UAE: How Insurers and Clinics Can Exchange Pre-Authorization and Claims Data Through an API in 2027

You work with health insurance in the UAE and wonder whether an insurer and a clinic can exchange prior authorization and claims data through an API. Start with where the law says health data may be kept, because that question comes first. This guide reads the UAE's own texts first, then outlines the ClinikEHR API (api.clinikehr.com) in general terms. ClinikAPI (clinikapi.com) is a separate product built around FHIR, a health-data standard. ClinikEHR is not connected to eClaimLink or Shafafiya, the claims systems of Dubai and Abu Dhabi.

Quick Answer

Read the UAE's own texts on where health data may be kept and which channel carries claims before an insurer and a clinic exchange anything, because an API settles neither.

• Federal Law No. 2 of 2019 says health data about services given in the UAE may not be stored, processed, generated or transformed outside it, in the English translation the Dubai Health Authority (DHA) hosts. Article 13 itself states one exception, a Health Authority resolution made in coordination with the Ministry. Ministerial Decision No. 51 of 2021 separately lists cases in which health data may be stored or transferred abroad, and this guide does not say how the two fit together. Dubai and Abu Dhabi add rules.
• Health insurance is mandatory by law in Dubai and Abu Dhabi for the groups each law names. The DHA regulates it in Dubai, and the Department of Health (DoH) in Abu Dhabi.
• Dubai's texts name eClaimLink as the claims and authorization channel. Abu Dhabi's Healthcare Regulator Manual requires providers and insurers to submit healthcare data to the Department of Health (DoH) as its Data Standards and Procedures specify, and the DoH publishes those standards through Shafafiya. No text read says in terms that the Shafafiya Post Office is mandatory.
• The personal data protection law treats health data as sensitive but excludes personal health data that has its own legislation.
• An insurer or HMO (health maintenance organization) can apply for the insurer kind of data access in the ClinikEHR API, and a hospital chooses whether to link the insurer. This guide makes no claim about ClinikEHR in the UAE and does not say that a UAE insurance company can be approved.

What Are Prior Authorization, eClaimLink and Shafafiya, in Plain Words

Prior authorization is an insurer's approval before a planned service. Seven other terms recur below:

• Claim: the bill a provider sends an insurer for the insurer's share.
• DHA, DHIC and DoH: the Dubai Health Authority, the Dubai Health Insurance Corporation under it, and the Department of Health Abu Dhabi. The DHA and the DoH regulate health insurance in their emirates.
• eClaimLink: the DHA's electronic claims platform in Dubai.
• Shafafiya: the DoH's portal of data-exchange standards in Abu Dhabi. It also runs the exchange itself, the Shafafiya Post Office.
• Pre-authorization and PA code: the ClinikEHR API's words for an approval request and its code. PA means pre-authorization.
• HMO: a term used on the ClinikEHR API pages for a health maintenance organization that pays part of a member's bill. It is not a category in the UAE texts read here, which name insurance companies, claim management companies and payers. This guide does not say that any of them can use the API.
• Enrollee: the ClinikEHR API's word for a person an insurer covers. UAE texts say beneficiary, insured or member.

This guide is general information, not legal advice. Ask a UAE lawyer about your own case.

What This Guide Could Read, and What It Could Not

Facts here were read in October 2026, three items from archived copies, as their links show. Where a point is unsettled or belongs with a lawyer, this guide says so and does not choose.

Treat the English texts of laws here as translations. The Supreme Legislation Committee's English text of Dubai Law No. 11 of 2013 carries a footnote saying the Arabic text prevails in a conflict.

What the UAE's Texts Say About Keeping Health Data in the UAE

This section comes first because location rules come before any question about an API. It states what each text says and draws no conclusion about an API, a vendor or a hosting arrangement. That is for the regulated entity, its lawyer and the regulator. Step 3 turns the location questions into questions for a vendor.

Federal Law No. 2 of 2019

Article 13 of Federal Law No. 2 of 2019, which covers information and communication technology in health fields, is the location rule. In the English translation the DHA hosts, it begins:

It is not permissible to store, process, generate or transform the health data and information outside State

Dubai Health Authority, 2019, Article 13, English translation of a federal law hosted by the DHA

The same translation shows that the law was issued on 6 February 2019 and applies in the State, free zones included. Article 13 covers health data related to services provided inside the State. The only exception Article 13 itself states is a resolution by the Health Authority in coordination with the Ministry. Latham and Watkins reported in 2021 that the approval may come from the health authority or the Minister; this guide does not resolve that. Article 24 sets a penalty of at least AED 500,000 and at most AED 700,000, in UAE dirhams, for breaching it. Have a certified translator check the verb transform against the Arabic original. The law also refers to an executive regulation, which this guide did not read.

