Industry · Healthcare

Healthcare data automation for South African practices, hospitals and schemes

Claims that go out complete and come back explained, bookings that do not need a phone call, and reporting that reconciles to the remittance. We automate the admin around the clinician — never the clinical decision — under POPIA, the National Health Act and the HPCSA's AI guidelines.

Discuss your project
9.17m
medical scheme beneficiaries in 2024, across 71 schemes and 33 administrators
Source: Council for Medical Schemes, Industry Report 2024
R259.3bn
in healthcare benefits paid by medical schemes in 2024, up 8.52% on 2023
Source: Council for Medical Schemes, Industry Report 2024
57.43%
of risk benefits paid in 2024 went to Prescribed Minimum Benefit conditions
Source: Council for Medical Schemes, Industry Report 2024

Why healthcare automation starts with the claim, not the chatbot

Private healthcare in South Africa runs on a claim. Medical schemes covered 9.17 million beneficiaries in 2024 and paid R259.3 billion in benefits, and almost every rand of that moved as a coded account: patient and membership details, a practice number, an ICD-10 diagnosis code and a tariff code for each service. When any of those is wrong, the money stops and someone at reception picks up the phone.

That is why we start with the data rather than the interface. The rules are written down — Regulation 5 of the Medical Schemes Act lists what every account must contain, and Regulation 6 gives schemes 30 days to say a claim is wrong and providers 60 days to fix it. Rules that precise are what software checks well. A claim can be tested before it leaves the practice, and a rejection can be read, classified and either corrected or routed to the right person while the clock is still running.

Health information is also the most sensitive data a business holds. POPIA treats it as special personal information, the National Health Act makes it confidential and makes it an offence to connect a records system to another system without authority, and the HPCSA's 2025 AI guidelines say the practitioner always makes the final decision on patient care. So we draw a clear line: automation handles bookings, claims, reconciliation and reporting; clinicians handle diagnosis and treatment; and every integration is authorised, logged and minimised.

We have not yet published a healthcare case study, so we will not pretend otherwise. The closest proof is in other regulated work: document intelligence with human review for FICA checks at a South African neo bank, and an AI contact-centre layer that answers routine queries and hands the rest to a person with the full context. Claims intake and practice reception have the same shape — automate the clear cases, route the uncertain ones, evidence everything.

Data engineering for governed health dataWhatsApp automation for bookings and remindersCase study: document intelligence for FICA compliance
How it works

How a medical claim moves through an automated pipeline

From the consultation to the money in the bank. The practitioner still chooses the diagnosis and the codes; the automation makes sure the claim is complete, on time and followed up — and that a person sees anything it cannot fix.

  1. STEP 01

    Visit captured

    The booking already holds the patient's scheme, membership number and dependant code, confirmed at check-in, so the account does not start with a gap.

  2. STEP 02

    Account checked before it leaves

    After the practitioner codes the visit, every line is tested for what Regulation 5 requires — ICD-10 code, tariff code, practice number, dates — and possible PMB conditions are flagged. Nothing is coded for the practitioner.

  3. STEP 03

    Submitted and tracked

    The claim goes to the scheme with a reference, and its four-month submission window and any correction deadline are tracked from that moment, not discovered later.

  4. STEP 04

    Response read and classified

    Remittances and rejections are read as they arrive, matched to the original claim, and the rejection reason is classified so it can be dealt with — not left in an inbox.

Automated

Administrative fix: corrected and resubmitted

A wrong dependant code, a typo in a membership number, a missing practice number — corrected from source data within limits you set and resubmitted inside the 60-day window.

Human decides

Clinical or coding query: routed to a person

Diagnosis codes, PMB disputes and anything needing clinical judgement go to the billing team or the practitioner, with the scheme's reason and the deadline attached.

Every claim accounted for

Status, age, rejection history and who touched it, for every claim — so month-end reconciliation and a scheme query are both a report, not a search through email.

Guides

Healthcare automation, explained: how to do it and why it is hard

The questions practice managers, hospital finance teams and scheme operations leads actually ask, answered plainly. Each starts with a short answer you can take into a meeting, then the steps or reasons behind it.

01 · How to

How do you automate medical aid claims and rejections in South Africa?

Short answer

Check every account against Regulation 5 of the Medical Schemes Act before it is submitted, track each claim against its deadlines, and classify every rejection as it arrives. Fix administrative errors automatically and send coding or clinical queries to a person, inside the 60 days the regulations allow for correction.

  1. 1

    Measure today's rejection rate and the most common rejection reasons first. Without a before-number there is no business case.

  2. 2

    Capture scheme, membership number and dependant code at booking and confirm them at check-in, so errors are stopped before the visit.

