ADHICS Compliance in the UAE: A Guide for Healthcare Providers

Healthcare providers hold some of the most sensitive data any organisation handles — patient records, diagnoses, insurance details, sometimes genetic or mental health information. In Abu Dhabi, that sensitivity is reflected in a dedicated regulatory standard: ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health – Abu Dhabi (DoH). If you run or support a healthcare entity in the emirate, ADHICS is not optional guidance — it is a licensing-linked obligation. Here's what it covers and how to prepare for it.

What ADHICS is, and who it applies to

ADHICS sets out information security requirements for the healthcare sector in Abu Dhabi: hospitals, clinics, laboratories, pharmacies, insurers, and other entities licensed or regulated by DoH, along with the technology vendors and third parties that process health data on their behalf. It was built with the sector's specific risks in mind — clinical systems that cannot simply be taken offline, a high volume of highly sensitive personal data, and a web of providers, insurers, and labs that all exchange that data.

Healthcare entities elsewhere in the UAE don't fall directly under DoH's remit, but the standard is widely treated as a reference point for good practice across the sector, particularly where a group operates facilities in both Abu Dhabi and other emirates and wants one consistent security baseline. If you operate outside Abu Dhabi, confirm what your own local health authority expects — security requirements at the emirate level are not all identical — but don't assume ADHICS is irrelevant just because your licence sits elsewhere.

What the standard covers

ADHICS is structured around the kind of control domains you'd recognise from ISO 27001 or NESA, but written for a healthcare operating environment:

• Governance and accountability. A named owner for information security, documented policies, and a management structure that can actually enforce them — not a policy document that exists only for audit day.
• Risk management. A formal process for identifying and treating risks to health data and clinical systems, reviewed on a regular cycle rather than once at go-live.
• Asset and data management. Knowing where patient data lives — across clinical systems, billing, insurance integrations, and any third-party labs or imaging providers — and classifying it appropriately.
• Access control. Ensuring clinical and administrative staff can reach only the records their role requires, with access reviewed as roles change.
• Operations and network security. Hardening of the infrastructure hosting clinical and patient-facing systems, including segmentation between clinical networks and general office IT.
• Third-party and vendor management. Due diligence and contractual controls over any vendor — a lab integration, a billing platform, an AI diagnostic tool — that touches patient data.
• Incident management and reporting. A defined process for detecting, containing, and reporting security incidents, including obligations to notify DoH where required.
• Business continuity. Plans for keeping clinical operations running, or recovering quickly, if systems are disrupted — a higher bar in healthcare than in most sectors, since downtime has a direct patient-safety dimension.

Where providers typically fall short

In our experience working across regulated UAE sectors, the recurring gaps for healthcare entities tend to be the same few things:

1. Shadow integrations. A lab result feed, an insurance pre-authorisation API, or a referral portal gets connected outside the formal change process, and nobody updates the data inventory or risk assessment to reflect it.
2. Legacy clinical systems. Imaging, lab, or practice-management systems that are difficult or expensive to patch, left running on outdated software because "it's always worked."
3. Flat networks. Clinical devices and general office systems sharing the same network segment, so a compromised reception PC can reach systems it has no business touching.
4. Vendor risk left unmanaged. Third parties that process patient data are often not assessed with the same rigour as the provider's own systems, even though a breach at the vendor is still the provider's breach to answer for.
5. Policy without testing. Documentation that satisfies an audit checklist but has never been validated against a real attack — access controls and network segmentation that look correct on paper but fail under actual testing.

How to prepare, practically

1. Map your data and systems first. You cannot secure or classify what you haven't inventoried — clinical systems, billing, insurer connections, and every third party with access to patient data.
2. Run a gap assessment against ADHICS's control domains to see where your current policies, access controls, and technical controls fall short, rather than guessing.
3. Segment clinical from administrative networks. This single architectural change closes a large share of the exposure most providers carry.
4. Test it. A penetration test of patient-facing portals, APIs, and the internal network validates that access controls and segmentation hold up against real attack techniques, not just documentation review.
5. Formalise vendor oversight. Build security requirements into contracts with labs, insurers, and software vendors, and review their access periodically.
6. Assign ownership and keep it live. ADHICS compliance is a continuous governance responsibility, not a one-time certification exercise — if you don't already have someone accountable for it, a virtual CISO can hold that role without a full-time hire.

FAQ

Does ADHICS apply to my clinic if I'm not based in Abu Dhabi?

ADHICS is issued by the Department of Health – Abu Dhabi and applies directly to entities it licenses or regulates. Healthcare providers elsewhere in the UAE should confirm their own local health authority's requirements, but many groups adopt ADHICS as a practical security baseline across all their facilities for consistency.

Is ADHICS the same as HIPAA?

No. HIPAA is a US federal law covering protected health information in the United States. ADHICS is a UAE (Abu Dhabi-specific) standard with a different legal basis and regulator, though both address similar goals — protecting the confidentiality, integrity, and availability of health information — and share some control themes.

Do third-party vendors need to comply with ADHICS too?

Any vendor processing patient data on behalf of a regulated healthcare entity is in scope through that entity's own obligations. Providers are expected to assess and manage the security posture of labs, insurers, software vendors, and other third parties that touch health data, not just their own internal systems.

How often should an ADHICS gap assessment be repeated?

Treat it as an ongoing process rather than a point-in-time exercise: review your risk assessment and control effectiveness at least annually, and whenever you make a material change such as a new clinical system, a new vendor integration, or a network redesign.

Get a gap assessment

TestUnity helps UAE healthcare providers map their ADHICS exposure, close control gaps, and validate their defences with real penetration testing. Talk to us about a gap assessment for your organisation.