Uganda: How Health Insurers and Hospitals Can Go Digital on Claims (2027 Guide)

If you handle medical claims in Uganda, you work in a loop between hospitals and insurers or health membership organisations (HMOs). The Insurance Regulatory Authority has issued directives on that loop, and a data protection law covers the health data inside it. This guide reads those texts first, then outlines the ClinikEHR API (api.clinikehr.com). ClinikAPI (clinikapi.com) is a different product, built on FHIR R4, a health-data standard. ClinikEHR is not connected to any Ugandan national system. This is general information, not legal advice.

Quick Answer

Check Uganda's own rules first, because a claims API changes none of your legal duties.

• The Insurance Regulatory Authority of Uganda (IRA) licenses insurers and HMOs under the Insurance Act (Cap. 191, short for chapter 191). In a release of 1 July 2026 the IRA described a national health insurance scheme as a Bill still waiting to return to Cabinet.
• The IRA's Directives on Medical Insurance Claims, in force since 30 January 2025, set out the steps of a medical claim between a hospital and an insurer or HMO.
• The Data Protection and Privacy Act (Cap. 97) treats health status and medical records as special personal data, the Act's name for protected data. Its 2021 Regulations require registration with the Personal Data Protection Office (PDPO) unless an exemption applies. They ask for breach notice immediately, with no hour count.
• An insurer or HMO can apply to use the ClinikEHR API, and a hospital decides whether to link it. Each side has its own Enterprise requirement.

What Is a Health Membership Organisation, in Plain Words

Uganda's Insurance Act defines a health membership organisation, or HMO, as a body that funds health care for people who join it as members (Government of Uganda, 2017). You will meet these terms often:

• Member and policyholder: a person an HMO covers is a member. A person an insurer covers is a policyholder. The ClinikEHR API says enrollee for either.
• Service provider: the Directives' word for a hospital or clinic that treats them.
• Service level agreement (SLA): the contract between an insurer or HMO and a service provider.
• Claim: the bill a hospital sends for the insurer's or HMO's share of the cost.
• Pre-authorization (PA): approval from the insurer or HMO for care, asked for before or during treatment. The PA code is the proof of it.
• Tariff: the price list agreed with an insurer or HMO.
• Special personal data: the privacy Act's name for a protected class of data that includes health records.
• Data controller and data processor: a controller decides why and how personal data is used. A processor handles it for a controller.

Sources and Limits of This Guide

Every legal and market fact here was read in October 2026. Where the texts leave a point open, this guide says so. It does not guess.

How Health Insurance Is Regulated in Uganda

The IRA and the Insurance Act

The Insurance Regulatory Authority of Uganda (IRA) regulates insurance business. The Insurance Act continues the IRA in existence, sets its aims and lets it issue directives. Those aims include a sound, fair and stable insurance sector, and protection for policyholders. A licensee that fails to follow a directive is liable to a fine (Government of Uganda, 2017).

The Act was passed as Act 6 of 2017. A Revised Edition of the Principal Laws of Uganda took effect on 1 July 2024 (Ministry of Justice and Constitutional Affairs, 2024). The IRA now cites the Act as Cap. 191 (IRA, 2025).

Insurers, HMOs and administrators

The Act licenses an HMO separately from an insurer. An HMO licence covers health benefit plans for people resident in Uganda only (Government of Uganda, 2017). The Act also defines a third party administrator as a person who provides services to an HMO or a licensed insurer in running its plans or policies (Government of Uganda, 2017). This guide mentions that only as background on the market.

Licensed insurers write medical cover too (clause 5, IRA, 2025).

What the IRA's yearly lists show

Each year the IRA announces the industry players it has authorised. Its announcements count three HMOs for 2022 (IRA, 2022), two for 2023 (IRA, 2023) and two for 2024 (IRA, 2024). They count one for 2025 (IRA, 2025) and one for 2026 (IRA, 2026). The IRA's 2026 list of authorised HMOs has one entry (IRA, 2026).

A count of HMOs does not measure medical insurance as a whole, because licensed insurers write medical cover as well.