Article 16 is a separate confidentiality rule, expressed to apply without prejudice to other applicable legislation. One of its listed cases lets insurers and funding authorities ask for patient information to review, approve or verify financial entitlements without the patient's written approval. It does not say that any information may leave the UAE, and this guide did not reconcile it with other texts.

Ministerial Decision No. 51 of 2021

The Minister of Health and Prevention issued Decision No. 51 of 2021 on 28 April 2021. It sets the cases in which health data about services provided inside the UAE may be stored or transferred outside it (Ministry of Health and Prevention, 2021). One case is for insurance and claims-management institutions. Article 2, item 4 covers what they need to provide health insurance cover, after the patient's consent. Article 5 adds conditions, including these. The institutions operate in the UAE and store all the data inside it. No identifying patient data is transferred. The patient gives written consent. The data is not transferred in full, and it is encrypted before it is sent.

No English text of the Decision was found in a primary source. This reading comes from the Arabic text and awaits a certified translation. Two law firms read the Article with different emphasis (Latham and Watkins, 2021; CMS, 2021). Latham and Watkins reported that the data must be anonymized. CMS reported, tentatively, that the recipient may need to belong to the same group of companies. No source read says what the Decision means for any API or hosting arrangement. This guide does not conclude, and you should not conclude without legal advice.

Dubai: the DHIC's data directive

The Dubai Health Insurance Corporation (DHIC) works under the DHA's supervision. Its Data Governance and Records Management Policy Directive was issued on 7 October 2025 and took effect on 27 October 2025 (Dubai Health Authority, 2025). It applies to entities licensed or authorized by the DHA that handle health insurance data, and it names insurance companies, claim management companies (also called third-party administrators or TPAs), brokers, health service providers, and outsourced vendors, consultants and subcontractors handling health insurance data. TPAs and brokers are market context here, and this guide does not say that any of them can connect to anything.

The directive says health data must be stored, processed, generated and transferred within the UAE unless an exemption applies or specific conditions are met. The DHIC grants exemptions in coordination with the Ministry of Health and Prevention. The conditions include research, insurance verification and treatment of overseas patients, with safeguards like anonymization and encryption. No cross-border transfer is permitted without a documented justification approved in advance.

Abu Dhabi: the DoH's security standard

The DoH's Abu Dhabi Healthcare Information and Cyber Security Standard, known as ADHICS, has a second version. It was published in May 2024 and took effect in August 2024 (Department of Health Abu Dhabi, 2024). It applies to any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes or transmits health information. Its examples include a payer and a healthcare technology and service provider. Control DP 1.4, item 4, says:

Ensure health information and its copies in any form, whether encrypted, anonymized, deidentified, pseudonymized, etc., are not stored, processed, or transferred outside the UAE.

Department of Health Abu Dhabi, 2024, control DP 1.4, item 4

Exemptions need the entity's management and then the DoH to approve them. Control CS 1.2 adds that a cloud environment is to be physically hosted within the UAE, backup and disaster recovery included. It also bars access or support by other parties in a shared environment, and remote support from outside the UAE.

Health Insurance Is Mandatory in Dubai and Abu Dhabi

Dubai

Dubai Law No. 11 of 2013 on health insurance was issued on 24 November 2013 (Dubai Health Authority, 2013). Article 7(a) says the responsible entities must enrol UAE nationals, residents and visitors. Articles 9 and 10 make the employer responsible for enrolling its employees, with benefits no less than the Basic Coverage, and for bearing the cost.

Abu Dhabi

Abu Dhabi Law No. 23 of 2005 was issued on 10 September 2005 (Department of Health Abu Dhabi, 2005). Article 4, subject to Articles 2 and 3, makes subscription compulsory for non-UAE nationals who reside in the emirate, and optional for others. Article 3 exempts listed categories. Article 5 makes the employer responsible for providing cover for employees and their families. Article 2 says the scheme may also apply to UAE nationals by a resolution of the Executive Council.

