Ghana: Building a Health Insurance Claims Integration for Insurers and Hospitals (2027 Developer Guide)

In Ghana, the law requires a resident to belong to the National Health Insurance Scheme (NHIS), and a member may also hold private cover. A hospital can therefore serve patients who hold both kinds of cover. A claims link between an insurer and a hospital should start from Ghana's own legal texts. This guide sets them out, then sketches the ClinikEHR API (api.clinikehr.com). ClinikAPI (clinikapi.com) is a different product, with its own site, built on FHIR R4, a health-data standard. ClinikEHR is not an NHIS integration. This is general information, not legal advice.

Quick Answer

Read how Ghana's public scheme, private-insurance rules and data-protection law fit together before an insurer's claim data is linked to a hospital's.

• The National Health Insurance Act, 2012 (Act 852) created the National Health Insurance Authority (NHIA). The NHIA runs the NHIS, which this guide also calls the Scheme, and it registers and supervises private health insurance schemes.
• The Act requires a resident to belong to the Scheme, and a member may hold private cover too, so a hospital can serve patients with both kinds.
• Under the Data Protection Act, 2012 (Act 843), health is special personal data, and a data controller must register with the Data Protection Commission (DPC). The Act sets no number of hours for a breach notice.
• A replacement Bill is only a proposal, and some points are unsettled. This guide says which.
• Applying for the ClinikEHR API is open to an insurer or HMO, and linking is the hospital's choice. For the API, the insurer's developer workspace needs the Enterprise contract plan, and the hospital needs the Enterprise plan with API access on. ClinikEHR is not connected to any NHIS or NHIA system.

What Are the NHIS and Private Health Insurance, in Plain Words

The NHIS is Ghana's public health insurance scheme, and the NHIA is the public body that runs it. Private health insurance sits beside it. Act 852 names two kinds of private scheme, commercial and mutual. These terms recur below:

What This Guide Could Read, and What It Could Not

Every source below was read on 15 October 2026. Where the sources leave a point open, this guide says so instead of picking an answer.

How the National Health Insurance Scheme Works for a Hospital

What the Act and the Authority do

Act 852 received assent on 31 October 2012 and was gazetted on 14 November 2012. It creates the NHIA, the Scheme, a National Health Insurance Fund and private health insurance schemes. The NHIA's functions include running the Scheme, registering members, supervising private schemes, granting credentials to providers, and receiving, processing and paying their claims (section 3, Government of Ghana, 2012). A resident of Ghana shall belong to the Scheme (section 27(1)), and membership is by registration (section 27(3)). Section 27(2) adds:

A member of the Scheme may belong to a private health insurance scheme.

Government of Ghana, 2012, section 27(2)

So a patient can reach a hospital holding both kinds of cover.

Credentials, claims and payment

A provider serves Scheme members only after the NHIA grants it credentials and the two sign an agreement (section 32). Section 36 sets the claims rule. The provider submits a claim within a period the NHIA determines. The NHIA must reject a claim with a material error and tell the provider, with a reason, within one month of receiving it, and the provider may fix the error and resubmit. It pays at least a portion of a claim's face value after a period the Minister sets (Government of Ghana, 2012). All of this concerns Scheme claims, not a private insurer's.

How Scheme claims travel

The NHIA publishes a specification for how a provider's hospital system sends Scheme claims electronically. It is version 8.6, dated 2018, and marked work in progress. It describes a Claims Processing Centre inside the NHIA, a batch claim file, three levels of message verification and a feedback file. It also says a provider's own software must first be verified through accreditation and production tests (NHIA, 2018). The NHIA has a mobile app too, called Claim-it, which its policy describes as meant to manage and transmit NHIS claims data (NHIA, 2026).

No source read describes today's process in one place, so treat the 2018 document as dated context and ask the NHIA for its current method. The NHIA's 2024 Annual Report gives its own figures: electronic claims submission at 99.9% in 2024, 18.47 million active members and 5,483 active healthcare providers (NHIA, 2026). This guide did not audit them.

ClinikEHR is not an NHIS integration. It is not connected to any NHIA system, including Claim-it, the e-claims interface and the Claims Processing Centre. It makes no claim to produce the NHIA's claim file or to have passed its verification.

Private Health Insurance Beside the Scheme

Nobody may operate a private health insurance scheme unless it is registered with the NHIA and holds a licence (section 56(2)). A licence lasts two years from issue (section 57(1)), can be renewed for further two-year periods (section 57(2)), and stays in force while a renewal application is pending (section 57(4)). Operating without one is an offence (section 63) (Government of Ghana, 2012). The NHIA's private-insurance page prints a licence period from 1 July 2024 to 30 June 2026. That period had ended when this guide was read, and the page did not say whether licences were renewed (NHIA, 2026).