A national scheme is still a proposal

The IRA's release of 1 July 2026 reports that talks on a National Health Insurance Scheme had reached Cabinet level. It says the IRA and other stakeholders were awaiting the re-tabling of the Bill to Cabinet (IRA, 2026). This guide found no source showing a national scheme in force, so it describes none. Check the IRA and Parliament for the current position.

Unsettled: approving hospitals for insurers' panels

In a circular of 20 December 2024, the IRA proposed a framework to approve hospitals for inclusion on insurers' panels. The paper attached to it calls itself a concept paper. The circular asked insurers and HMOs for their provider lists by 15 January 2025 (IRA, 2024). A circular of 18 June 2025 says a deadline of 30 May 2025 for prequalification has been lifted until further notice (IRA, 2025). An IRA news item of August 2025 reports a meeting with medical service providers that followed some providers' discontentment over a guideline requiring them to be prequalified by the IRA (IRA, 2025). This guide found no IRA text after that item. Whether any hospital approval rule applies is therefore unsettled. Ask the IRA, and do not assume either way.

How a Medical Claim Moves Between a Hospital and an Insurer or HMO

What the Directives are

The IRA's Directives on Medical Insurance Claims came into force on 30 January 2025. They apply to every licensed insurer that provides medical insurance and to the HMOs the IRA regulates (clause 5, IRA, 2025). They call a hospital a service provider. They also tie each claim submission to the service level agreement.

Why the IRA says it acted

The IRA says medical establishments customarily defer their claims and gather them before sending them on. That leaves the insurer or HMO with a backlog (IRA, 2025).

The Directives also list aims. These include processing medical claims accurately and consistently, and helping to detect and prevent fraudulent claims (clause 4, IRA, 2025). They are the regulator's aims. This guide promises neither of them for any system.

The steps the Directives describe

Clause 7 (IRA, 2025) sets out processes to be followed in processing medical claims. It says they include, but are not limited to, the following steps. In plain words:

1. Pre-authorizations needed while treatment runs must be available round the clock.
2. Each physical claim form is acknowledged by marking it received and dating it.
3. Claims data is coded with ICD codes, the standard diagnosis codes.
4. Claims are examined against the pricing agreed with the facility, to separate legitimate claims from fraudulent ones.
5. If fraud is reasonably suspected, the insurer or HMO may investigate further.
6. The claims manager approves a schedule of payable and non-payable claims, and the finance team pays.
7. The insurer or HMO tells the service provider about the payment and sends a remittance schedule, which is the payment notice.
8. A reconciliation window of up to fourteen working days, in which payments are matched to claims, follows payment. A rejected claim is communicated to the service provider during payments, and the same window applies.

Two lines that are easy to misread

The first is the round-the-clock line in step 1. Clause 7(a) says:

The pre-authorizations from the insurer required during the running of medical services must be available 24 hours in a day.

IRA, 2025, clause 7(a)

That is a rule about availability. This guide does not read it as a deadline for a decision.

The second is thirty working days. Clause 6 (IRA, 2025) says new service level agreements must state a claims settlement period of thirty working days from the date the insurer or HMO receives a claim. The clause governs those agreements. This guide does not read it as a rule that every claim must be paid in that time.

Clause 9 lets an aggrieved party complain to the IRA's Complaints Bureau if an insurer or HMO misses the agreed timelines. Clause 10 makes a licensee that fails to comply liable to a fine under the Act. Clause 8 sets a review at least every five years, so check for a newer version (IRA, 2025).

What the Data Protection and Privacy Act Says About Health Data

The Act and the PDPO

The Data Protection and Privacy Act, 2019 (Act 9 of 2019) is now Cap. 97. It applies to anyone who collects, processes, holds or uses personal data within Uganda. It also applies to anyone outside Uganda who does so with personal data relating to Ugandan citizens (section 1, Government of Uganda, 2019).

Section 4 sets up a Personal Data Protection Office (PDPO) under the National Information Technology Authority - Uganda (NITA-U). Section 5 makes it responsible for enforcing the Act and keeping a data protection and privacy register (Government of Uganda, 2019).

The Act names three roles: a data collector, a data controller and a data processor (section 2, Government of Uganda, 2019). Which role an insurer, an HMO, a hospital or a software supplier holds depends on the facts. The sources read do not settle it, and this guide does not assign a role to ClinikEHR.