The rest of the UAE

A Ministry of Human Resources and Emiratisation page says a Cabinet decision extended mandatory cover to all emirates from 1 January 2025. It covers private-sector employees and domestic workers (Ministry of Human Resources and Emiratisation, 2026). The Cabinet decision itself was not read. This guide does not cover free zones such as DIFC, ADGM or Dubai Healthcare City.

How Prior Authorization and Claims Work, in the Regulators' Own Words

The regulators' words differ. The DHA's claims directive uses pre-authorization in its headings, and its circulars call the electronic form eAuthorization. The DoH's data dictionary calls the transaction Prior Request/Authorization (Department of Health Abu Dhabi, 2026). This guide says prior authorization for the UAE market and keeps pre-authorization for the ClinikEHR API.

Dubai: the DHA and eClaimLink

eClaimLink is the DHA's electronic claims platform. The DHA's document site describes it as serving healthcare providers, payers and the Authority (Dubai Health Authority, 2026). The platform's own site could not be read.

A DHA circular of 13 October 2016 said eAuthorization would be mandatory from 1 January 2017 for all Dubai authorization transactions between providers and payers, other than ePrescriptions (Dubai Health Authority, 2016). It applies to providers other than pharmacies, and it leaves which transactions need an authorization to the agreement between provider and payer. Al Tamimi reported in October 2025 that the DHIC's claims directive revokes and supersedes all previous claims management regulations. This guide could not confirm whether that reaches the 2016 circular.

The DHIC's Health Insurance Claims Management Policy Directive was issued on 27 October 2025, to take effect on 16 November 2025 (Dubai Health Authority, 2025). It applies to insurance companies, claim management companies and licensed providers in Dubai. In this guide's paraphrase, it does these things:

• It sets a time limit for providers to send a prior authorization request to the payer, and response windows for insurers.
• It tells providers to verify patient identity and eligibility through eClaimLink.
• It says a claim sent outside eClaimLink will not be processed for settlement.
• It says remittance advices, the insurer's record of payment for a claim, are posted on the Dubai Health Post Office (DHPO).

The DHA site no longer links this directive, and the file answered as not found when this guide was checked. It may have been withdrawn, revised or re-issued under another number. This guide does not say it is in force and leaves its figures out. Check its status with the DHA.

The DHIC's data directive also makes insurers keep datasets that match the eClaimLink minimum dataset (Dubai Health Authority, 2025).

Abu Dhabi: the DoH and Shafafiya

Shafafiya is the DoH's portal of the standards that govern how healthcare information is exchanged. It is also the data-exchange system, called the Shafafiya Post Office, where healthcare entities upload files for other organizations to collect. The DoH says electronic transactions between healthcare entities need to be structured and exchanged to those standards (Department of Health Abu Dhabi, 2026).

The DoH's Healthcare Regulator Manual, November 2017 edition, says providers and insurers must submit healthcare data to the DoH. They submit it as its Data Standards and Procedures specify (Department of Health Abu Dhabi, 2017). Its routine transactions include claim submission, remittance advice and prior request or prior authorization. This guide gives no Abu Dhabi time limits, because it did not confirm that this edition is current.

A 2010 standard from the Health Authority Abu Dhabi, as the DoH was previously known, says a claim may be denied for lack of prior authorization only if the plan requires it for that service. It also says an incomplete payer answer counts as approved (Health Authority Abu Dhabi, 2010). This guide did not find whether it was revised.

The two emirates side by side

The Federal Personal Data Protection Law, Explained

Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data, called the PDPL here, was issued on 20 September 2021 (Dubai Health Authority, 2021, English translation). It came into force on 2 January 2022 (UAE Government portal, 2025). It treats data about a person's health as sensitive personal data, including information about healthcare services that reveals the person's health status (Article 1). Article 2(2) then lists matters the law does not apply to. One item is:

Personal Health Data that has legislation regulating its protection and processing

Federal Decree-Law No. 45 of 2021, Article 2(2)(e), English translation hosted by the Dubai Health Authority

Another item is free-zone companies that have their own personal data legislation. The federal health-data law above is a separate law. No source read says in terms that it is the legislation item (e) refers to, so this guide does not join the two. The PDPL has its own rules for sending personal data abroad (Article 22), which this guide does not apply to health data. It explains the PDPL and certifies no one, and it does not say the PDPL applies, or does not apply, to any insurer, hospital or vendor.

What an Insurer or Clinic Team Can Do Before Choosing a Claims System

None of these steps is a ClinikEHR feature, and this list is not a legal checklist. The texts above decide what you must do. The steps turn them into records you can show a regulator, a lawyer or a buyer.

