United Kingdom: Private Medical Insurance Pre-Authorization for Independent Clinics, an API Approach (2027)

You run an independent clinic in the United Kingdom, or you build tools for one. If your patients have private medical insurance, a clinic and an insurer may exchange authorisations, claims and health data. Before a clinic and an insurer link that data, read what UK regulators and UK law say. This guide reads those texts first, then outlines the ClinikEHR API (api.clinikehr.com) in general terms. ClinikAPI (clinikapi.com) is a separate product built around the FHIR standard, with its own site, keys and licence.

Quick Answer

Read what UK regulators and UK law say before a clinic and an insurer link claim data, because choosing an API settles none of it.

• The Financial Conduct Authority (FCA) sets a conduct rule for insurers: handle claims promptly and fairly. The Financial Ombudsman Service takes a policyholder's complaint once the insurer's own process has run.
• In 2014 the Competition and Markets Authority (CMA) recorded that insured patients are normally required to get pre-authorisation from their insurer before treatment. That report is twelve years old. The sources read do not describe how clinics and insurers exchange authorisation or claims data, any standard for it, or a duty to use one.
• The UK GDPR and the Data Protection Act 2018 treat health data as special category data, which has stricter rules. The Data (Use and Access) Act 2025 amended both. Since 30 September 2026 the regulator is the Information Commission, still known as the ICO, the former Information Commissioner's Office.
• An insurer or HMO can apply for access to the ClinikEHR API, and a clinic decides whether to link it. Access has two separate Enterprise requirements, one for the insurer or HMO and one for the clinic, as the API section explains. UK private medical insurers appear here only as market context.
• This guide claims no regulator approval, certification, registration, UK hosting or UK customers for ClinikEHR. ClinikEHR is not connected to any national or scheme claims or health-information system.

What Is Private Medical Insurance Pre-Authorisation, in Plain Words

Private medical insurance (PMI) pays for investigating and treating medical or dental conditions (Financial Ombudsman Service, 2026). Pre-authorisation, as this guide uses the word, is the insurer's approval before treatment. No regulator text read defines it. These terms recur below:

• Policyholder and beneficiary: the policyholder holds the policy. The Financial Ombudsman Service (FOS) calls an employee covered by an employer's group policy a beneficiary instead (Financial Ombudsman Service, 2026).
• Claim: a request that the insurer pays its share of a bill.
• HMO: ClinikEHR's word for a health plan organisation. No UK source read uses it, so this guide says insurer for the UK market.
• Enrollee: the API's word for someone an insurer or HMO covers. In the UK that is a policyholder or beneficiary.
• PA code: the pre-authorization (PA) code field in the ClinikEHR API. No UK source read says UK authorisations carry a code.

Treat this guide as general information, not legal advice. A UK lawyer can answer for your own case.

What Sources This Guide Used, and What It Could Not Read

Every source marked as used below was read in October 2026. If the sources leave a point open, or it is a matter for a lawyer, the guide says that and picks no side.

How Private Medical Insurance Sits in the UK

What the FCA and the Ombudsman say about claims

The FCA sets a conduct rule for insurers, ICOBS 8.1.1R, in its Insurance Conduct of Business sourcebook. An insurer must handle claims promptly and fairly. It must also give reasonable guidance to help a policyholder make a claim and appropriate information on its progress, not reject a claim unreasonably, and settle promptly once terms are agreed (FCA Handbook, 2017). The rule is for insurers, not for clinics or ClinikEHR. ICOBS 1 Annex 1 sets which contracts and customers each chapter covers (it does not apply to reinsurance, for example), and this guide did not apply it to any policy (FCA Handbook, 2026). In a February 2023 letter to general insurance and protection firms, the FCA wrote that it expects unreasonable delays in claims processing to be avoided (FCA, 2023).

The FOS is a free complaints service (Financial Ombudsman Service, 2026). It says it follows the FCA's Dispute Resolution Rules (Financial Ombudsman Service, 2026). A policyholder first complains to the insurer. After a final response, or eight weeks without one, the policyholder can bring the complaint to the FOS. The FOS says an insurer has to handle claims promptly and fairly. It also says it may suggest compensation if it thinks a delay in authorisation was unnecessary (Financial Ombudsman Service, 2026).

What the FOS says about hospitals and consultants

The FOS says private medical insurers usually keep a list of consultants and hospitals they recognise. A hospital on that list has usually agreed its charges with the insurer by contract. The FOS also expects an insurer that needs information from a hospital or the customer's GP to chase it at regular intervals (Financial Ombudsman Service, 2026). These describe usual practice, not rules for clinics.

