Pre-alpha · Architecture phase

Who pays when a patient walks into a Saudi hospital?

A decision service that identifies the liable insurance entity for a medical case in the Kingdom of Saudi Arabia — across CCHI, NPHIES, GOSI, MoH, military health systems, Aramco, Najm/MTPL, and a fragmented landscape of private TPAs.

Headline finding · refined 3 May 2026

KSA has no general Coordination of Benefits cascade for cooperative health insurance. CHI, NPHIES, and the Insurance Authority all assume single-source coverage per beneficiary. One narrow exception surfaced in the second-pass extraction: CCHI Visitor Insurance Article 6 establishes a pay-and-subrogate model — the only explicit COB clause in any KSA primary cooperative-insurance regulation. The general regime still requires composing routing from five distinct rule families — exactly what this service does.

5
Rule families composed
16 / 16
Priority PDFs extracted
30+
Verbatim citations captured
1 / 30
Open questions answered

The problem in one paragraph

When a beneficiary visits a hospital in KSA, the hospital typically defaults to a single insurance provider for billing. In reality, liability is fragmented — CCHI, MoH, NPHIES, GOSI, MoI, MoD, NGHA, SAMSO, Najm, and many private TPAs all have their own rules. Whose rules apply depends on the type of case, the beneficiary's class, and the circumstances of injury. We answer that question from primary regulatory sources.

The five rule families we compose

Multi-coverage routing is determined by applying these in order. The first family that yields a verdict wins. Click any source pill to see the verbatim quotation and the link to the primary document.

1 Statutory carve-outs

Highest precedence. Work injury → GOSI Occupational Hazards (Social Insurance Law M/273 of 1445H, Arts. 28/30/31/32 — supersedes the older M/33 of 1421H). RTA bodily injury → MTPL of at-fault driver. The work-injury carve-out is now confirmed verbatim in CCHI EBP §3.A.7 — Q1.1 ANSWERED.

Sources:

2 Emergency override

Orthogonal to all others. Hospitals must treat first regardless of nationality, employer, or insurance — verbatim from MoH Annex 66 Article 1 + Health Law M/11 §5.E. 24-hour rule located 3 May 2026: the private hospital notifies an MoH-appointed TPA (not the patient's CCHI insurer) per Annex 66 Art. 3; TPA decides between transfer to a government hospital or state-funded continuation. CCHI Urgent Circular §6 separately exempts the three urgent levels from co-payment. Annex 66 Art. 5 establishes a Saudi-CCHI-cap-exhausted cascade: when private cap exhausted, MoH bears continuation via the TPA.

Sources:

3 Facility-driven routing

NGHA, MSD, MoI Medical, SAMSO, and Royal Commission are closed-system payers — they pay only at their own facilities. An NGHA-eligible person walking into a private hospital does not get NGHA coverage applied.

Sources:

4 Beneficiary-class assignment

CHI's Beneficiaries Policy is an anti-duplication assignment rule, not a cascade. Default: husband's employer covers children. One unified policy per employer. Resolves which insurer is responsible at all — not how two split a bill.

Source:

5 Default to private cover

What's left after the above: routine encounters → primary CCHI insurer. Special-case schemes apply if active: Hajj/Umrah pilgrim, Visitor (with explicit pay-and-subrogate COB clause in Article 6 — the only published COB cascade in any KSA cooperative regulation), Domestic Worker. Otherwise the uninsured cascade from rule family 2 takes over.

Sources:

Why this matters

NPHIES — KSA's national FHIR-based eligibility exchange — does not return a primary/secondary indicator when a patient has multiple coverages. Coverage.order is unconstrained. Hospitals and TPAs make the call ad-hoc. This service makes it consistent, auditable, and citation-backed.

Source:

How the algorithm composes the rules — decision flow

The five rule families execute as a layered cascade. The first family that yields a verdict wins. Diplomatic mission staff short-circuit at the top (Vienna Convention exemption, never enter the CCHI cascade). Verbatim Annex 66 mechanics surfaced in the second-pass extraction.

RF-0 · short-circuit

Diplomatic / IO exemption

Per Vienna Convention 1961 Arts. 23/33/34, diplomatic mission staff and accredited international-organisation staff are exempt from KSA mandatory CCHI. They never enter the cascade.

if beneficiary.class ∈ {DIPLOMATIC_MISSION, INTL_ORGANIZATION} → Embassy direct / IO insurer / Self-pay
VCDR 1961 Arts. 23, 33, 34
if not exempt
RF-1 · highest precedence

Statutory carve-outs

Statute makes a specific payer the sole primary, regardless of any private insurance.

if case.type == work_injury AND beneficiary GOSI-registered → GOSI Occupational Hazards
SIL M/273 Arts. 28/30/31/32 + EBP §3.A.7 (Q1.1 ANSWERED)
if case.type == rta AND bodily injury AND Najm report present → MTPL of at-fault driver (CCHI subrogation)
Unified MTPL Policy Arts. 3/4/6 + Visitor Insurance Art. 6 (subrogation analogue)
if not statutory carve-out
RF-2 · orthogonal override