The NHIA's November 2020 guidelines name three kinds of private policy. Duplicate cover pays for services the NHIS benefit package already includes. Complementary cover pays all or part of the cost of benefits the NHIS does not cover. Supplementary cover is for services the NHIS does not cover. The same guidelines say a private scheme may use a provider only if the relevant agency has licensed it and the NHIA has credentialed it. The policy kinds come from section 1.4 and this rule from section 2.3 (NHIA, 2020). A facility chooses whether to seek credentials for the Scheme, for private schemes or for both (NHIA, 2026).

Who regulates whom

The NHIA's guidelines say it registers, licenses and supervises private schemes, intermediaries and third-party administrators (section 1.1). They also describe roles for third-party administrators and loss adjusters in processing and vetting claims (sections 4.1.1 and 2.4.1.2, NHIA, 2020). Both appear here as market context only.

The National Insurance Commission (NIC) regulates Ghana's insurance industry in general under the Insurance Act, 2021 (Act 1061) (National Insurance Commission, 2026). It has a seat on the NHIA's Board and on its Private Health Insurance Oversight Committee (sections 4(1) and 11(1) of Act 852). Section 75 of Act 852 applies listed provisions of the Insurance Act, 2006 (Act 724) to private commercial schemes (Government of Ghana, 2012). The NIC says Act 1061 replaced Act 724 (National Insurance Commission, 2026).

The text of Act 1061 could not be read for this guide, so it cannot say how that Act maps onto section 75. The sources read do not say that the NIC licenses private health insurance schemes. Ask a lawyer which body's rules bind a given scheme.

What the NHIA Reports About Claims Between Private Schemes and Providers

The NHIA's 2024 Annual Report lists this among the private sector's challenges. HSP is the report's short form for a health service provider.

Poor claims reconciliation between schemes and HSPs.

NHIA, 2026, section 7.7

The report also says two claims verification exercises were run at selected providers. A comparison of scheme and provider data was made, and schemes were directed to reconcile discrepancies and settle outstanding claims (section 7.5).

What the Data Protection Act, 2012 Says About Health Data

The Act and the Commission

Act 843 received assent on 10 May 2012 and was gazetted on 18 May 2012. Section 99 leaves the date it comes into force to the Minister (Government of Ghana, 2012). The DPC says the Act has been in effect since 16 October 2012 (DPC, 2026). The Act creates the Commission, whose functions include monitoring compliance, investigating complaints and keeping the Data Protection Register (sections 1 and 3).

Health is special personal data

Section 96 defines special personal data to include information about a person's physical, medical or mental health or mental condition, or DNA. Section 37(1) says nobody may process personal data about health unless the Act provides otherwise. Under section 37(2), a data controller may process special personal data where the processing is necessary or the data subject consents. Section 37(6)(e) presumes processing for medical purposes to be necessary when a health professional carries it out under a duty of confidentiality to the patient. Section 96 defines a health professional as a registered medical practitioner, a recognised traditional healer or another registered provider of health services (Government of Ghana, 2012).

The sources read do not say how an insurer or a software provider fits under section 37(2) or the presumption, and this guide does not guess. It does not say which ground in section 20, on processing without prior consent, suits any party either.

Registration

Section 27(1) says a data controller who intends to process personal data shall register with the Commission. Section 53 says an unregistered controller shall not process personal data, and section 56 makes processing without registering an offence. An application must say whether the applicant holds special personal data and must give the name or description of the country to which it may transfer the data (section 47(1)). Registration is renewed every two years (section 50) (Government of Ghana, 2012).

The Act speaks of data controllers, while the DPC's registration page says all entities involved in processing personal data must register and lists data processors among them (DPC, 2026). This guide does not say whether any hospital, insurer or software provider is registered.

Security, processors and contracts

A controller must take appropriate, reasonable technical and organisational measures against loss, damage and unlawful access (section 28(1)). A processor may act only with the controller's prior knowledge or authorisation and must treat the data as confidential (section 29(1)). Under section 30(2), a written contract governs processing by a processor. Under section 30(4), where a processor is not domiciled in Ghana, the controller must ensure that it follows Ghana's relevant laws (Government of Ghana, 2012).