For cover through an employer, the CMA wrote in 2014 that the organisation that administers the scheme is typically an insurer (Competition and Markets Authority, 2014). This guide treats private medical insurers and administrators as market context only. It does not say that either can apply for, or be linked through, the ClinikEHR API.

What independent healthcare means in England

The Care Quality Commission (CQC) defines independent healthcare services as private sector health care. That means care from organisations that are not NHS trusts or NHS GP services (Care Quality Commission, 2026). Its registration rules apply to regulated activity in England (Care Quality Commission, 2025). This guide did not read the regulators of Scotland, Wales or Northern Ireland, and says nothing about NHS work.

How Pre-Authorisation and Claims Work, in the Regulators' Words

No regulator text read describes today's steps in full. The best description found is the CMA's, from 2014. It is twelve years old, and it describes what patients did then.

What the CMA recorded in 2014

The CMA wrote that:

insured patients are normally required to obtain pre-authorization from their PMI prior to seeking treatment

Competition and Markets Authority, 2014, paragraph 5.11. The CMA writes PMI for a private medical insurer and uses the z spelling.

The report sets out the steps in paragraphs 2.47 to 2.54. A patient with private cover may contact the insurer, or the organisation that administers their employer's scheme, to get authorisation for an initial outpatient consultation. The patient may then contact the insurer again to seek authorisation for the recommended treatment, the hospital or clinic and the consultant. The insurer typically checks whether the policy covers the procedure and whether the patient may use that clinic. After treatment, the hospital and consultant will submit their bills, probably direct to the payer, unless the patient has taken package pricing. The CMA added that practice varies. The same report records that, for one insurer, most policyholders did not need pre-authorisation before seeing a consultant (paragraph 7.111). Those paragraphs describe authorisation steps that the patient starts and bills that the hospital and consultant send, not an electronic exchange.

What the FOS records

One published FOS case study involved a policyholder who had pre-authorisation for an appointment but had been told that further authorisation was needed to claim for treatment. The insurer had declined the claim on two grounds: no pre-authorisation for the treatment, and the policy's chronic-condition term. The FOS found the insurer had acted fairly on both. It had made clear that pre-authorisation was needed before treatment, and it was reasonable to conclude from the medical evidence that the condition was chronic (Financial Ombudsman Service, 2026). That is one complaint, not a rule, and it does not show that a missing authorisation always defeats a claim.

What the sources do not say

The sources read do not:

• define pre-authorisation;
• set a time limit for an insurer's authorisation decision;
• say what an authorisation looks like, such as a code, a number or a letter;
• describe an electronic exchange of authorisation or claims data between a clinic and an insurer, a standard for one, or a duty to use one;
• say how many independent clinics claim through insurers, how often claims are declined or how long insurers take.

That is an absence in the sources read, not proof that nothing exists. The CMA report does mention, in a footnote, an intermediary between hospital operators and private medical insurers that was the source of some of its data. This guide read nothing more about it and names none.

What UK Data Protection Law Says About Claims Data

Which texts apply, and who regulates them

UK health data rules sit in the UK GDPR, which is the General Data Protection Regulation as it forms part of UK law, and in the Data Protection Act 2018. The Data (Use and Access) Act 2025 amended both. Many of its data protection provisions, including the new lawful-basis and transfer rules, took effect on 5 February 2026 (legislation.gov.uk, 2026). The ICO said that day that most of the remaining data protection provisions had come into force (ICO, 2026).

From 30 September 2026 the office of Information Commissioner is abolished, and its functions belong to the Information Commission (legislation.gov.uk, 2026). The regulator said it will continue to be known as the ICO (ICO, 2026).

Health data is special category data

The UK GDPR defines data concerning health as personal data about a person's physical or mental health, including the provision of health care services, that reveals their health status (legislation.gov.uk, 2026). It lists that data among the special categories, and processing them is prohibited unless an exception applies (legislation.gov.uk, 2026). The ICO says appointment details and invoices can be health data when they reveal something about a person's health. Its examples include a list of appointments at an osteopath clinic and an invoice for a series of physiotherapy sessions (ICO, 2024). The ICO pages cited in this section carry a banner saying the guidance is under review and may change, so the Act's own text is the one to rely on.

Special category processing takes two steps. The ICO puts it this way:

In other words, you must identify both a lawful basis under Article 6 and a condition for processing special category data under Article 9.