Health data is special personal data

Section 9(1) bars collecting or processing several kinds of personal data, health among them:

A person shall not collect or process personal data which relates to [...] health status or medical records of an individual.

Government of Uganda, 2019, section 9(1)

Section 9(3) lists three exceptions: an employer's legal right or duty, the free consent of the person the data is about, and the legitimate activities of certain non-profit bodies. Separately, section 7(2) lets personal data be processed without prior consent in listed cases. One of them is medical purposes (Government of Uganda, 2019).

The sources read do not say how these rules fit together for an insurer, a hospital or its software supplier. Section 9(1) also lists financial information, and the sources do not say whether billed amounts or payment advices count as that. This guide quotes the text and stops there. Ask a Ugandan lawyer.

Registration with the PDPO

The Data Protection and Privacy Regulations, 2021 are Statutory Instrument No. 21 of 2021 (Government of Uganda, 2021). Regulation 15 says every data collector, data processor or data controller shall register with the PDPO (Government of Uganda, 2021). Regulation 15(2) has the PDPO exempt certain groups from registering by notice in the Gazette, the government's official journal. This guide found no such notice, so ask a lawyer whether an exemption covers you. This guide also did not check whether the Act or the Regulations have been amended since the texts linked here, so check the NITA-U page for the current versions.

A registration lasts twelve months (regulation 20, Government of Uganda, 2021). The fee is 100,000 Uganda shillings (UGX) for an application and for a renewal (Schedule 2). Not registering is an offence (regulation 15(3)). An applicant outside Uganda must name a representative (regulation 16(2)(b)). Every application needs a written undertaking. The applicant promises not to process or store personal data abroad unless that country has adequate measures and the person consents (regulation 16(3), Government of Uganda, 2021).

Reported by DLA Piper, a law firm: the PDPO decided on 18 July 2025 that Ugandan data protection duties reach any entity that handles Ugandan citizens' personal data. That holds wherever the entity is based (DLA Piper, 2025).

Regulation 12 may also require an impact assessment, and regulation 47 a data protection officer where core activities consist of processing special personal data (Government of Uganda, 2021). The sources read do not settle whether either reaches a given insurer, hospital or supplier.

Security, processors and breach notice

The Act requires appropriate technical and organisational measures against loss, damage and unlawful access (section 20, Government of Uganda, 2019). On a breach, section 23(1) says the person concerned:

shall immediately notify the Authority in the prescribed manner, of the unauthorised access or acquisition and the remedial action taken.

Government of Uganda, 2019, section 23(1)

In the Act, the Authority is NITA-U. Regulation 33 (Government of Uganda, 2021) repeats the word immediately. Neither text gives a number of hours, and this guide gives none. The data-protection addendum for the ClinikEHR API sets a 72-hour clock for incident notices between the insurer or HMO, ClinikEHR and the hospital. That is a contract term. It is not Uganda's law.

Processing or storing data outside Uganda

Section 19 applies where a processor or controller based in Uganda processes or stores personal data outside Uganda. It must make sure the other country has adequate measures in place, or that the person the data is about has consented (Government of Uganda, 2019). Regulation 30 does not limit itself to those based in Uganda. It asks the collector, processor or controller to show the PDPO that these conditions are met, and it bars a further transfer to a third country without the express consent of the person the data is about. The PDPO is to name the countries with adequate measures by Gazette notice (regulation 30(4), Government of Uganda, 2021).

DLA Piper's country guide reports that this list was yet to be released. Its page is undated (DLA Piper, undated). The Act and the Regulations differ in reach, and this guide does not say which governs a supplier based abroad. It found no rule that health data must stay in Uganda, and it does not say none exists.

Four Steps Before You Choose a Claims System

These four steps are buyer habits. They are not ClinikEHR features, and they are not a legal checklist. Your lawyer decides what the law requires of you.

Step 1: Map how claims travel between you and each partner

Write one row for each insurer or HMO a hospital bills, or each service provider an insurer or HMO pays. Record the settlement period, how claim forms arrive and who acknowledges them.

What you need: every signed service level agreement.

How you know it worked: each row traces to a clause in a contract.

