The one-hour rule: how NHIA's authorisation deadline forces Nigerian HMOs to automate

Published 26 October 2026 · 6 min read · By Moyo Awoyokun, MB ChB, MBA, FIHIMCN

In brief

The National Health Insurance Authority's one-hour authorisation rule took effect on 1 April 2025. An HMO must approve a request, or communicate "no authorisation" with reasons, within one hour of the provider's submission. If the hour passes, the provider treats the patient and reports the HMO. Emergencies need no code before treatment at all. The rule exists because delayed codes were among the most common complaints the regulator received, and it has backed the rule with sanctions. For an HMO handling hundreds of requests a day across channels that do not even timestamp arrival, the rule cannot be met by adding staff. It can only be met by deciding the routine requests automatically and reserving people for the ones that need judgement.

What the rule says

The NHIA approved the change at a stakeholders' meeting in February 2025 and brought it into operation on 1 April 2025. The provisions are short.

• Authorisation shall no longer exceed one hour from the time of the provider's request.
• Where an HMO has justifiable reasons not to issue a code, it must communicate "no authorisation" within the same hour.
• Where the hour is exceeded, the provider proceeds with treatment and notifies the NHIA immediately. The NHIA verifies that the service was rendered.
• In emergencies no code is required before treatment begins; the code is obtained within 48 hours of starting care.
• HMOs and providers must keep records of every request and every response.
• Sanctions apply to entities that deliberately delay authorisation.

The rule arrived with enforcement behind it. In 2024 the NHIA received 3,507 complaints, with delays in referral authorisation among the leading categories, and sanctioned 49 facilities and 47 HMOs. By September 2026 it reported 3,878 complaints resolved, more than ₦14.2 million refunded to enrollees, 368 warning letters issued and nine facilities suspended.

The desk was never built for a clock

Authorisation in most Nigerian HMOs is a human process layered on whatever channel the hospital used. A request arrives by email, by WhatsApp to a case officer's phone, or by a call to a helpline. Someone reads it, checks the member's status, checks the benefit, checks the tariff, and replies. Press investigations in 2025 and 2026 described hospital staff waiting on HMO portals that were down, on pending emails, and on call centres that did not pick up, while patients waited or paid cash.

Three things make the sixty-minute clock hard to meet on that model.

The clock starts at submission, not at pickup. A request sent at 19:40 on a Saturday is already forty minutes late by the time the Monday shift opens it, unless someone is watching every channel around the clock.

Volume is lumpy. Take an HMO with 100,000 lives. If members average around two encounters a year and a quarter of those need authorisation, that is roughly 50,000 requests a year, or 140 on an average day, with peaks well above that on Mondays and during malaria season. Over a twelve-hour working day the average is one request every five minutes. A desk of four officers can read that volume. It cannot guarantee that every one of them is answered inside an hour, every hour, on every channel.

The record is the evidence. The rule requires a record of every request and response. When the request is a WhatsApp message on a personal phone, the HMO has no record it can produce, and no defence when a provider reports it.

The cost of failing is not only regulatory. Every request that overruns the hour is treated anyway, outside the HMO's decision, at a tariff the HMO has not checked. The one-hour rule converts slow authorisation directly into leakage.

So what can meet the clock?

If people cannot answer every request inside an hour, what can?

Automate the routine, gate the rest

A request can be decided automatically when three facts are known and the rule is clear: the member is active and within benefit, the service is covered at this provider, and the price is within the agreed tariff. For most elective procedures, routine diagnostics and chronic medication refills, all three can be checked in seconds against the HMO's own data. That is where automation belongs.

1. Capture every request in one timestamped queue. Whatever the channel, the request must land in a system that records arrival time. A provider portal is the cleanest route. Email and WhatsApp intake can be parsed into the same queue. Phone requests are logged by the officer who takes them. Without this, the HMO cannot measure its own compliance, let alone prove it.