ICO, 2026. The page is titled What are the rules on special category data?

Three Article 9 conditions matter here: explicit consent, substantial public interest, and health or social care. The health or social care condition has a professional-secrecy test (legislation.gov.uk, 2026).

The Data Protection Act 2018 routes these conditions to Schedule 1. The health or social care condition sits in Part 1, and the substantial public interest conditions sit in Part 2 (legislation.gov.uk, 2026). Part 2 includes an Insurance condition in paragraph 20. It covers health data that is necessary for an insurance purpose and for reasons of substantial public interest, with a consent limb that applies in some cases. The Act says an insurance purpose includes:

administering a claim under an insurance contract

legislation.gov.uk, 2026, Data Protection Act 2018, Schedule 1, Part 2, paragraph 20

Part 2 conditions, including the Insurance one, are met only if the controller, the organisation that decides why and how the data is used, has an appropriate policy document in place, unless the Act says otherwise. The controller must give it to the ICO on request (legislation.gov.uk, 2026).

Here the text is set out, not applied. The sources read do not say which lawful basis or condition a clinic uses to send treatment information for a claim, or which an insurer uses to receive it. Ask a UK lawyer.

Since 5 February 2026, Article 6 also has a lawful basis called recognised legitimate interest. It applies only if the processing fits a condition in Annex 1 (legislation.gov.uk, 2026). Annex 1 has five headings, including emergencies, crime and safeguarding vulnerable individuals (legislation.gov.uk, 2026). None of those headings is about insurance or health care, and Article 9 still needs its own condition. Regulations can amend Annex 1. In October 2026 legislation.gov.uk listed no change to it since 5 February 2026, so check before relying on that.

Controllers, processors and breach notice

A processor handles personal data on the controller's behalf (legislation.gov.uk, 2026). This guide does not say which role any clinic, insurer or supplier has in a claims flow. Whether the UK GDPR reaches a supplier outside the UK, and whether that supplier must appoint a representative in the UK, turns on Articles 3 and 27 (legislation.gov.uk, 2026; Article 27). That is a question for a UK lawyer, and this guide does not answer it for any party.

If a notifiable personal data breach happens, the controller must tell the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. A processor must tell the controller without undue delay, and the controller must tell people if the risk to them is high (legislation.gov.uk, 2026; Article 34). ClinikEHR's data-protection addendum, described below, has its own 72-hour incident notice. That is a contract clock, not this legal duty.

Moving data out of the UK

Since 5 February 2026, personal data can go to another country only if regulations approve the transfer, it is made subject to appropriate safeguards, or an exception applies. Approval by regulations turns on a data protection test (legislation.gov.uk, 2026; Article 45B). The ICO's guide names three safeguard tools and says whoever starts a restricted transfer must follow the transfer rules (ICO, 2026).

The data protection fee

A controller usually pays an annual data protection fee to the Information Commission unless all its processing is exempt (legislation.gov.uk, 2026). Since 17 February 2025 the amounts are £52, £78 or £3,763 by size, and £5 less by direct debit (legislation.gov.uk, 2026). Check the ICO fee pages for any change. The ICO keeps a register of fee payers (ICO, 2026).

ClinikEHR's own terms

ClinikEHR's published Data Processing Agreement and the data-protection addendum for organizations are ClinikEHR's own terms. The addendum is with Bettar Platforms, Inc. and has no United Kingdom-specific terms. Each side has a 72-hour notice for unauthorised access. Neither settles what UK law requires of any party.

What This Guide Does Not Claim

• It claims no regulator approval, certification, registration, UK hosting or UK customers for ClinikEHR.
• ClinikEHR is not connected to any national or scheme claims or health-information system, in the United Kingdom or anywhere.
• It does not say that any UK insurer, administrator or claims intermediary uses, accepts or can connect to the ClinikEHR API. It does not say that any insurer, HMO or clinic is approved, onboarded or live on it.
• It does not judge any clinic, insurer or supplier against the rules above. A UK lawyer can say what applies to you.

What a Clinic or Insurer Team Can Do Before Choosing a Claims System

These steps are habits for any clinic or insurer team, not ClinikEHR features or a legal checklist, because the law, not this list, sets the duties.

Step 1: List each insurer and how its authorisations and claims travel

Make one row per insurer. Note how you request authorisation, how you send the bill, and who owns each step.

What you need: each agreement you hold with an insurer, and the insurer's own guidance to providers.