Telling the Commission about a compromise

Section 31 covers unauthorised access to personal data. Where there are reasonable grounds to believe it has happened, the controller, or a third party processing under its authority, notifies the Commission and the data subject. Subsection (2) sets the timing:

The notification shall be made as soon as reasonably practicable after the discovery of the unauthorised access or acquisition of the data.

Government of Ghana, 2012, section 31(2)

The Act gives no number of hours, and the DPC's FAQ says to notify it as soon as possible (DPC, 2026). Clocks in other texts do not discharge that rule. A contract can set its own notice period, and a draft Bill would add a fixed one. The Cybersecurity Act, 2020 (Act 1038) has its own incident-reporting duties, to a different body and measured in hours. Section 39 applies to owners of systems the Minister designates as critical information infrastructure under section 35. Section 47(5) applies to a person in charge of an institution, and the Act's interpretation section does not define institution (Government of Ghana, 2020). This guide found no source saying a hospital or insurer system has been designated, and it does not say whether a hospital or insurer is an institution under section 47(5). Ask a lawyer.

Sending data abroad

This guide could find no section of Act 843 on transfer abroad that restricts sending personal data out of Ghana. The DPC's guidelines cite section 28(3b) under cross-border transfer, so ask a lawyer. The Act does reach a controller not established in Ghana that uses a processor carrying on business there (section 45(1)(b)) (Government of Ghana, 2012).

The DPC's July 2025 guidelines list cross-border transfer among a controller's obligations (DPC, 2025). Its FAQ advises against hosting data in a country that does not regulate the processing of personal information (DPC, 2026). Both are the DPC's view, not a section of the Act. Ask a lawyer what they mean in practice.

Two sections to read with care

Section 62 sits under the heading Exemptions. It says personal data about a person's physical or mental health shall not be disclosed except where the law requires it (Government of Ghana, 2012). How that sits beside consent-based sharing with an insurer is not settled by the sources read. Section 63 says the Act does not apply to processing for the protection of the public against loss or malpractice in providing services such as banking and insurance. This guide applies neither section to anyone. Take legal advice before relying on either.

What Is Proposed, and What Is Only Guidance

Act 843 is the Act this guide found in force as of 15 October 2026. The DPC has published a draft Data Protection Bill, 2025, which would repeal it and set up a Data Protection Authority. The draft would add rules on moving health records out of Ghana and a fixed hour limit for breach notice (DPC, 2025). It is a draft, not law. As of 15 October 2026, web searches found no report that it has been passed, and Parliament's own record was not opened. Check that record and the DPC's documents page. The DPC's guidelines and FAQs are guidance, not the Act.

Other Health-Sector Rules a Hospital Meets

The Health Institutions and Facilities Act, 2011 (Act 829) sets up the Health Facilities Regulatory Agency (HeFRA). HeFRA licenses and monitors public and private health care facilities (Government of Ghana, 2011, text hosted by the WHO). A licensee must submit health service data to the Ministry every three months, or as the Minister directs in writing (section 20).

Five Steps Before You Link an Insurer and a Hospital

Use these steps to organise your own paperwork. They are not ClinikEHR features and not a legal checklist, because the texts above set your duties.

Step 1: Map your payers and their claim routes

List every payer your hospital bills: the Scheme, each private scheme and any other. For each, note who sets the claim route.

What you need: your signed agreements and the NHIA's current documents.

How you know it worked: each payer has a named route, backed by a document.

A mistake to avoid: sending a private scheme's claim down the Scheme's route.

Step 2: Check credentials and licences

Confirm that your facility holds credentials for each kind of cover it accepts. Look up each private scheme's licence status with the NHIA, and record the date you checked.

What you need: your HeFRA certificate and the NHIA's credentialing page.

How you know it worked: each payer entry shows a credential or licence status with a date.

A mistake to avoid: trusting a licence list whose printed period has ended.

Step 3: Settle your own DPC registration

List each role you play with personal data: controller, processor or both. Compare the list with sections 27 and 53 of Act 843 and the DPC's registration page, then ask a lawyer to confirm in writing.

What you need: your data flows, and who decides the purpose of each.

How you know it worked: you hold a registration record, or a lawyer's written opinion on why none is needed.

A mistake to avoid: assuming a vendor's registration settles yours, when section 27(1) puts the duty on each controller.

Step 4: Put the same questions to every claims-software vendor

This guide gives no answers for ClinikEHR.

What you need: written replies from the vendor.

How you know it worked: you can open a file and find a written, dated reply to each question.

A mistake to avoid: treating a friendly answer on a call as a reply.