2. Decide the clear cases by rule. Eligibility, benefit limit, tariff band and provider accreditation are deterministic checks. A rules engine applies them in under a second and issues the code. The 2024 to 2025 experience of several Nigerian operators suggests that elective and pharmacy requests, which are the bulk of volume, are where this works. Emergencies are already outside the rule and should stay outside automation.

3. Never deny automatically. A refusal is a decision with significant consequences for the member. Section 37 of the Nigeria Data Protection Act 2023 gives a data subject the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where an exception applies, the controller must still provide safeguards, including the right to human intervention and to contest the decision, and the NDPC's 2025 implementing directive expects safeguards against bias. Automated approval of a covered service harms no one. Automated denial should not happen. Requests that fail a rule go to a human within the hour, with the rule that failed attached, so the reviewer starts from the reason rather than from scratch.

4. Route the exceptions by cost and risk. High-cost procedures, unusual diagnosis-to-service combinations, and providers with a history of upcoding should go to a reviewer regardless of rule outcome. The point of automation is to free those reviewers from the routine so they have the hour to spend on the cases that need it.

5. Keep the record the regulator asked for. Every automated decision, every rule applied, every human override and every timestamp is stored. This is the audit trail that answers a provider complaint, and it is the dataset that shows the HMO where its own rules are too tight or too loose.

Done this way, the one-hour rule stops being a threat and becomes a metric. An HMO can state its median time to decision, the share of requests decided inside the hour, and the share decided by rule, and improve all three.

Three questions for an HMO executive

1. Measured from the provider's submission, not from your officer's pickup, what is your median time to decision today?
2. What share of your authorisation requests arrive through a channel that records their arrival time?
3. What share of last month's approved requests could have been approved by a rule, with no human involved?

If the answers are "we don't know", "less than half" and "most of them", the sixty-minute clock is already running against you.

Frequently asked questions

What is the NHIA one-hour authorisation rule?

From 1 April 2025, an HMO in Nigeria must approve a treatment authorisation request, or communicate a refusal with reasons, within one hour of the provider submitting it. If the hour passes, the provider treats the patient and notifies the NHIA.

Does the one-hour rule apply to emergencies?

No. In an emergency the provider treats first without waiting for a code. The authorisation code is obtained within 48 hours of the start of care.

What happens if an HMO misses the one-hour deadline?

The provider proceeds with treatment and reports the delay to the NHIA, which verifies the service was rendered. Enrollees can also report delays directly. The NHIA has said sanctions apply to entities that deliberately delay authorisation.

Can HMOs automate pre-authorisation decisions?

Approvals for routine, elective and chronic pharmacy requests can be decided by rules against eligibility, benefit and tariff data. Denials should always involve a person, both for the member's sake and because section 37 of the Nigeria Data Protection Act 2023 gives individuals the right not to be subject to purely automated decisions that significantly affect them, with a right to human intervention.

For a full governance framework covering what to automate and how to evidence it, see the white paper Auditable AI for Nigerian health insurers. For the mechanics of authorisation as a control point, see what pre-authorisation is and why real-time beats retrospective review. For the market the rule now governs, see Nigeria's health insurance market after the NHIA Act.

Sources

1. Channels TV, "Approve treatment within one hour, NHIA directs HMOs", 7 April 2025 (rule provisions, effective date, emergency and record-keeping clauses).
2. The Sun (Nigeria), "NHIA mandates HMO to issue authorisation codes in 1hr", April 2025.
3. 21st Century Chronicle, "NHIA sanctions 96 health providers, HMOs", 30 June 2025 (2024 complaints and sanctions).
4. The Guardian (Nigeria), "NHIA enrolment hits 23m as cancer, HIV/TB coverage expands", 20 September 2026 (2025 to 2026 complaints, refunds, warnings, suspensions).
5. Blueprint, "NHIA reluctant as Nigerians groan over near-death experiences with HMOs", August 2026 (investigation of authorisation delays at accredited hospitals).
6. Nigeria Data Protection Act 2023, section 37 (automated decision-making), and NDPC General Application and Implementation Directive 2025, article 18.