How you know it worked: every insurer has a row, and each entry points to a document.

A mistake a team can make: assuming every insurer works the same way. The CMA wrote that practice varies.

Step 2: Write down what each authorisation covers

Record whether an authorisation covers an appointment, a course of treatment or both.

What you need: each authorisation as the insurer sent it, in whatever form it arrives.

How you know it worked: every authorisation on file states what it covers and what it leaves out.

A mistake a team can make: treating an authorisation for an appointment as one for treatment. One published FOS case study involved that gap, alongside a second ground about a chronic condition.

Step 3: Ask each claims-system supplier the same questions

Put the same questions to every supplier you consider. This guide does not answer them for ClinikEHR.

What you need: written answers and contract terms from the supplier.

How you know it worked: every question has an answer in writing, with a date.

A mistake a team can make: taking a verbal reassurance as the answer.

How an Insurer or HMO and a Clinic Could Work Together Through the ClinikEHR API

The ClinikEHR API belongs to the ClinikEHR app and works through a connected clinic's account. It builds on the clinic's HMO billing and carries three things: the claims the clinic submits, the pre-authorization requests it sends, and the enrollees and plans agreed with an insurer.

What the API offers an insurer or HMO

• Enrollee lookup. Using an insurance number, an insurer or HMO can find an enrollee the clinic has already recorded. The result comes from the record the clinic already holds, so it is not a live eligibility check.
• Claim decisions. An insurer or HMO reads a claim and rules on each line, never above the billed figures. A decision moves no money. The API does not compare a line with an agreed price list, and it has no fraud scoring.
• Pre-authorization. A request gets one decision: approved with a PA code, or denied with a reason. No response time is promised.
• Payment advices. An advice tells the clinic what was paid. Recording the money stays with clinic staff.

This table maps the CMA's 2014 steps to API operations of the same shape.

The CMA described, in 2014, authorisation steps that the patient starts and bills sent by the hospital and consultant. This table sets those steps beside a clinic-led API and does not say that any UK insurer uses or accepts it.

Who can use it

An insurer or HMO applies, from a verified developer workspace, for the Insurer claims, authorizations and enrollees kind of data. A ClinikEHR reviewer decides the application, and no timeline is stated. Access has two Enterprise requirements, and both must hold. On the insurer side, the developer workspace needs the Enterprise contract plan, a plan ClinikEHR sets on request. On the clinic side, the clinic must be on its Enterprise plan with API access switched on.

On the clinic side, the owner must set Insurance to Outside the US under Settings, General. That is a setting, not a place, and this guide does not say any clinic in the United Kingdom uses it. After that, the owner approves the connection and records a basis from the list in ClinikEHR's addendum (the addendum's own term, not a UK GDPR lawful basis), and an owner or manager links your organization to the clinic's record of your insurer. Separately, billing HMOs inside ClinikEHR works on any plan once the Insurance setting is Outside the US.

Each insurer has one submission channel at the clinic, chosen by an owner or manager. When that channel is the ClinikEHR API, a submitted claim can be read by the linked organization. The insurer's or HMO's organization must also accept the current data-protection addendum, a contract with Bettar Platforms, Inc. (version 2026-10-09). No sandbox data exists for the insurance routes. To try them you need a live key and a clinic that has linked you. Each link joins one clinic to one insurer or HMO. It does not reach any national or scheme system.

To see each route in turn, read the HMO claims tutorial and the pre-authorization guide. Their examples are Nigerian, and each describes the routes in full. The API documentation and the insurance routes page hold the reference.

Mistakes to Avoid

1. Treating dated or single sources as rules. The CMA report is twelve years old, and a FOS case study records one decision.
2. Naming the wrong regulator. Write the Information Commission, still known as the ICO.
3. Reading recognised legitimate interest as a basis for health data. Annex 1 has no heading about insurance or health care.
4. Mixing the two 72-hour clocks. One is a legal duty, and one is a contract term.
5. Treating a lookup result as proof of cover. It returns what the clinic recorded.

Frequently Asked Questions

What does this guide cover, and is it legal advice?

It explains how private medical insurance pre-authorisation and claims work for independent clinics in the United Kingdom. It draws on what the FCA, the Financial Ombudsman Service, the Competition and Markets Authority and the ICO say. It then covers UK data protection law for health data and outlines the ClinikEHR API in general terms. It is general information, not legal advice. It claims no approval, certification, registration, hosting or customers for ClinikEHR in the United Kingdom, so ask a UK lawyer about your own case.

