ZATCA Phase 2 e-invoicing for Saudi clinics: a step-by-step guide
Clearance, reporting, CSIDs, invoice hashes and credit notes, explained for clinic finance teams, plus the clinic-specific traps that general ZATCA guides skip.
Short answer: ZATCA Phase 2 (the Integration Phase of Fatoora) requires your invoicing system to connect to ZATCA's platform. Standard tax invoices to businesses are cleared by ZATCA before you share them. Simplified invoices to patients are reported within 24 hours. Each invoice is XML, cryptographically stamped and chained to the previous one. Helix supports ZATCA Phase 2 for Saudi clinics.
Most ZATCA guides are written for retailers and distributors. Clinics have extra wrinkles: a patient invoice and an insurer invoice for the same visit, refunds after a cancelled procedure, pharmacy sales at the counter, and several branches invoicing under one VAT number. This guide covers the general rules and those clinic-specific points.
This article is general guidance, not legal advice. Regulators update their standards, circulars and deadlines often, so always confirm the current requirement with the relevant authority or a qualified advisor before you act on it.
Phase 1 vs Phase 2 in one paragraph
Phase 1 (the Generation Phase) began on 4 December 2021 and required VAT-registered businesses to issue invoices electronically, from a compliant system, with a QR code. Phase 2 (the Integration Phase) adds a live connection to ZATCA's Fatoora platform. ZATCA brings taxpayers into Phase 2 in waves, based on their taxable revenue, and notifies each wave ahead of its deadline. If you have received a ZATCA notification, your date is in it. If you are not sure, check the Fatoora portal or ask your tax advisor.
Clearance vs reporting
| Standard tax invoice | Simplified tax invoice | |
|---|---|---|
| Typical buyer | A business (B2B), e.g. an insurer or corporate client | An individual (B2C), e.g. a self-pay patient |
| ZATCA model | Clearance | Reporting |
| When ZATCA sees it | Before you share it with the buyer | Within 24 hours of issuing it |
| Valid when | Once ZATCA clears it | Once issued with your stamp and QR code |
| Stamp | ZATCA stamps it on clearance | Your system stamps it with your certificate |
Which invoice type applies to each clinic transaction depends on who the buyer is. A patient paying at the desk is usually simplified. An invoice to an insurer or a corporate client for their employees is usually standard. Mixed cases, such as a patient co-pay and an insurer share for the same visit, should be mapped with your tax advisor once, then built into the system so staff never have to decide at the counter.
Clearance vs reporting
Simplified: reporting
- Individual buyer, e.g. patient
- Reported within 24 hours
- Your system stamps it
- Valid once issued
Standard: clearance
- Business buyer, e.g. insurer
- Cleared before you share it
- ZATCA stamps it
- Valid once cleared
What every Phase 2 invoice must carry
- XML in the UBL 2.1 format ZATCA specifies. A PDF alone is not the e-invoice.
- A unique identifier (UUID) for the invoice.
- A cryptographic stamp from a ZATCA-issued certificate (CSID).
- The hash of the previous invoice, chaining every invoice from the same unit together.
- An invoice counter that never resets or repeats.
- A QR code in the Phase 2 format on the printed invoice.
The hash chain and counter are where clinics get into trouble. If an invoice is deleted, edited after issue, or re-created after a system restore, the chain breaks. The rule to teach staff is simple: once issued, an invoice is never edited or deleted. It is corrected with a credit or debit note.
Onboarding: getting your CSID
- Log in to the Fatoora portal and generate a one-time password for the invoicing unit you are onboarding (for a clinic group, typically per branch or per system).
- Your invoicing system creates a certificate signing request with your VAT and unit details and sends it to ZATCA with the OTP.
- ZATCA issues a Compliance CSID.
- The system sends test invoices, credit notes and debit notes through ZATCA's compliance checks.
- Once they pass, ZATCA issues a Production CSID, and the unit can go live.
- Test the whole flow end to end in ZATCA's simulation environment before switching on production.