Emergency cascade (corrected per Annex 66)

Treat-first obligation always applies (Annex 66 Art. 1). Within 24 hours, private hospital notifies the MoH-appointed TPA via purchasingprogram.com.sa; TPA decides between transfer or state-funded continuation.

if Saudi with CCHI AND policy cap exhausted (or service excluded) → MoH-funded continuation via TPA
Annex 66 Art. 5(a)/(b) — closest published COB cascade
if patient has CCHI → CCHI insurer (copay waived for urgent levels)
Annex 66 Art. 1 + CCHI Urgent Circular §6
if uninsured AND in Annex-66-eligible category → State via TPA
Annex 66 Arts. 1/3/4 — TPA-mediated state-funded backstop
if uninsured non-Saudi worker → Employer (statutory duty to insure)
Cooperative Health Insurance Law M/10 Arts. 2-3
if not emergency
RF-3 · facility-driven

Closed-system providers

NGHA, MSD, MoI Medical, SAMSO, RCJY pay only at their own facilities. University Medical Cities (KAUH, KSUMC, KFSHRC) are open referral receivers — multi-payer, not closed.

if facility ∈ closed-system AND beneficiary eligible for that system → that closed system pays
if eligible-for-closed-system but at a non-system facility → AMBIGUOUS (Q3.4) · falls through to RF-2 if emergency
if no closed-system match
RF-4 + RF-5 · default

Anti-duplication assignment + private cover

For routine care after the above. Husband-employer rule is interpretive (CCHI FAQ #37, not the Beneficiaries Policy itself — verified by deep-mine). Visitor Insurance Art. 6 is the only published COB pay-and-subrogate clause.

if exactly one CCHI coverage → that insurer
if multiple CCHI coverages → apply CHI FAQ #37 husband-employer rule → assigned insurer (medium confidence)
if multi-CCHI not resolved by assignment (e.g., personal + group) → AMBIGUOUS (Q5.1) · human review
if special-case scheme active (Visitor / Hajj / Domestic Worker) → that scheme
Visitor Insurance Art. 6 = pay-and-subrogate if other coverage exists
if uninsured (no special case) → apply RF-2 emergency cascade if applicable, else out-of-pocket

Research coverage map

Where the research stands today: KPIs at the top, per-rule-family coverage cards in the middle (color-coded), and the five high-risk gaps still open at the bottom.

16 / 16
Priority PDFs extracted
30+
Verbatim citations captured from primary sources
2 / 30
Questions answered (Q1.1 via EBP §3.A.7; Q2 via Annex 66 Art. 3)
25
Worked-example scenarios authored (5 deliberately ambiguous)
0 / 4
Regulator confirmations received (CHI · IA · NPHIES · SDAIA)

Coverage by rule family / question group

Well-covered (primary sources cited; key questions answered) Partial (sources extracted; questions still open) Gap (no primary text; depends on regulator response)
RF-1 Well-covered
Statutory carve-outs
6 sources 12+ quotes 1 / 6 Q answered
GOSI SIL M/273 Arts. 28/30/31/32/33 + MTPL Arts. 3/4/6/Appendix A + EBP §3.A.7 (work-injury exclusion). Q1.1 ANSWERED; Q1.2 PARTIAL via SIL Art. 31(2). Q1.3–1.6 still open.
RF-2 Well-covered
Emergency override
4 sources 10+ quotes 1 / 4 Q answered 1 high-risk lead
Annex 66 Arts. 1/3/4/5 verbatim (re-extracted 3 May 2026 with pymupdf). 24-hr rule located, Saudi-CCHI cap-exhausted cascade discovered, TPA mechanism documented. Health Law M/11 §5.E, Urgent Circular §6 verbatim. Lead: Q2.1 Service Procurement Mechanism Circular 274877-1439H referenced in Annex 66 Art. 11 — the actual tariff schedule we still need.
RF-3 Partial
Facility-driven (closed systems)
5 entities convention only 0 / 4 Q answered 1 high-risk
NGHA, MSD, MoI Medical, SAMSO, RCJY catalogued from each entity's public site. The closed-system rule is convention, not codified — so we lack a primary citation. Gap: Q3.4 emergency-at-private-hospital is the most likely IDC dispute case.
RF-4 Partial
Beneficiary-class assignment
2 sources 5 quotes 0 / 4 Q answered
CHI Beneficiaries Policy + Employer's Commitment Policy fetched in full. Verbatim Dependent definition captured. Gap: husband-employer rule articles need Arabic translator (T4); Q4.1–4.4 (transition window, divorced parents, disabled adults, husband-uninsured) all open pending CHI letter Q5–Q8.
RF-5 Partial
Default to private cover
5 sources 8+ quotes 0 / 5 Q answered 2 high-risk
Updated EBP (108 pp), Visitor Insurance, Hajj/Umrah scheme, Domestic Worker Insurance all fetched. Visitor Article 6 is the only published COB clause in KSA cooperative regulation. Gaps: Q5.4 + Q5.5 NPHIES sandbox + multi-coverage Coverage.order semantics.
RF-6 Gap
Cross-cutting / regulatory horizon
0 sources 0 quotes 0 / 4 Q answered 1 high-risk
Insurance Authority post-March-2024 regulations, Daman / Unified Mandatory Insurance, draft Insurance Law, IDC precedents — all monitored but no primary text retrieved. Q6.1–6.4 entirely depend on the IA letter (T7) and ongoing watch (T13).
RF-7 Partial
PDPL constraints (data residency)
3 sources limited quotes 0 / 3 Q answered
PDPL (RD M/19 + M/148), SDAIA Cross-Border Transfer Regulation (11 pp), Risk Assessment Guideline (16 pp) — all extracted. Gap: Q7.1–7.3 (adequacy list, DPIA template, consent withdrawal SLA) need an SDAIA written response (T9).