What must a UK insurer do when it handles a claim?

The FCA's rule ICOBS 8.1.1R says an insurer must handle claims promptly and fairly. It must also give reasonable guidance to help a policyholder make a claim and appropriate information on its progress. It must not reject a claim unreasonably, and it must settle promptly once terms are agreed. Which policies and customers the rule reaches depends on ICOBS 1 Annex 1, which this guide did not apply. The Financial Ombudsman Service tells policyholders that an insurer has to handle claims promptly and fairly and should not reject a claim unreasonably. It says it may suggest compensation if it thinks a delay in authorisation was unnecessary. This is a rule for insurers, not for clinics. This guide found no time limit for an insurer's authorisation decision.

How did the CMA describe pre-authorisation in 2014?

In its 2014 final report the CMA recorded that insured patients are normally required to obtain pre-authorisation from their private medical insurer before treatment. It said the insurer typically checks whether the policy covers the procedure and whether the patient may use the clinic. It said the hospital and consultant submit their bills, probably direct to the payer, and that practice varies. The report is twelve years old and describes authorisation steps the patient starts, so treat it as history and not as today's rule.

What does UK law say about health data?

The UK GDPR defines data concerning health and treats it as special category data. Processing it needs a lawful basis under Article 6 and a condition under Article 9. The Data Protection Act 2018 routes those conditions to Schedule 1, which includes health or social care and insurance conditions. The Data (Use and Access) Act 2025 amended both texts, and since 30 September 2026 the regulator is the Information Commission, still known as the ICO. This is general information, not legal advice, and it does not say which condition any party uses for a claim.

What does enrollee lookup do in the ClinikEHR API?

An insurer or HMO that a clinic has linked can look up the enrollees the clinic has recorded, by insurance number. It reads the clinic's own record, so it is not a live eligibility check, and the clinic must already hold the enrollee. An insurer or HMO sees only its own enrollees. There is no sandbox data for the insurance routes, so a live key and a linked clinic are needed to try them.

What do claim decisions and payment advices do through the API?

A linked insurer or HMO can read a claim with its lines and decide it line by line, never approving more than was billed. For pre-authorization, it records one decision per request: approval with a PA code, or denial with a reason. A payment advice is a message to the clinic saying what was paid. No money moves through the API, and clinic staff record payments themselves. The API does not compare lines with an agreed price list and has no fraud scoring.

Who can use the ClinikEHR API, and what does it need?

An insurer or HMO applies, and a ClinikEHR reviewer decides, with no stated timeline. The insurer's or HMO's developer workspace needs the Enterprise contract plan. The clinic needs the Enterprise plan with API access switched on. Its owner sets Insurance to Outside the US, approves the connection with a recorded basis from the addendum's list (not a UK GDPR lawful basis) and links the insurer. This guide treats UK private medical insurers and administrators as market context only and does not say that either can apply or be linked.

Is ClinikEHR connected to any national or scheme system in the United Kingdom?

No. ClinikEHR is not connected to any national or scheme claims or health-information system, in the United Kingdom or anywhere. This guide claims no regulator approval, certification, registration, UK hosting or UK customers for ClinikEHR, and it does not say that any UK insurer uses the API. To judge any supplier, ask it for written answers to the questions in Step 3.

Conclusion

Before a clinic and an insurer link claim data, read the texts above. The FCA's rule sets how insurers must handle claims, and the Ombudsman takes complaints about them. The UK GDPR and the Data Protection Act 2018 are the UK texts on health data. No regulator text read describes an electronic exchange between a clinic and an insurer, so check each insurer's own requirements. A UK lawyer can say which rules apply to you.

An API only moves data between an insurer or HMO and a clinic. Any rules that cover that data still apply, and a UK lawyer can say which. If you want to know how access to the ClinikEHR API works, contact the team or open the developer portal. The pricing page lists the plans a clinic can choose.

Related Articles

• How to Build an HMO Claims Integration in Nigeria With the ClinikEHR API (Step-by-Step, 2027)
• Pre-Authorization API for Nigerian HMOs: Approve or Deny PA Requests With a PA Code (2027)
• Connecting Your HMO to the ClinikEHR API in Nigeria: Access, Approval and Data Protection Explained (2027)
• Building a Health-Insurance Startup for Emerging Markets: What Your Hospital Integration Must Do (2027 Developer Guide)

Facts are as of the dates shown. Check the linked sources for updates. This is general information, not legal or professional advice.