Step 2: Settle where you stand on PDPO registration

Compare your role and your purposes with regulation 15. Ask a Ugandan lawyer whether you must register, and note when your registration ends.

What you need: a list of the personal data you hold, and why you hold it.

How you know it worked: you hold a registration with an end date, or a written opinion that explains why you need none.

A mistake a team can make: assuming a supplier based abroad sits outside the Act. Read section 1 first.

Step 3: Put the same questions to every vendor

Take these questions from the texts above. Nothing here answers them for ClinikEHR.

What you need: written replies and documents from each vendor.

How you know it worked: every question has an answer in writing, with a date on it.

Step 4: Write the breach plan around the law's wording

The texts say immediately. Name who gives breach notice to the Authority (NITA-U), which houses the PDPO, and who acts first. Keep any contract clock apart from the legal duty.

What you need: contacts at the PDPO and NITA-U, and your processor contracts.

How you know it worked: one page names who acts on each notice.

How an Insurer or HMO and a Hospital Could Use the ClinikEHR API

The ClinikEHR API belongs to the ClinikEHR app and reaches a hospital's data only through a connection the hospital's owner approves. It builds on the hospital's HMO billing: the claims the hospital submits, the pre-authorization requests it sends, and the enrollees and plans agreed with each insurer or HMO. For route and request detail, read the HMO claims tutorial and the pre-authorization guide. Both are written for Nigeria but describe the same API. Full route lists sit in the API documentation and on the insurance routes page.

What a linked insurer or HMO can do

• Look up members. Search by insurance number among the people the hospital has recorded for your insurer or HMO. The lookup reads the hospital's own record, so it does not check cover live.
• Decide claims line by line. Mark each line approved, adjusted or declined. A declined line needs a reason, its own or the claim's, and no line can be approved above what was billed.
• Decide pre-authorizations. Approve with a PA code, or deny with a reason. Each request gets one decision.
• Send payment advices. A payment advice tells the hospital what was paid and against which claims. It is a message, not a payment. Hospital staff record the money.

Each claim line carries a tariff code and the billed price. The API does not compare a line with a tariff, and it has no fraud scoring. The approved figures come from your own decision.

Who can apply, and what each side needs

An insurer or HMO can apply for access to the Insurer claims, authorizations and enrollees data kind. A ClinikEHR reviewer decides, and no timeline is stated. Two Enterprise requirements work as a pair. On your side, the developer workspace (its account in the developer portal) sits on the Enterprise contract plan, which ClinikEHR sets on request, and its owner accepts the data-protection addendum. On the hospital's side, the plan is Enterprise and API access is switched on.

The hospital's owner also sets Insurance to Outside the US (Settings, General). That names a setting, not a country. The owner approves the connection, records a legal basis, the stated reason for sharing the data, and an owner or manager links your insurer or HMO. A hospital cannot just invite insurers, because each needs its own workspace and approval first. For each insurer or HMO the hospital picks one delivery channel, and the ClinikEHR API is one choice. Billing HMOs inside ClinikEHR is a different matter: a hospital on any plan can do it once its Insurance setting is Outside the US.

The addendum is with Bettar Platforms, Inc. It has no Uganda-specific terms, and it leaves each party responsible for making any cross-border transfer lawful. The insurance routes hold no sandbox data. To try them you need a live key and a hospital that has linked you.

The Directives and the API side by side

This table pairs each Directive step with an API step of similar shape. It maps shapes only. It is not a claim of compliance.

What This Guide Does Not Claim

• It says nothing about ClinikEHR's customers, hosting or registrations in Uganda, and it claims no certification or approval from the IRA, the PDPO or any other Ugandan body.
• ClinikEHR is not connected to the IRA, the PDPO, NITA-U, the Ministry of Health, a proposed national health insurance scheme, or any national claims or health-information system.
• It does not say any insurer, HMO or hospital in Uganda is live, approved or onboarded on the ClinikEHR API.
• It does not grade anyone's practice against the Directives or the Act. A payment advice is not the IRA's remittance schedule.

