace period

The Law's promulgation says those it addresses must bring themselves into line within a year of the date the executive regulations were issued. The regulations carry a 1 November 2025 Gazette date. CMS reported in January 2026 that a strict reading points to enforcement from 1 November 2026, that the regulations were not made public until 25 December 2025, and that this late release created some uncertainty about whether the PDPC might treat the period as running to the end of 2026 (CMS, 2026). Clyde and Co reported full enforcement on 31 October 2026 (Clyde and Co, 2026).

No PDPC statement on the date could be read. Check the current date with the Personal Data Protection Center. By the time you read this the period may have ended. Licences and permits are required by the Law either way.

What Hospital and Insurer Teams Can Do Before Choosing a Claims System

None of these steps is a ClinikEHR feature, and this list is not a legal checklist. The steps turn the texts above into records you can show a regulator, a lawyer or a buyer.

Step 1: List each payer and how its claims travel

Make one row per payer, including the UHI Authority and each insurer you bill. Note the contract, the channel and the owner.

A mistake to avoid: assuming one process fits every payer.

Step 2: Decide who handles what, and ask a lawyer

For each flow of patient data, write down who decides why it is used and who only handles it. Those are the controller and the processor roles in Law 151. Ask an Egyptian lawyer to confirm which licences or permits apply, and note their end dates.

How you know it worked: a written opinion, or a current licence or permit, sits in your file for each role.

A mistake to avoid: assuming an exclusion applies. The Law lists its own exclusions, for example data kept for personal use and personal data held by the Central Bank of Egypt and the entities it supervises, apart from money-transfer and exchange companies. Whether any exclusion reaches your organization is a question for an Egyptian lawyer.

Step 3: Ask each claims-system vendor the same questions

These questions are for any vendor. This guide gives no answers for ClinikEHR.

How you know it worked: each question has a dated document in your file.

A mistake to avoid: accepting a promise in place of a licence.

Step 4: Write the breach plan with Egypt's clock

The hospital learns of a breach at hour 0. Within 72 hours it reports to the PDPC. Within three working days of that report it tells the people affected. Add any shorter clock your contracts set.

How you know it worked: a one-page plan names a person for each clock.

A mistake to avoid: using Egypt's clock for a contract notice, or the contract clock for a legal one.

How an Insurer or HMO and a Hospital Exchange Claim Data Through the ClinikEHR API

The ClinikEHR API is the API of the ClinikEHR app, and it reaches a hospital's records only through a connection the hospital approves for your organization. It sits on top of the hospital's HMO billing. It carries the claims the hospital submits, the pre-authorization requests it sends, and the enrollees and plans an insurer has agreed with it.

What the API does

• Enrollee lookup. An insurer or HMO can look up the members a hospital has recorded by insurance number. It reads the hospital's own record, so it is not live eligibility.
• Claim decisions. It can read a claim with its lines and decide it line by line. It cannot approve more than was billed, and a decision moves no money.
• Pre-authorization. It can approve a request with a PA code or deny it with a reason. A request is decided once.
• Payment advices. It can send the hospital a message saying what was paid. Hospital staff record the money themselves.

Here is an illustrative claim file. The amounts are invented, in Egyptian pounds, and the table is not data.

Who can use it

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data, and a ClinikEHR reviewer decides, with no stated timeline. Two Enterprise requirements form a pair. The insurer's or HMO's developer workspace is on the Enterprise contract plan, which ClinikEHR sets on request. The hospital is on the Enterprise plan, with API access switched on.

The hospital's owner sets Insurance to Outside the US under Settings, General. It is a setting, not a place. The owner then approves the connection and records a legal basis, and an owner or manager links the insurer. The hospital's owner generates a one-time connection code and hands it to the insurer or HMO. The insurer or HMO needs its own approved workspace first, because a reviewer decides that separately. The hospital chooses one submission channel per insurer. If it chooses the ClinikEHR API, a submitted claim becomes available to the linked organization.

The organization accepts a data-protection addendum with Bettar Platforms, Inc. It has no Egypt-specific terms. An insurer's duties under Law 151 stay its own.

The insurance routes have no sandbox data, so trying them needs a live key and a linked hospital. This is a private link between one hospital and one insurer or HMO. It is not a route to the Universal Health Insurance Authority or to any Egyptian system.

How you know it worked

• The hospital's owner has approved your connection with the insurance permissions.
• An owner or manager has linked your organization to the hospital's record of your insurer.
• Your organization's connection list shows the hospital and the permissions granted.

The route-by-route detail is in the HMO claims tutorial and the pre-authorization guide. Both are written for Nigeria. See also the API documentation and the insurance routes page.

What Is Still Unsettled

Re-check these before you rely on this guide. Each could change.