Step 5: Write the breach plan

Act 843 sets no hour count. Write down who tells the Commission and the data subject, add whatever notice periods your contracts require, and ask a lawyer whether the Cybersecurity Act, 2020 adds a report to another body. Keep contract clocks apart from the Act's rule.

What you need: the Commission's current breach-reporting channel, and your processor contracts.

How you know it worked: someone is named against every notice you might have to give.

A mistake to avoid: importing a deadline from a draft, a contract or a foreign law and treating it as Ghana's rule.

What the ClinikEHR API Does for an Insurer and a Hospital

Treat this section as a map, not a manual. The ClinikEHR API works through a hospital's own ClinikEHR account and sits on the hospital's HMO billing.

What it does

• Enrollee lookup. A linked insurer or HMO can search by insurance number. The search reads an enrollee record the hospital already holds.
• Claim decisions. The insurer reads a claim and decides it line by line, approving, adjusting or declining each line. It cannot approve more than the hospital billed. The decision moves no money, and the API decides nothing on the insurer's behalf.
• Pre-authorization. An approval needs a PA code, a denial needs a reason, and each request is decided once.
• Payment advices. An advice is a message to the hospital saying what the insurer paid. It changes no claim, and hospital staff record the money themselves.

This claim file is illustrative. Its lines and cedi amounts are invented, and it is not data.

Who can use it, and what each side needs

Two approvals sit behind any link, and neither replaces the other. The first belongs to ClinikEHR. An insurer or HMO applies for access to the Insurer claims, authorizations and enrollees kind of data, and a reviewer decides. The docs state no timeline. This guide does not say which Ghanaian bodies a ClinikEHR reviewer would treat as an insurer or HMO. The second belongs to the hospital, whose owner decides whether to connect that organization at all.

The access rules also pair two Enterprise requirements. The insurer's developer workspace must be on the Enterprise contract plan. A workspace moves from Sandbox to a paid plan by request, and there is no self-serve checkout yet. ClinikEHR sets the plan once the workspace is approved. The hospital, for its part, must hold the Enterprise plan and have API access turned on.

The hospital's owner must also choose Outside the US for the Insurance setting (Settings, General) before the insurance routes will serve that hospital. It is a setting in the app, not a place on the map. After that, the owner approves the connection and records a legal basis for sharing, which is the lawful reason the information is shared. An owner or manager then links your organization to the hospital's record for your insurer. A hospital cannot simply invite an insurer, because each insurer needs its own approved workspace first. Billing insurers inside ClinikEHR is a separate matter, and it starts when the hospital's owner sets Insurance to Outside the US.

A test key cannot try the insurance routes, because the sandbox holds no insurance data. Before its key can carry patient-data permissions, the organization must accept the data-protection addendum, a contract with Bettar Platforms, Inc. The addendum has no Ghana-specific terms, and its notice periods are contract terms, not Ghanaian law. An insurer's duties under Act 843 remain its own.

What results is a private arrangement between one hospital and one insurer or HMO, and it is not a route to the Scheme. This guide makes no claim of approval, registration, certification, hosting or customers for ClinikEHR in Ghana. It does not say that ClinikEHR meets any rule described above.

How you know it worked

You know a link works when the hospital's owner has approved a connection for your organization with a legal basis recorded, and your connection list returns that hospital.

The Nigeria guides on the HMO claims integration and the pre-authorization API cover the routes one by one, while this section is only an outline. Ghana's NHIA is a different body from Nigeria's NHIA. The API documentation and the insurance routes page list every route.

Mistakes to Avoid

1. Repeating the DPC's stop-order wording. The registration page says the DPC can issue a stop order to an unregistered organization, but Act 843 names an enforcement notice (section 75) and an offence (section 56).
2. Mixing up credentials and accreditation. Act 852 grants credentials to a provider or facility (section 32). The 2018 specification uses accreditation for the tests of a provider's software.
3. Putting a cedi value on a fine. Act 843 states fines in penalty units, and no source read for this guide gives a penalty unit's cedi value.
4. Mixing up the DPC's web addresses. The DPC's website is dpc.gov.gh, but its guidelines print an e-mail address at dataprotection.org.gh. Confirm the current channel before you send a notice.
5. Reading the Exemptions sections as a permission. This guide applies neither section 62 nor section 63 to insurers or to anyone else. Ask a lawyer first.

Frequently Asked Questions

What is the National Health Insurance Scheme, and who runs it?