  3. 3

    Test each account for what Regulation 5 requires: patient and member details, practice number, ICD-10 diagnosis code, tariff codes and service dates.

  4. 4

    Track the four-month submission window and the 60-day correction window for every claim from the day of service.

  5. 5

    Read remittances and rejections automatically and match them to the original claim.

  6. 6

    Correct administrative errors from source data; send diagnosis, coding and PMB questions to the billing team or practitioner with the reason and deadline attached.

Source: Regulations under the Medical Schemes Act, Regulations 5 and 6 (CMS)
02 · Why

Why do medical aid claims get rejected?

Short answer

Mostly for administrative reasons, not clinical ones. Regulation 5 lists what every account must contain, including the diagnostic and item codes, and a scheme that finds an account erroneous must say why within 30 days. Missing or wrong details, late submission and incorrect ICD-10 coding are the usual causes.

  • Missing diagnostic or item codes: Regulation 5(f) requires the relevant diagnostic and item code numbers on the account.

  • Wrong patient or member details: surname, initials, membership number and the scheme name are all required fields.

  • Late submission: schemes may refuse accounts submitted after the end of the fourth month from the date of service.

  • Incorrect ICD-10 coding: the CMS points out that PMB conditions can only be identified with the correct ICD-10 codes, so a wrong code can send a claim to the wrong benefit.

  • Benefit limits and pre-authorisation gaps on the patient's option. (From what we see in practice billing, not from a published rejection study.)

Source: CMScript: The coding and funding of medical scheme claims (CMS)
03 · How to

How do you use AI with patient data and stay POPIA-compliant?

Short answer

Treat health information as what POPIA says it is: special personal information. Process it only under an authorisation in section 32 — for treatment, practice administration, or a medical scheme agreement — by people bound by confidentiality, keep it out of models that do not need it, and log every access.

  1. 1

    Confirm which section 32 authorisation each process relies on: treatment and care, practice administration, or the performance of a medical scheme agreement.

  2. 2

    Make sure everyone processing the data is under a duty of confidentiality, as section 32(2) requires — including your vendors, by written agreement.

  3. 3

    Mask ID numbers, diagnoses and contact details before any model sees a record it does not need them for.

  4. 4

    Know where the data goes. Sending it to a model hosted outside South Africa is a cross-border transfer under section 72.

  5. 5

    Get written authority before connecting any system to your records system; the National Health Act makes an unauthorised connection an offence.

  6. 6

    Keep access logs good enough to answer "who saw this patient's record, and why".

Source: POPIA section 32 — health information
04 · Why

Why does it matter whether healthcare software counts as a medical device?

Short answer

Because SAHPRA regulates AI with a medical purpose as a medical device, and software that drives or influences clinical decisions will likely fall into its higher-risk classes. Admin automation such as bookings, claims and reconciliation has no medical purpose. Keeping that line clear keeps a project out of device regulation.

  • SAHPRA's September 2025 communication covers software as a medical device and software in a medical device that uses AI or machine learning.

  • AI intended to drive or influence clinical decisions, where an error could cause significant harm, will likely be Class C or D.

  • A general-purpose language model is not a medical device on its own, but SAHPRA says it qualifies once adapted to a specific medical purpose — for example with an instruction prompt.

  • The intended purpose is decided by whoever builds or imports the product, so write it down and keep the build within it.

  • If a feature drifts towards triage or diagnosis, stop and get regulatory advice before building it. (Our practice, not a SAHPRA requirement.)

Source: SAHPRA communication MD08-2025/2026 — AI/ML-enabled medical devices
05 · How to

How do you get healthcare data ready for automation and reporting?

Short answer

Bring practice management, billing, remittance and booking data into one governed platform, standardise it in tested layers, and control access from day one. Most healthcare reporting problems are matching problems — the same patient, claim or scheme recorded differently in different systems — so resolve those before building dashboards or models.

  1. 1

    List every source: practice management system, billing, claims switch responses, remittance advices, booking tools and spreadsheets.

  2. 2

    Land raw data unchanged, then clean and standardise it in tested layers so every change is visible.

  3. 3

    Match patients, members and claims across systems before anything else. (In our experience this is where most of the effort goes.)

  4. 4

    Agree definitions with finance and practice managers — what counts as a rejected, paid or written-off claim — before building a report.

  5. 5

    Classify health information and restrict it by role; most reports need counts and amounts, not diagnoses.

  6. 6

    Keep records for as long as the HPCSA's guidance expects, and enforce retention in the platform rather than in a policy document.

