Healthtech Software in Nigeria: Building Around NHIS and Patient Data Realities | Blog

# Healthtech Software in Nigeria: Building Around NHIS and Patient Data Realities

TL;DR: Nigeria's shift to mandatory health insurance and its 2023 data protection law mean healthtech software can no longer be a generic booking app with a stethoscope icon — it has to be built for NHIA claims data, MDCN telemedicine rules, and sensitive-data handling from day one, or it will stall the moment it needs an insurer, a hospital, or an investor.

Why "just build an app" doesn't work anymore

For years, Nigerian healthtech meant a doctor-on-demand app bolted onto WhatsApp and a card payment gateway. That's no longer enough. Two structural shifts changed the ground rules.

First, health insurance stopped being optional. The National Health Insurance Authority (NHIA) Act, signed into law in May 2022, made the NHIA the sole regulator of health insurance in Nigeria and made insurance mandatory for every employer with five or more staff, covering the employee, one spouse, and up to four children under 18 (NHIA Act 2022). That mandate is now actively being enforced: federal payroll deductions for the scheme began in October 2025, following a presidential directive pushing mandatory enrolment across all government ministries, departments, and agencies (NHIA presidential directive). Any software that touches billing, appointments, or records in a Nigerian clinic will sooner or later need to speak the language of NHIA-accredited HMOs, capitation, and claims — not just Paystack or Flutterwave.

Second, patient data stopped being "just PII." The Nigeria Data Protection Act (NDPA) 2023 replaced the older NDPR and explicitly classifies health information as sensitive personal data, alongside biometric data and genetic data (NDPA overview, CookieYes). In March 2025 the Nigeria Data Protection Commission (NDPC) issued the General Application and Implementation Directive (GAID), which took effect in September 2025 and formally retired the old NDPR framework, tightening expectations around breach notification (72 hours to the NDPC for high-risk breaches), lawful basis for processing, and mandatory Data Protection Officers for "data controllers of major importance" (NDPC GAID 2025). The NDPC isn't a paper tiger either — in August 2025 it opened investigations into 1,368 organisations across finance, insurance, and other regulated sectors (AllAfrica), a signal that health data controllers should expect the same scrutiny.

What this means for the build, not just the pitch deck

1. Design for NHIA claims from the schema up

If a product will ever touch insured patients — and given the mandate, most eventually will — the data model needs to separate enrollee identity, HMO/plan association, encounter/diagnosis coding, and claims status as distinct entities from day one. Retrofitting this after launch usually means a painful migration of patient records. Fields worth having even before an HMO integration exists:

NHIA/HMO enrollee ID and plan tier
Capitation vs. fee-for-service encounter flags
ICD-coded diagnosis and procedure fields (insurers reject free-text claims)
Claim status lifecycle (submitted → adjudicated → paid/rejected)

2. Treat health data as sensitive by default, not by exception

Under the NDPA, health records need a documented lawful basis for processing, encryption in transit and at rest, strict role-based access, and audit logging sufficient to prove who accessed what and when — this last part matters as much for MDCN's confidentiality rules as for the NDPC. The Medical and Dental Council of Nigeria's Code of Medical Ethics already requires practitioners to maintain "utmost confidentiality of patient information" and explicitly recommends encryption for transferring patient data in its telemedicine guidance (Guideline 22) (Chambers and Partners). Practically, this means:

Encrypting PHI at rest and in transit as a baseline, not an upsell
Building a real audit trail (who viewed/edited a record, when, from where) rather than relying on generic application logs
Data minimisation — don't collect fields a clinical or claims workflow doesn't actually need
A documented breach-response runbook, since the 72-hour NDPC notification clock starts the moment a controller becomes aware of a high-risk incident