• The grace period under the Personal Data Protection Law. Its end date, and whether it was extended, were not confirmed by the PDPC.
• The PDPC's rules. Its fees, licence tiers, guidance and list of adequate countries could not be read.
• The text of the Laws. Several articles were read in copies, Decision 229 of 2025 was read in an Internet Archive copy of the FRA's file, and the UHI Law as read is the 2018 enactment.
• The rollout. Official start dates for the second-phase governorates were not found.
• The FRA. Daily News Egypt reported on 11 July 2026 that the FRA extended a compliance deadline for healthcare administrators to 10 July 2027 (Daily News Egypt, 2026). The FRA's own announcement could not be read.
• Court judgments. None were searched.

Mistakes to Avoid

2. Confusing the two Law 155s. One is the insurance law of 2024. The other is a 2026 change to the UHI Law reported by Parlmany.
3. Treating consent as the whole answer on a transfer abroad. Article 14 sets a protection-level and licence-or-permit condition, and article 15 lists the limited cases where consent can matter. Read both with a lawyer.
4. Calling an enrollee lookup a cover check. It is not live eligibility.

Frequently Asked Questions

What is Universal Health Insurance in Egypt, and which law created it?

Universal Health Insurance (UHI) is created by Law No. 2 of 2018, printed in Official Gazette issue 2 bis (b) on 11 January 2018. It is compulsory and solidarity-based, and it applies to citizens resident in Egypt, gradually by governorate. The Law separates financing from the provision of care. It creates the Universal Health Insurance Authority, the General Authority for Healthcare and the General Authority for Healthcare Accreditation and Regulation.

How far has the Universal Health Insurance rollout gone?

As the State Information Service described it in April 2026, phase one covers six governorates and the system was launched in Port Said in 2019. Phase two is planned for five governorates, with Alexandria under consideration. On 1 August 2026 the service reported preparations for the official rollout in Minya. This guide gives no start date for any governorate and no completion year, because the sources read differ.

Where do private insurers and TPAs sit beside Universal Health Insurance?

The Financial Regulatory Authority alone licenses and supervises the bodies that carry on insurance under Law No. 155 of 2024. That Law also covers companies that manage healthcare programmes, which handle policy administration as a third party and may not carry insurance risk. This guide treats them as market context. It does not say that any company in those categories can connect to the ClinikEHR API, and it does not say how UHI treats a patient with private cover.

Is health data sensitive under Egypt's data-protection law?

Yes. Law No. 151 of 2020 defines sensitive personal data to include data that reveals mental, physical or genetic health. Handling it needs a licence from the Personal Data Protection Center and the person's explicit written consent, unless the law allows otherwise. This guide does not say which licence category any hospital or insurer needs. This is general information, not legal advice.

When must a data breach be reported in Egypt?

Under article 7 of Law No. 151 of 2020, a controller or processor must tell the Personal Data Protection Center within 72 hours of knowing of a breach, or immediately if national security is involved. It must tell the affected person within three working days of the date of the report. The regulations say the report goes through the Center's electronic portal or hotline. A contract between parties may set a different clock.

Can health data be stored or processed outside Egypt?

Article 14 of Law No. 151 of 2020 prohibits transferring, sharing or storing personal data in a foreign country. It allows this only if the destination offers protection not below the Law's and the Center has issued a licence or permit. Article 15 lists limited cases where explicit consent can justify a transfer to a country without that protection level, and this guide does not say how it interacts with the licence-or-permit condition. The texts contain no rule that private health data must stay in Egypt. Take legal advice before you move data.

How can an insurer or HMO and a hospital exchange claim and pre-authorization data through the ClinikEHR API?

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data, and a ClinikEHR reviewer decides. Its developer workspace needs the Enterprise contract plan, and the hospital must be on Enterprise with API access switched on. The hospital's owner sets Insurance to Outside the US and approves the connection, and an owner or manager links the insurer. The API then lets the insurer look up the members the hospital recorded, decide claims line by line, approve or deny pre-authorizations and send payment advices. No money moves through it, and the insurance routes have no sandbox data.

Is ClinikEHR connected to Universal Health Insurance or approved in Egypt?

No. ClinikEHR is not a UHI integration and is not connected to the Universal Health Insurance Authority, the Egypt Healthcare Authority, the General Authority for Healthcare Accreditation and Regulation, the Financial Regulatory Authority or the Personal Data Protection Center, or to any other Egyptian system. No regulator in Egypt has approved it. This guide makes no claim about ClinikEHR in Egypt, and it does not say ClinikEHR meets any rule described here. Ask any vendor for its own documents, using the questions in this guide.

Conclusion

Egypt's texts set the frame for any claims link: the UHI Law, the Unified Insurance Law and the Personal Data Protection Law. Some points are unsettled, and some belong with an Egyptian lawyer.

An API can carry claim and pre-authorization data between an insurer or HMO and a hospital. It does not answer those texts for you. To ask how access to the ClinikEHR API works, contact the team. The pricing page lists the plans, including Enterprise.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• ClinikEHR API documentation
• Insurance for HMOs and insurers (API documentation)

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.