The Scheme is run by the National Health Insurance Authority (NHIA), which the National Health Insurance Act, 2012 (Act 852) created. The NHIA registers members, grants credentials to providers, and receives, processes and pays their claims. It also registers and supervises private health insurance schemes. A resident of Ghana is required to belong to the Scheme, and a member may also belong to a private scheme.

Can a patient have the Scheme and private health insurance at the same time?

Yes. Section 27(2) of Act 852 says a member of the Scheme may belong to a private health insurance scheme. The NHIA's 2020 guidelines name three kinds of private policy. Duplicate cover is for services the Scheme's benefit package already includes. Complementary cover is for all or part of the cost of benefits the Scheme does not cover. Supplementary cover is for services the Scheme does not cover. The guidelines also say a private scheme may use a provider only if the relevant agency has licensed it and the NHIA has credentialed it.

Who regulates private health insurance in Ghana, the NHIA or the National Insurance Commission?

Act 852 names the NHIA as the body that registers and licenses private health insurance schemes, and the NHIA calls itself their regulator. The National Insurance Commission regulates the insurance industry in general under the Insurance Act, 2021 (Act 1061), and has a seat on the NHIA's Board. Section 75 of Act 852 applies listed provisions of the older Insurance Act, 2006 (Act 724) to private commercial schemes. This guide could not read the text of Act 1061, so it does not say how the two Acts connect. Ask a lawyer which body's rules bind a given scheme.

Must an insurer or hospital register with the Data Protection Commission?

Section 27(1) of the Data Protection Act, 2012 (Act 843) says a data controller who intends to process personal data shall register with the Commission. Section 53 says an unregistered controller shall not process personal data, and section 56 makes failing to register while processing an offence. The Act speaks of controllers, and the DPC says processors must register too. This guide does not say whether any hospital, insurer or software provider is registered. Ask a lawyer how the duty applies to you.

How soon must a data breach be reported in Ghana?

Section 31 of Act 843 says the controller, or a third party processing under its authority, notifies the Commission and the data subject as soon as reasonably practicable after discovery. The Act gives no number of hours, and the DPC's FAQ says to notify it as soon as possible. A draft Bill would add a fixed hour limit, but it is not law. A contract can set its own notice periods, and those do not replace a notice to the Commission. The Cybersecurity Act, 2020 has separate incident-reporting duties in sections 39 and 47, so ask a lawyer whether they apply to you.

Can health data be hosted or sent outside Ghana?

This guide could find no section of Act 843 on transfer abroad that restricts sending personal data out of Ghana. A registering controller must give the name or description of the country to which it may transfer data (section 47(1)). A controller must also make sure a processor that is not domiciled in Ghana follows Ghana's laws (section 30(4)). The DPC's guidelines list cross-border transfer among obligations, and its FAQ advises against hosting data in a country that does not regulate the processing of personal information. A draft Bill would add rules for health records, but it is not law. Ask a lawyer what applies to you.

How can an insurer or HMO and a hospital exchange claim and pre-authorization data through the ClinikEHR API?

Access has two gates. For the insurer or HMO, a ClinikEHR reviewer must approve an application for the Insurer claims, authorizations and enrollees kind of data. Its developer workspace must also be on the Enterprise contract plan. For the hospital, the Enterprise plan and API access are both needed. Its owner must set Insurance to Outside the US and approve the connection, and an owner or manager must link the insurer. After that, the insurer can look up enrollees the hospital has recorded and decide each line of a claim. It can also approve or deny pre-authorizations with a PA code or a reason, and send payment advices. The API moves no money, and a test key cannot try insurance because the sandbox holds none of its data.

Is ClinikEHR connected to the NHIS or the NHIA?

No. ClinikEHR is not an NHIS integration, and it is not connected to any NHIA system, including Claim-it, the NHIA's e-claims interface and its Claims Processing Centre. This guide claims no approval, registration, certification, hosting or customers for ClinikEHR in Ghana, and it does not say that ClinikEHR meets any rule described here. Put the same questions to every vendor and ask for documents.

Conclusion

Ghana's texts frame any claims link between an insurer and a hospital. The NHIA runs the Scheme and supervises private schemes. Act 843 treats health as special personal data and asks controllers to register.

A shared API can move claim and pre-authorization data between an insurer or HMO and a hospital, yet the legal questions above stay with each party and its lawyer. For questions about access, talk to the ClinikEHR team. Hospital plans are on the pricing page.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)
• Building a Health-Insurance Startup for Emerging Markets: What Your Hospital Integration Must Do (2027 Developer Guide)

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.