Source: National Health Act 61 of 2003, sections 14 to 17
Challenges We Solve

The hard problems Healthcare faces

Claims that come back

A missing ICD-10 code, a wrong dependant code or a lapsed membership number sends an account back. Regulation 5 of the Medical Schemes Act lists what an account must contain, so most of these are checkable before submission — but in most practices nobody checks until the scheme does.

Deadlines nobody is tracking

Schemes can refuse accounts submitted more than four months after the service, and a returned account has to be corrected within 60 days. Practices that track claims in spreadsheets find out a claim has expired when the patient calls about a statement.

Reception carrying the whole practice

Bookings, reschedules, eligibility checks, pre-authorisations, scheme queries and payment follow-ups all land on the same front desk, usually by phone. The admin load grows with every practitioner added to a group.

Health data with strict rules attached

Health information is special personal information under POPIA and confidential under the National Health Act. Copying records into a spreadsheet, a personal WhatsApp or an unvetted AI tool creates exactly the exposure those laws were written to prevent.

By line of business

Where automation fits, by type of healthcare business

A hospital group, a radiology practice and a scheme administrator all handle claims, but the first process worth automating is different for each.

First win: Pre-auth and billing

Private hospital groups and day hospitals

Hospitals were the largest category of scheme spend in 2024, at 35.95% of benefits paid. Assembling pre-authorisation requests, reconciling remittances across schemes and reporting across facilities are high-volume, rule-heavy and well suited to automation.

First win: Front desk and claims

Multi-practice GP and specialist groups

Groups multiply the same admin across every room: bookings, reminders, eligibility, claims and follow-ups. One booking-to-claim pipeline shared by all practitioners removes duplicate effort and gives the group a single view of what is owed.

First win: Referral data and volume

Pathology and radiology practices

Very high claim volumes with patient details captured second-hand from referral forms. Reading referrals, validating member details before the test, and matching results to accounts cuts the rework that comes from bad demographic data.

First win: Claims intake and reporting

Medical scheme administrators and managed care

Administrators sit on the other side of the same account. Document intelligence for claim and pre-auth intake, queues that send PMB and clinical-review cases to the right people, and governed reporting to trustees and the Council for Medical Schemes.

Our Solutions

What we build for you

01

Claims checking and rejection handling

Every account is tested against the required fields and coding rules before it is submitted, tracked against its deadlines after, and every rejection is read and classified — corrected automatically when the fix is administrative, routed to a person when it is clinical.

02

Booking, reminders and patient admin

Patients book, confirm and reschedule on WhatsApp or the web, synced to your practice calendar, with membership details collected up front so the claim starts clean. Anything clinical is handed to staff, never answered by a bot.

03

Governed health data platform

Practice, billing and remittance data in one controlled place, with access logging, masking and retention rules enforced by the platform — so group reporting, scheme reconciliation and audit questions are queries rather than projects.

Regulatory context

The rules healthcare automation has to live inside

South African healthcare has more written rules about data than almost any other sector, and several changed in the last year. Here is where they stand as of October 2026, with dates, so you can check rather than take our word for it.

  1. Signed 15 May 2024; no section in force; Constitutional Court judgment reserved

    National Health Insurance Act 20 of 2023

    The President signed the NHI Act on 15 May 2024. On 24 February 2026 the Presidency agreed to delay proclaiming any section until the Constitutional Court rules on challenges by the Board of Healthcare Funders and the Western Cape government over public participation. The court heard them on 5–7 May 2026 and reserved judgment. We had not found a judgment as of early October 2026 — check before relying on this.

  2. Constitutional Court, 18 May 2026

    Certificate of need struck down

    In Solidarity Trade Union and Others v Minister of Health, the Constitutional Court confirmed that sections 36 to 40 of the National Health Act — which would have required practitioners and facilities to hold a certificate of need — are unconstitutional. The Minister had described the scheme as a central pillar of NHI implementation, so expect the NHI timetable to shift.

  3. In force

    POPIA: health information is special personal information

    Section 26 prohibits processing health information unless an authorisation applies. Section 32 provides them: for practitioners and facilities where processing is necessary for treatment or for administering the practice, and for medical schemes, administrators and managed care organisations where it is necessary for the scheme agreement. Everyone processing it must be bound by confidentiality.

  4. In force — sections 14 and 17

    National Health Act: confidentiality and record systems

    Section 14 makes all information about a patient's health status, treatment or stay confidential. Section 17 requires the person in charge of a health establishment to control access to records and the systems that hold them, and makes it an offence to connect a records system to another computer system without authority. Integration work needs that authority in writing.

  5. Published September 2025

    HPCSA Booklet 20: ethical use of AI

    The HPCSA's first AI guideline applies to every registered practitioner. It recognises AI's potential to reduce administrative burden, but says practitioners must always make the final decision on patient care and that AI should not be the final decision maker. Patients must be told when an AI tool is in use, including its capabilities and limitations.

