What Nigeria's digital-health direction means for a private hospital

Two questions come up whenever a Nigerian practice looks seriously at a records system, and both get answered wrongly in both directions.

Must patient records be held on servers inside Nigeria? And is there a Nigerian approval a clinical records system is supposed to have?

The honest answers today are no and no. But neither is a simple no, and the reasons are worth knowing, because one of them has a specified path to becoming yes.

The localisation question, precisely

On 17 August 2026 the Federal Ministry of Communications, Innovation and Digital Economy published the National Digital Cloud Policy, a 43-page framework that supersedes the Nigeria Cloud Computing Policy of 2019.

The ministry's own summary is unambiguous about the general position:

It therefore does not impose general data localisation requirements on commercial data. Sovereignty requirements are narrowly applied to defined categories of government and regulated data where national control is necessary.

So far, so simple. But read the policy itself and health is named. Its classification framework at Part 11.3 puts Level 3, "Highly Sensitive", as covering "sensitive personal data, regulated data including financial, health, biometric, and identity data", to be "stored in Nigeria at rest, with continuous sovereign recovery capability".

If you stop reading there you will conclude that clinical records must be hosted in Nigeria. Three further provisions say otherwise, and they matter more than the table.

Part 14.5 sets out what is actually in force: the policy's Part III (the sovereignty component, containing that classification and the residency rules) "takes effect upon Presidential approval in accordance with Part 11.7", while Parts I, II and IV took effect on publication.

Part 11.6 says that data generated under regulation, licence or directive becomes subject to that Part "only upon designation", and that "designation is a deliberate act requiring justification, not an automatic consequence of regulatory status".

Part 11.7 requires that any designation applying Level 3 to a category of regulated data carries its own Presidential approval, on top of the approval that brings the framework into force at all. The policy explains the design in a sentence worth quoting:

The asymmetry is intentional and favours openness: relaxation is administratively straightforward, while restriction requires Presidential authority.

Put together: reaching a real localisation obligation for a private hospital's records takes two distinct acts: Presidential approval of the framework, and then a designation of health data as a category, itself needing Presidential approval. Health is named, and the route is written down. Neither step has been taken as at the review date on this page.

That last sentence is the one that will age. Nothing announced by the ministry between the policy's publication and this review indicated that the sovereignty component had been approved. If you are making a hosting decision on the strength of this, check the ministry's announcements yourself before you act. This is exactly the sort of claim that is true on the day it is written and false a quarter later, which is why the date this page was last reviewed sits at the top of it.

There is no Nigerian approval to buy

The second question has a shorter answer.

The federal programme is the Nigeria Digital in Health Initiative. Its portal describes the initiative, its strategic pillars and its aspirations, and carries a documents page. What it does not publish is a set of standards for clinical software, a certification scheme, or a list of approved vendors. There is no Nigerian accreditation for an electronic medical record, and no register a practice could check a supplier against.

Which means that a supplier telling you their software is approved or certified in Nigeria for clinical use is describing something that does not exist. That is a useful question to put directly, because the answer tells you how carefully the rest of what they say has been checked. Ask which specific body issued it, and look the body up.

RizCare is not certified, not regulatorily approved and not clinically validated, and there is no Nigerian scheme under which it could be. We would rather say that than let the absence of a claim be read as one.

What does exist is data-protection registration with the Nigeria Data Protection Commission, which is a real, public, checkable filing. It is an obligation on your practice, not a badge on a product. What Nigerian data-protection law asks of a hospital that keeps records covers who has to register, which tier, and what else comes with it.

What is actually being built, and the date on it

None of the above means nothing is happening. Three things are worth a practice's attention.

A reporting spine already exists. Nigeria's National Health Management Information System was configured on the DHIS2 platform in 2010, and by December 2017 the routine immunisation module of that platform had been rolled out to all 36 states and the Federal Capital Territory, with all states reporting through it. Whatever comes next is being built on a system that already reaches every state for at least that programme.

An exchange is being planned, with a date. The Ministry of Health's account of the Nigeria Digital in Health Initiative (endorsed by the National Council on Health in November 2024) describes a Health Information Exchange "to allow seamless and secure data sharing across public and private facilities nationwide" and a Health Claims Exchange to track health financing and reduce fraud. The Minister of State for Health has framed both as an enabler "to be delivered before May 2027".

Note "public and private". A private hospital is inside the scope of what is being designed, not outside it.

Who coordinates it is still settling. A national coordinating office, the NHTDAO, was approved in 2026 with a pioneer national coordinator, and the commentary around it is not uniformly optimistic. Nigeria Health Watch's assessment puts the risk plainly: digital health leadership "should connect the system, not create new silos". A practice reading that should take it as a reason to avoid betting on any one initiative's timetable, rather than as a reason to wait.

What a practice can usefully do now

Keep your facility registration current. This is state law, not federal, and it is the obligation most likely to actually bite. In Lagos, every health facility must register with the Health Facility Monitoring and Accreditation Agency, through an application, document submission, inspection and certificate; operating unregistered draws a closure notice under section 60 of the state's Health Sector Reform Law. Every state has its own regulator with its own requirements, so confirm yours rather than assuming Lagos generalises.

Keep records in a form that can be counted and handed over. Whatever an exchange eventually asks for, it will ask for structure: a diagnosis in a consistent place, a date that is the date of the encounter, an identifier that stays with the person. A practice whose register can already answer "how many of this, since when" is a practice that will have a short conversation about it rather than a long one.

Ask a supplier where the data sits, and whether it could move. Not because you must host in Nigeria today (you need not) but because Part 11.6 exists, and the answer you want is a straight one rather than a reassuring one.

Do not buy on an approval claim. There is nothing to hold. Buy on what the software does with your records, and on whether your staff will use it.