Step 1: List each emirate, regulator and channel

Make one row per emirate where you work: the regulator, the channel and the dated document that requires it, or a note that none was found. Log the date you read each text and whether the regulator still publishes it. Quote each document by its title and issue date, not by a number alone.

How you know it worked: every row names a document, its date and its status.

The mistake to avoid: assuming one channel and one set of rules covers both emirates.

Step 2: Find which location rules reach you

List the health data you hold, with every copy, backup and support route, and where each sits. Then ask a UAE lawyer which texts above reach you.

How you know it worked: a written legal opinion names each text it relies on and any exemption you hold.

The mistake to avoid: assuming an encrypted or anonymized copy sits outside the rules. The Abu Dhabi control names both.

Step 3: Ask each claims-system vendor the same questions

These questions are for any vendor. This guide gives no answers for ClinikEHR.

What you need: the vendor's documents, not its sales pages.

How you know it worked: each question has a dated document in your file.

The mistake to avoid: accepting a promise in place of a document.

How an Insurer or HMO and a Hospital Exchange Data Through the ClinikEHR API, in General Terms

This is a general outline. It does not say that a UAE insurer or hospital can use the API under the texts above. The ClinikEHR API is the API of the ClinikEHR app, and it reaches a hospital's records only through a connection the hospital approves for your organization. It carries the claims the hospital submits, the pre-authorization requests it sends, and the enrollees and plans an insurer has agreed with it.

What the API does

• Enrollee lookup. By insurance number, an insurer or HMO can find a member the hospital has recorded. It reads the hospital's own record. It is not live eligibility, and it is not the eClaimLink check the Dubai claims directive (status unconfirmed) describes.
• Claim decisions. An insurer decides each claim line, never above the billed quantity or price. No money moves.
• Pre-authorization. A request is approved with a PA code or denied with a reason, and it is decided only once. The API sets no response time.
• Payment advices. A message to the hospital saying what was paid. It is not a remittance advice on the DHPO.

Who can use it

An insurer or HMO can apply for the Insurer claims, authorizations and enrollees kind of data. A ClinikEHR reviewer decides, with no stated timeline, and that approval does not replace any authorization from the DHA or the DoH. This guide does not say that a UAE insurance company, claim management company or broker can be approved.

Access needs a pair of Enterprise requirements. The insurer or HMO has its own developer workspace on the Enterprise contract plan, which ClinikEHR sets on request. The hospital is on the Enterprise plan with API access on. Its owner sets Insurance to Outside the US under Settings, General, a setting and not a place. The owner then approves the connection and records the basis for sharing, and an owner or manager links the insurer.

The insurer or HMO accepts a data-protection addendum with Bettar Platforms, Inc. It has no UAE terms. It leaves each party responsible for making any cross-border transfer lawful, and it does not say that any transfer is lawful.

A hospital chooses one submission channel per insurer, and eClaimLink and Shafafiya are not among them. The insurance routes have no sandbox data, so trying them needs a live key and a linked hospital. Each hospital decides for itself whether to approve a connection and link an insurer, and the API is not a route to any UAE system.

For route-by-route detail, read the HMO claims tutorial and the pre-authorization guide. Both were written for Nigerian readers, and neither supports any statement about UAE law. See also the API documentation and the insurance routes page.

What This Guide Does Not Claim

• No hosting statement. It says nothing about where any ClinikEHR system or the API's data is held.
• No presence. It claims no registration, certification, accreditation, customers or partnership for ClinikEHR in the UAE.
• No connection. ClinikEHR is not connected to eClaimLink, the DHPO, Shafafiya, the Shafafiya Post Office or any national or emirate system.
• No approval of anyone. It does not say that any UAE insurer, claim management company, broker or clinic can connect, has been approved or is live. It gives no market statistic.

Mistakes to Avoid When Reading These Texts

1. Treating the insurance case in Decision No. 51 as a general permission. It carries conditions.
2. Using the PDPL as your only data law. It excludes health data that has its own legislation.
3. Reading Article 16(1) as a location exception. It is a confidentiality rule and does not say where data may be kept.
4. Reading market context as a connection list. Claim management companies and brokers appear above as regulated roles. This guide does not say that any of them can connect.
5. Reading an English translation as the last word. The English text of Dubai Law No. 11 of 2013 carries a footnote that the Arabic text prevails in a conflict.