  6. Communication MD08-2025/2026, 26 September 2025

    SAHPRA on AI-enabled medical devices

    SAHPRA's first consolidated position on AI and machine-learning medical devices. AI that drives or influences clinical decisions will likely fall into the higher-risk classes, and a general-purpose language model becomes a medical device once adapted to a medical purpose. Admin automation sits outside this — provided its intended purpose stays administrative.

  7. In force — Regulations 5 and 6

    Medical Schemes Act: account contents and claim deadlines

    Regulation 5 lists what every account must contain, including diagnostic and item codes; ICD-10 has been the diagnostic standard since 1 July 2005. Regulation 6 lets schemes refuse accounts submitted after four months, requires them to explain an erroneous account within 30 days, and gives 60 days to correct and resubmit. These are the rules a claims pipeline enforces.

Where we start

Engagements we run in Healthcare

01

Claims pre-checks and a rejection workqueue

Accounts tested against Regulation 5 before submission, every claim tracked against its four-month and 60-day deadlines, and rejections classified on arrival — administrative fixes resubmitted automatically, coding and clinical queries sent to the right person with the reason attached.

02

WhatsApp booking, reminders and pre-visit admin

Patients book, confirm and reschedule on WhatsApp or the web, and send membership details and consent before they arrive. Anything clinical is passed to staff; the bot never offers medical advice.

03

Remittance reconciliation across schemes

Remittance advices read and matched to claims line by line, short payments and rejections surfaced, and the debtors' book reconciled daily rather than at month-end.

04

Pre-authorisation packs for hospital admissions

Booking, referral and scheme data assembled into the pre-authorisation request, with the reference carried through to the final account so the hospital bill matches what was authorised.

05

Claims and pre-auth intake for scheme administrators

Document intelligence that reads incoming claims and supporting documents, routes possible PMB and clinical-review cases to the right queue, and keeps an evidenced trail of who decided what.

06

Group reporting on a governed data platform

Practice, billing and remittance data from every site in one platform with role-based access and masking, so a group sees revenue, rejection rates and debtor days per practice without anyone exporting patient data to a spreadsheet.

Proof

Work we have shipped in regulated financial services

Same regulators' expectations, same compliance shape: automate the clear cases, route the uncertain ones to a person, evidence every decision.

Automating FICA Compliance for a South African Neo Bank with Google Vertex AI
Case study · Fintech

Automating FICA Compliance for a South African Neo Bank with Google Vertex AI

90%
Reduction in fraud detection latency
75%
Of KYC reviews fully automated
Read the case study
AI-Powered Call Centre Automation for a South African Telecoms Operator
Case study · Telecommunications

AI-Powered Call Centre Automation for a South African Telecoms Operator

65%
Of calls fully resolved without human agent
42%
Reduction in average handle time
Read the case study
Key terms

Healthcare terms, in plain language

ICD-10
The international diagnostic coding standard, adopted in South Africa on 1 July 2005. A diagnosis code is required on accounts submitted to medical schemes.
PMB (Prescribed Minimum Benefits)
Conditions and treatments that medical schemes must fund in full under Regulation 8 of the Medical Schemes Act. They accounted for 57.43% of risk benefits paid in 2024.
Tariff (procedure) code
The item code that describes the service rendered on an account. Regulation 5(f) requires it alongside the diagnosis code.
Remittance advice
The scheme's statement of what it paid, short-paid or rejected on each claim. Reconciling remittances to claims is one of the most automatable tasks in a practice.
Medical scheme administrator
A company accredited by the Council for Medical Schemes to run a scheme's day-to-day operations, including claims. The CMS regulated 33 in 2024.
Special personal information
POPIA's category for the most sensitive data, including health. It may only be processed under specific authorisations, such as section 32 for health bodies and medical schemes.
Pre-authorisation
A scheme's approval obtained before a planned admission or procedure. Missing or mismatched pre-authorisations are a common reason hospital accounts are short-paid.
SaMD (software as a medical device)
Software intended for a medical purpose without being part of a hardware device. In South Africa SAHPRA decides whether, and at what risk class, it is regulated.
FAQ

Healthcare questions

From our blog

POPIA-compliant WhatsApp automationPOPIA as a catalyst for better workflow automationDocument workflow automation: beyond the PDF5 data quality pitfalls silently killing your automation

Sources & further reading

Related Services
WhatsApp AutomationAI ChatbotsWorkflow Automation

Ready to transform your Healthcare data strategy?

Let's discuss the specific challenges your business faces and design a solution that delivers real impact.

Book a free AI assessmentView our services