Five high-risk questions still open

These are the gaps most likely to materially change a routing verdict. Each is documented in docs/research/second-pass-tasks.md; addressed in the regulator letters T6–T8.

Q2.1 The exact MoH-approved tariffs schedule for emergency reimbursement at non-network providers. Lead found: Annex 66 Art. 11 references "Service Procurement Mechanism Circular No. 274877-1439H of 30/10/2017G" — needs retrieval. Asked in CHI letter Q2.
Q3.4 When a closed-system beneficiary (NGHA / MSD / MoI / SAMSO) presents at a private hospital with an emergency, who actually pays? Convention vs codification — most likely IDC dispute case.
Q5.4 Are there NPHIES technical bulletins post-IG v1.0.0 that constrain Coverage.order in multi-coverage CoverageEligibilityResponse?
Q5.5 Is there an NPHIES sandbox available to test multi-coverage scenarios? Gates the integration phase.
Q6.1 Has the Insurance Authority issued any post-March-2024 regulation addressing COB? Could replace large parts of our composed algorithm if so.

Research artefacts & deeper docs

Direct links to the supporting documents in the repo. All are markdown — open them on GitHub or in your editor.

Research progress

First-pass research complete. Researched means primary sources cited. Partial means key documents identified but not all retrieved. Pending means not yet started.

Regulators

CCHI / CHICouncil of Health Insurance — Unified Policy, EBP, Beneficiaries Policy
Researched
Insurance Authority (IA)New regulator since 4 March 2024 — replacing SAMA's insurance functions
Partial
SDAIA / PDPLPersonal Data Protection Law — RD M/19 (2021), amended M/148 (2023)
Researched

Statutory primary payers

GOSI Occupational HazardsSocial Insurance Law M/273 (Jul 2024) — work-injury carve-out
Researched
Najm / MTPLUnified Compulsory Motor Insurance Policy — RTA bodily injury
Researched
MoH Emergency DecreeHealth Law M/11 + Annex 66 + CCHI Urgent Circular
Researched

Government coverage systems

Ministry of Health (MoH)Provider model; Saudis free; non-Saudis emergency-only
Researched
MoI Medical ServicesPolice, civil defense, border guard, traffic — hybrid model
Partial
MSD (Ministry of Defense)Military personnel + dependents — predominantly closed
Partial
NGHANational Guard Health Affairs — strictly closed system
Researched
SAMSO / JHAHSaudi Aramco — self-funded plan registered with CHI
Researched
SRCARed Crescent — pre-hospital EMS, government-funded
Researched
Royal Commission Medical (Jubail / Yanbu)RC industrial cities — primarily closed
Researched
University Medical CitiesKAUH, KSUMC, KFSHRC — coverage rules as employers + referral receivers
Pending

NPHIES & private market

NPHIESFHIR R4 IG v1.0.0 — Coverage / CoverageEligibility profiles. No COB ranking field.
Researched
Private cooperative insurers (7 of ~9)Tawuniya, Bupa Arabia, MedGulf, AXA, Walaa, Allianz SF, Malath
Researched
Hajj / Umrah pilgrim insuranceSAR 100K cap, 90-day validity, underwritten by Tawuniya
Researched
Visitor / Tourist insuranceBundled with e-visa; verification portal exists
Researched
Domestic worker insuranceTwo parallel mandates: contract + compulsory health
Researched
Diplomatic personnelReciprocal arrangements vary by country
Pending

Project roadmap

Where we are and what's next. Click any milestone to open its detailed plan.

Tech choices

Greenfield. No code yet — these are the locked architectural decisions.

Python 3.12 FastAPI · auto-OpenAPI PostgreSQL 16 · JSONB policies Redis 7 · cache + rate limit OAuth2 + JWT · scoped per consumer HL7 FHIR R4 · NPHIES interop JSON decision trees · versioned, auditable PDPL-aligned · KSA-resident hosting Docker · cloud-agnostic pytest + schemathesis · contract tests