3. Plan for interoperability gaps, don't assume them away

Nigeria doesn't yet have a mature, mandated national interoperability standard the way some markets do. Research reviewed in PLOS Digital Health identifies interoperability as one of the most persistent structural barriers to digital health delivery in the country, and while HL7 FHIR is gaining traction as the preferred open standard for health data exchange in African contexts, Nigeria has limited representation in the standards bodies that shape it (PMC scoping review). In practice, this means most facilities run on paper, Excel, or disconnected point solutions. A realistic build:

Uses FHIR-shaped internal data models even where no external FHIR endpoint exists yet, so future integration is additive, not a rewrite
Supports manual CSV/Excel import and export as a fallback for facilities that will never have an API
Treats every hospital or HMO integration as bespoke until proven otherwise — Nigerian EMR/HIS integration work is still largely point-to-point, not standards-driven (elabassist on HIS/EMR integration challenges)

4. Get the telemedicine licensing model right before scaling clinicians

MDCN has confirmed that telemedicine consultations count as the practice of medicine and fall squarely under its jurisdiction — meaning every prescribing clinician on a platform needs a valid, current MDCN practising licence, and the platform itself needs to be built around that verification, not around volume (MDCN telemedicine regulation, Global Law Experts). Skipping licence verification at onboarding is a recurring failure mode in fast-scaling telehealth products.

The market context: funding is down, scrutiny is up

Nigeria's healthtech sector has grown fast — the country now counts around 128 active healthtech startups, with roughly 65 new entrants between 2020 and 2025, more than the 103 launched in the fifteen years before that (TechCabal). But funding has cooled sharply: sector investment peaked near $55 million in 2023 and fell to roughly $3–4 million in 2025 (TechCabal). In a tighter funding environment, investors and hospital/insurer partners are doing more diligence, not less — a product that can demonstrate NDPA-aligned data handling and a credible path to NHIA/HMO integration is meaningfully more fundable and more partnerable than one that can't.

Regulatory layer	Body	What it means for your build
Insurance	National Health Insurance Authority (NHIA)	Claims-ready data model, HMO plan/enrollee fields, mandatory for employers with 5+ staff
Data protection	Nigeria Data Protection Commission (NDPC), under NDPA 2023	Sensitive-data handling, 72-hour breach notice, DPO for major controllers
Clinical practice	Medical and Dental Council of Nigeria (MDCN)	Licence verification for prescribing clinicians, confidentiality obligations

Where this fits into a build roadmap

None of this means a Nigerian healthtech MVP needs to launch with full NHIA claims automation or a certified FHIR gateway — that would be over-engineering for a product that hasn't found its first paying clinic yet. It means the underlying architecture (data model, access control, audit logging, integration boundaries) should be laid out so those capabilities can be added without a rebuild. That's the kind of groundwork a custom software engagement is meant to get right early — structuring the data model, auth, and integration layer around where the regulation and the market are actually heading, rather than shipping something that has to be torn up in 12 months.

FAQ

Does every Nigerian healthtech app need NHIA integration to launch?

No. Early-stage products (symptom checkers, appointment booking, pharmacy delivery) can launch without it. But if the product touches billing, diagnosis, or clinical records at a facility with insured patients, the data model should be NHIA/HMO-claims-ready from the start to avoid a costly migration later.

Is patient data automatically "sensitive personal data" under Nigerian law?

Yes. The NDPA 2023 explicitly classifies health information as sensitive personal data, alongside biometric and genetic data, which triggers stricter consent, security, and breach-notification obligations than ordinary personal data.

Can a startup legally offer telemedicine in Nigeria without MDCN-licensed doctors?

No. MDCN treats telemedicine consultations as the practice of medicine, so every prescribing or diagnosing clinician on the platform needs a current MDCN practising licence — this should be enforced at clinician onboarding, not left to manual spot-checks.

What's the single biggest technical mistake healthtech teams make in Nigeria?

Treating health records like generic app data — storing free-text diagnoses, skipping audit logs, and ignoring claims/plan fields — and then having to re-architect the data model once an HMO, hospital, or the NDPC comes asking.