Mistakes to Avoid When Linking Claims in Uganda

1. Leaving Insurance on the United States setting. New hospital workspaces start there, and only the owner can change it. The insurance routes refuse a hospital that has not set Insurance to Outside the US.
2. Treating the regulator's aims as a vendor's promise. A brochure that repeats the Directives' wording is not a feature. Ask what the system does.
3. Reusing hospital data for another purpose. The addendum has an insurer or HMO use what it receives only for the purpose the hospital agreed to, and no other.
4. Mixing up two approvals. A ClinikEHR reviewer's approval of insurer access is not an IRA licence and not a PDPO registration.
5. Assuming access lasts. A hospital owner can end the link or revoke the connection at any time, and access stops on the next request.

Frequently Asked Questions

What is a health membership organisation (HMO) in Uganda, and who regulates it?

The Insurance Act, Cap. 191 (enacted as Act 6 of 2017) defines a health membership organisation, or HMO, as an organisation that funds health care by way of membership. It calls an HMO's customer a member. The IRA licenses HMOs separately from insurers, and an HMO licence covers health benefit plans for people resident in Uganda only. The IRA's 2026 list of authorised HMOs has one entry. Licensed insurers also write medical cover, so a count of HMOs does not measure the whole market.

Do the IRA's medical claims Directives apply to hospitals?

The Directives on Medical Insurance Claims, in force from 30 January 2025, apply to every licensed insurer providing medical insurance and to the HMOs the IRA regulates. A hospital appears in them as a service provider, and its claim submissions must follow its service level agreement. New agreements must state a claims settlement period of thirty working days from receipt of the claim. This guide does not read that as a deadline for every claim. Check your own agreement.

Do the Directives set a time limit for a pre-authorization decision?

This guide found none. The Directives say the pre-authorizations an insurer or HMO must give during treatment have to be available round the clock. That is a rule about availability, not a deadline for a decision.

What does Uganda's data protection law say about health data?

The Data Protection and Privacy Act, 2019 (Cap. 97) bars collecting or processing health status or medical records unless a listed exception applies. The exceptions are an employer's legal right or duty, the person's free consent, and the legitimate activities of certain non-profit bodies. A separate section lets personal data be processed without prior consent for medical purposes. The sources read do not say how the two rules fit together for an insurer, an HMO or a hospital. This is general information, not legal advice, so ask a Ugandan lawyer.

Must an insurer, HMO or hospital register with the PDPO, and how soon must a breach be reported?

Regulation 15 of the 2021 Regulations says every data collector, data processor or data controller shall register with the PDPO, unless the PDPO exempts a group by Gazette notice. This guide found no such notice. A registration lasts twelve months, and the fee is UGX 100,000. The Act says to notify a breach immediately, and the Regulations repeat that word. Neither gives a number of hours. Ask a Ugandan lawyer whether you must register.

What does it take for an insurer or HMO to use the ClinikEHR API with a hospital?

An insurer or HMO can apply for access to the Insurer claims, authorizations and enrollees data kind, and a ClinikEHR reviewer decides with no stated timeline. Its developer workspace needs the Enterprise contract plan, and the hospital needs the Enterprise plan with API access on. The hospital's owner sets Insurance to Outside the US, approves the connection and records a legal basis, and an owner or manager then links the insurer or HMO. The insurance routes have no sandbox data.

Does the API move money, check cover or compare claim lines with prices?

No. A payment advice is a message to the hospital, and staff record the money themselves. Enrollee lookup reads the record the hospital holds, so it is not a live check of cover. A decision on a claim line can never approve more than the hospital billed. The API does not compare a line with a tariff and has no fraud scoring.

Is ClinikEHR connected to any Ugandan national system?

No. ClinikEHR is not connected to the Insurance Regulatory Authority, the Personal Data Protection Office, the National Information Technology Authority or the Ministry of Health. It is not connected to a proposed national health insurance scheme or to any national claims or health-information system, and it cannot be used to reach one. This guide makes no claim that ClinikEHR is certified, approved, registered or hosted in Uganda.

Conclusion

Uganda's own texts frame any claims link. Several points are unsettled.

An API can move claim and pre-authorization data between an insurer or HMO and a hospital. It does not change what Ugandan law asks of either. To ask how ClinikEHR API access works, contact the team or visit the developer portal.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.