In November 2025, Egypt's General Authority for Healthcare Accreditation (GAHAR) issued circular 84/2025, tightening what private clinic software is expected to support for GAHAR-2 accreditation. Three weeks later, Saudi Arabia's Council of Health Insurance (CCHI) finalized the e-claim specification for 2026. Both frameworks became effective in Q1 2026.
If you're operating a clinic in either country, your software vendor should have guided you through these changes in advance. In many cases, this has not happened.
Egypt — what changed in 2025-26
1. GAHAR-2 documentation requirements (effective March 2026) GAHAR-2 accreditation requires that patient interactions are documented in a structured way, including:
- ICD-10 coded diagnoses (not only free-text descriptions)
- Allergy reconciliation per visit (recorded and acknowledged)
- Medication reconciliation per visit
- Patient education documentation with acknowledgment
- Informed consent for procedures with moderate or high risk
Software that does not support structured capture of these elements may face challenges during accreditation inspections. Inspections began in April 2026.
2. UHIA Phase 5 expansion (ongoing rollout) The Universal Health Insurance rollout continues across Cairo, Giza, and Alexandria. Clinics participating in UHIA workflows are generally expected to:
- Submit claims electronically via HL7 FHIR R4
- Maintain an audit trail for submitted claims
- Respond to pre-authorization requests within required timeframes (typically 48 hours)
3. Egyptian Personal Data Protection Law (Law 151/2020)
- Patient consent must be explicit and purpose-specific
- Data subject rights must be handled within defined legal timelines
- Cross-border data transfer requires authorization
- Data breach notification is required within 72 hours
Saudi Arabia — what changed in 2025-26
1. CCHI e-claim format v3.0 (effective January 2026) The updated format introduces additional required fields compared to previous versions, including:
- Provider SCFHS number per encounter
- Service codes aligned with CCHI master service list
- Pre-authorization reference for higher-cost services
- ICD-11 codes for chronic conditions (where applicable)
Claims submitted in older formats may be rejected depending on system enforcement timelines.
2. SCFHS practitioner verification (Q2 2026) Clinical encounters are expected to be linked to verified practitioners. Systems should support:
- Verification of SCFHS registration during system access
- Prevention of documentation by unverified users
- Visibility of practitioner verification status on clinical records
3. Saudi PDPL enforcement (from Q3 2025 onward)
- Patient data residency requirements within KSA for regulated environments
- Explicit consent for communications and processing
- Data breach notification within 72 hours
- Financial penalties for violations under applicable regulations
The compliance checklist
Egypt:
- ICD-10 structured diagnosis coding
- Allergy reconciliation per visit
- Medication reconciliation per visit
- Patient education documentation with acknowledgment
- Informed consent capture with risk grading
- HL7 FHIR R4 claims submission support
- Pre-authorization response workflow
- Consent management under PDPL requirements
- Data subject rights workflow handling
- Breach detection and notification capability
Saudi Arabia:
- CCHI e-claim v3.0 format support
- SCFHS practitioner verification per encounter
- CCHI service code mapping
- ICD-11 support where required
- Integration with national practitioner systems
- Saudi data residency compliance
- PDPL consent management
- Security incident response workflow
If a clinic’s current software meets fewer than most of these requirements, it may face increasing operational and compliance pressure over time.
What enforcement typically looks like
Egypt — GAHAR inspections: Inspections are conducted with prior notice. Patient records are reviewed for structured documentation, coding accuracy, and consent handling. Non-compliance may affect accreditation status.
Saudi Arabia — CCHI audits: A percentage of insurance claims are audited periodically. Reviews typically focus on coding accuracy, practitioner verification, and pre-authorization alignment. Issues may result in claim adjustments or penalties.
Both countries — data protection enforcement: Investigations may be triggered by complaints or audits, with penalties applied according to applicable data protection laws.
The 5 changes most clinics need to prepare for
- Adopt systems that support structured ICD-10 / ICD-11 coding
- Map services to official payer catalogs where applicable
- Implement consent workflows tied to purpose of use
- Ensure data residency compliance where required
- Test incident detection and response procedures
Questions to ask any software vendor
- "How do you support GAHAR-2 documentation requirements?"
- "How ready is your system for CCHI v3.0 e-claims?"
- "Where is patient data hosted and stored?"
- "What is your incident response workflow in case of a data breach?"
- "How quickly do you adapt to regulatory changes in MENA healthcare systems?"
Vague answers such as "we are working on it" may indicate future compliance delays.
What ClinicOne provides
ClinicOne is built to support clinics working within evolving regulatory and payer requirements across the region. It includes support for:
- Structured ICD-10 and ICD-11 coding
- HL7 FHIR R4 integration for claims workflows
- CCHI e-claim format compatibility
- Practitioner verification workflows (where applicable)
- Tenant-based data residency options
- Consent management aligned with regional data protection laws
- Security and incident response workflows
If you're operating in Egypt or Saudi Arabia and want to evaluate your current readiness, book a compliance review call with our team to assess your setup against these requirements and identify potential gaps.