Getting a CSID per unit
- Generate a portal OTPOn Fatoora, per invoicing unit
- Send the signing requestVAT and unit details, with the OTP
- Receive Compliance CSIDIssued by ZATCA
- Pass compliance checksTest invoices, credit and debit notes
- Receive Production CSIDThe unit can now go live
- Test end to endIn simulation before switching on production
Clinic-specific traps
- Refunds after a cancelled procedure. A cleared or reported invoice cannot be voided. Issue a credit note that references the original invoice, and report it too.
- Price changes at checkout. Keep invoices in draft until the patient has finished. Issue only when the amounts are final.
- Pharmacy counter sales. Every sale is a simplified invoice. If the pharmacy runs on a separate POS that is not connected to ZATCA, that is a separate compliance project.
- Several branches, one VAT number. Each invoicing unit needs its own certificate and its own chain. Plan the onboarding per branch.
- Insurer invoices. Standard invoices need clearance before you send them. Build that into your claims calendar.
- Retries and outages. If the ZATCA connection fails, the invoice must still sit correctly in the chain. Ask your vendor how its system handles a retry.
A go-live checklist for clinic finance teams
- Confirm your wave and deadline from ZATCA's notification or the Fatoora portal.
- Agree the invoice-type mapping (simplified vs standard) for patients, insurers and corporate clients with your tax advisor.
- List every place the clinic issues invoices: reception, pharmacy, lab, online payments, branches.
- Onboard each invoicing unit and pass compliance checks in the simulation environment.
- Train staff that issued invoices are never edited or deleted, only credited.
- Test a refund, a partial refund and a price correction end to end before going live.
- After go-live, review rejected or unreported invoices daily for the first weeks.
E-invoicing and insurance claims are separate rails
ZATCA e-invoicing is about tax. Health insurance claims in Saudi Arabia go through NPHIES, which is a different platform run under the Council of Health Insurance. A clinic needs both, and the amounts should agree. Our NPHIES guide for providers covers the claims side, and our VAT guide for UAE and KSA clinics covers the tax treatment of healthcare services.
How Helix handles ZATCA Phase 2
Helix supports ZATCA Phase 2 e-invoicing with an in-browser onboarding wizard for each unit. New invoices start as drafts with no number. Issuing assigns the number, stamps the invoice and sends it to ZATCA, and the invoice counter and previous-invoice hash are managed by the system. A draft prints clearly marked as not a tax invoice. Issued invoices are corrected by credit notes, which are reported too and tracked on a credit notes report. Every invoice posts to the same double-entry ledger in our billing and accounting module, so VAT reports and the general ledger agree. For groups, each branch is onboarded separately inside one multi-branch system.
Does ZATCA Phase 2 apply to clinics?
Phase 2 applies to VAT-registered taxpayers as ZATCA brings each wave in. Clinics are not exempt because they provide healthcare. Check your ZATCA notification or the Fatoora portal for your date.
Are patient invoices simplified or standard?
Invoices to individual patients are usually simplified and reported within 24 hours. Invoices to businesses such as insurers are usually standard and cleared first. Confirm your mapping with a tax advisor.
Can I cancel an invoice after it is issued?
Not by deleting or editing it. Issue a credit note that references the original invoice. Deleting or editing breaks the invoice chain.
Is ZATCA e-invoicing the same as NPHIES?
No. ZATCA e-invoicing is a tax requirement. NPHIES is the national platform for health insurance transactions. Clinics that bill insurance need both.
Related articles
NPHIES for providers: eligibility, pre-authorization and claims in Saudi Arabia
How Saudi Arabia's national health insurance platform works for clinics and hospitals, the transactions you will use every day, and what to check before you trust a vendor's NPHIES claim.
VAT for clinics in the UAE and Saudi Arabia: what's zero-rated, standard or exempt
The same consultation room can produce zero-rated, standard-rated and citizen-relieved invoice lines in one afternoon. Here is how VAT on healthcare works in both countries, and how to set up your billing so it stays right.
Choosing clinic software in Saudi Arabia: NPHIES, ZATCA and beyond
Saudi clinics need software that speaks NPHIES and ZATCA Phase 2 from day one. Here is a fair buyer’s guide: the rails, the questions to ask and the gaps to check for.