Frequently Asked Questions

What does this guide cover, and is it legal advice?

It explains what UAE laws, regulators and decisions say about where health data may be kept. It also covers how Dubai and Abu Dhabi handle prior authorization and claims, and how the personal data protection law treats health data. It then gives a short outline of the ClinikEHR API. It is general information, not legal advice. The English texts it cites are translations, and Decision No. 51 of 2021 was read in Arabic only. Ask a UAE lawyer about your own case.

What are the DHA and DoH, and what are eClaimLink and Shafafiya?

The Dubai Health Authority (DHA) regulates health insurance in Dubai, and the Department of Health (DoH) does so in Abu Dhabi. eClaimLink is the DHA's electronic claims platform. Shafafiya is the DoH's portal of data-exchange standards and its data-exchange system, the Shafafiya Post Office. ClinikEHR is connected to neither.

Is health insurance mandatory in Dubai and Abu Dhabi?

Yes, for the groups each law names. Dubai Law No. 11 of 2013 says the responsible entities must enrol nationals, residents and visitors, and makes the employer responsible for enrolling and paying for its employees. Abu Dhabi Law No. 23 of 2005 makes subscription compulsory, subject to its exemptions, for non-UAE nationals who reside in the emirate, and the employer must provide cover for employees and their families. The Ministry of Human Resources and Emiratisation says a Cabinet decision extended mandatory cover to all emirates from 1 January 2025. It covers private-sector employees and domestic workers.

What does prior authorization mean in Dubai and Abu Dhabi?

It is an insurer's approval before a planned service, and the two emirates use different words. The DHA's directive uses pre-authorization, and its circulars call the electronic form eAuthorization. The DoH's data dictionary calls it Prior Request/Authorization. Dubai's texts route it through eClaimLink, although the status of the 2025 claims directive is unconfirmed. Abu Dhabi's Regulator Manual lists it among the transactions submitted to the DoH.

What does the federal health-data law say about keeping data in the UAE?

In the English translation the DHA hosts, Article 13 of Federal Law No. 2 of 2019 says health data about services provided inside the UAE may not be stored, processed, generated or transformed outside it. The only exception the Article itself states is a Health Authority resolution made in coordination with the Ministry. Ministerial Decision No. 51 of 2021 separately lists cases in which health data may be stored or transferred abroad. Article 24 sets a penalty of at least AED 500,000 and at most AED 700,000 for breaching it. Check the verb transform against the Arabic original. This is not legal advice.

Does the ClinikEHR API let a hospital or insurer skip eClaimLink or Shafafiya?

No. ClinikEHR is not connected to either, and nothing in the API replaces them. Each hospital decides for itself whether to approve a connection and link an insurer or HMO. The UAE texts in this guide describe the Dubai and Abu Dhabi channels for authorization and claims data. Ask a UAE lawyer which applies to you.

What do the API's lookup, claim decisions and payment advices do and not do?

The lookup reads the members a hospital has recorded. It is not live eligibility. Claim decisions are made line by line and never exceed what was billed. Pre-authorization requests are approved with a PA code or denied with a reason, and each is decided once. A payment advice is a message to the hospital. No money moves through the API. It does not compare a line with the price list the insurer agreed with the hospital (a tariff), it has no fraud scoring, and it makes no response-time promise. The insurance routes have no sandbox data.

Is ClinikEHR connected to any UAE system?

No. ClinikEHR is not connected to eClaimLink, the Dubai Health Post Office, Shafafiya, the Shafafiya Post Office or any national or emirate system. This guide claims no registration, certification, approval, hosting or customers for ClinikEHR in the UAE, and it makes no statement about where any ClinikEHR system is hosted. Ask any vendor the questions in Step 3 and keep its written answers.

Conclusion

The UAE's texts set the frame for any exchange of claims data. A federal law and a ministerial decision say where health data may be kept, and Dubai names eClaimLink while Abu Dhabi points to the DoH's Shafafiya standards. Some points are unsettled, and some belong with a UAE lawyer.

An API can carry pre-authorization and claims data between an insurer or HMO and a hospital, but it does not answer these texts for you. To ask how access to the ClinikEHR API works, contact the team or open the developer portal. The pricing page lists the plans, including Enterprise.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)
• Kenya: How Private Insurers and Hospitals Can Exchange Claims and Pre-Authorization Data Through an API in 2027

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.