Skip to content
Emergency helpGet started
Compliance & Governance

What is ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard?

ADHICS V2, effective August 2024, sets health information and cyber security controls for Abu Dhabi healthcare entities. Scope, domains and audits.
By VigilbasePublished
Read the guideMore Topics

ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard, is the Department of Health Abu Dhabi's information and cyber security standard for the emirate's health sector. The current version, ADHICS V2, was published in May 2024 and took effect in August 2024. It applies to any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes, or transmits health information, including healthcare facilities, payers, and healthcare technology and service providers. The Department of Health (DoH) audits regulated entities and can impose sanctions for breaches of the standard.

Who issued ADHICS and when?

DoH launched ADHICS in 2019. The first edition, ADHICS V0.9, was published on 3 February 2019, and DoH required healthcare facilities in Abu Dhabi to comply before 29 February 2020. ADHICS V2 supersedes it, together with the Internet of Medical Things (IoMT) Security Standard and the Standard on Patient Healthcare Data Privacy, both V0.9 of 2020. V2 is owned by the DoH Information and Cyber Security Office and is due for revision in May 2027.

Who must comply with ADHICS?

ADHICS V2 applies to any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes, or transmits health information, including healthcare facilities, payers, and healthcare technology and service providers. It also covers healthcare professionals and support staff with access to patients' health, diagnostic, or personal information. Any entity that stores or processes health information from the emirate must meet the applicable controls, and compliance with a minimum set of ADHICS controls is a prerequisite for onboarding to Malaffi, the Abu Dhabi Health Information Exchange.

How is ADHICS V2 structured?

Section A covers governance and the framework, and Section B sets the controls in 11 domains. The controls fall into four categories by entity type, with 131 controls across the Basic, Transitional, and Advanced categories, plus a Service Provider category. Basic controls apply by default to every entity, and Advanced entities also apply the Transitional controls by default.
1.Domains: human resource security; asset management; physical and environmental security; access control; communications and operations management; data privacy and protection; cloud security; third-party security; information systems acquisition, development, and maintenance; information security incident management; and information systems continuity management.
2.Basic: always applicable; 58 controls and 274 sub-controls.
3.Transitional: hospitals with 1 to 20 beds, and centers such as diagnostic, dialysis, IVF, and rehabilitation centers; 40 controls and 171 sub-controls.
4.Advanced: hospitals with 21 or more beds, the Malaffi health information exchange, insurers, and third-party administrators; 33 controls and 132 sub-controls.
5.Service Provider: all healthcare technology and service providers implement the controls in this category.

Which ADHICS controls shape security operations?

A handful of V2 controls set the operating rhythm for logging, incidents, hosting, and suppliers.
1.Logging: Advanced entities protect logs from tampering, modification, or destruction and keep them in a centralized log management system for a period that meets legal, regulatory, and entity needs; service providers must protect their logs too.
2.Incidents: inform the Abu Dhabi Health SOC of information security and privacy incidents within predetermined timeframes. The implementation guideline sets those by priority, from near real time for P1 to within 24 hours of acknowledgement for P4.
3.Data breaches: share the data breach form with DoH within 72 hours of acknowledging the incident.
4.Cloud (Transitional and Service Provider controls): host the cloud environment physically within the UAE, including backup and disaster recovery, and keep the entity's cryptographic keys out of the cloud provider's control.
5.Data location: do not store, process, or transfer health information outside the UAE unless DoH issues a valid, specific exemption.
6.Third parties: include right-to-audit terms, and promptly notify DoH of any security incident involving a third party.

How is ADHICS enforced and audited?

DoH conducts periodic audits and technical assessments of regulated entities to validate compliance, and entities must run independent audits at least annually. According to the V2 implementation guideline, the external ADHICS audit is integrated into the health facility audit program and linked to facility licensing, for new registrations and renewals. V2 gives each control category the same deadline: within six months of official program onboarding or the standard's release, whichever comes first. DoH can impose sanctions for breaches of the standard under the disciplinary regulation for Abu Dhabi's healthcare sector; the standard does not list fine amounts.

How do healthcare entities evidence ADHICS?

The implementation guideline's self-assessment checklist covers all 131 controls and their sub-controls, and auditors expect records that show each applicable control operating.
1.The completed self-assessment and the entity's control category.
2.Policies, risk assessments, asset inventories, and access reviews.
3.Centralized, protected logs and the retention period chosen for them.
4.Incident reports to the Abu Dhabi Health SOC and data breach forms sent to DoH.
5.Cloud hosting and key management records showing UAE hosting.
6.Third-party contracts with right-to-audit terms and incident notification duties.

Where does Vigilbase help with ADHICS evidence?

Vigilbase OS connects the security tools you already pay for and keeps their logs and events auditable and queryable in one place. Each investigation records the evidence, the action taken, and the verification result, which helps you produce incident records and the facts the Abu Dhabi Health SOC and DoH ask for. Managed Cloudflare operates WAF and DDoS controls for patient portals and other public applications within the agreed scope. ADHICS keeps health information inside the UAE unless DoH grants an exemption, its cloud controls require UAE hosting, and any healthcare technology or service provider falls under its Service Provider category. Bring your data-location requirements to scoping; we confirm supported configurations and unresolved requirements before onboarding.

About this guide

This guide summarizes ADHICS V2 and its implementation guideline as published by DoH, as available in October 2026. It is not legal advice. DoH's publications take precedence over this summary; confirm your control category and obligations with DoH and your compliance owners.

Key Takeaways

✓ADHICS V2 took effect in August 2024 and applies to any Abu Dhabi entity that handles health information.
✓Controls fall into Basic, Transitional, Advanced, and Service Provider categories across 11 domains.
✓DoH audits regulated entities, links ADHICS audits to facility licensing, and can impose sanctions.
✓Health information and cloud hosting stay in the UAE unless DoH grants a specific exemption.

Sources

Related Solutions

Vigilbase services related to this guide

Managed SOC

Learn more

Managed Cloudflare

Learn more

Get started with Vigilbase OS

Learn more

Managed cybersecurity in the UAE

Learn more

Frequently Asked Questions

What is an ADHICS audit?

DoH conducts periodic audits and technical assessments of regulated entities to validate compliance with ADHICS. The external ADHICS audit is integrated into the health facility audit program and linked to facility licensing, for new registrations and renewals.Entities must also run independent audits at least annually and keep records showing each applicable control operating.

Who needs to comply with ADHICS?

Any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes, or transmits health information, including healthcare facilities, payers, and healthcare technology and service providers.

What changed in ADHICS V2?

ADHICS V2, published in May 2024 and effective in August 2024, supersedes ADHICS V0.9 of 2019 and the 2020 standards on IoMT security and patient healthcare data privacy. It groups controls into Basic, Transitional, Advanced, and Service Provider categories across 11 domains, including data privacy and protection and cloud security.

Can health information be hosted outside the UAE under ADHICS?

Not without a valid, specific exemption from DoH. ADHICS V2's cloud controls for Transitional entities and service providers also require cloud environments, including backup and disaster recovery, to be physically hosted within the UAE.

How quickly must incidents be reported under ADHICS?

Incidents go to the Abu Dhabi Health SOC within predetermined timeframes, set by priority in the implementation guideline, from near real time for P1 to within 24 hours of acknowledgement for P4. The data breach form goes to DoH within 72 hours of acknowledging the incident.Security operations responsibilitiesCoverage and incident response commitments

Related Topics

Security Basics

What is SOC?

Network Security

What is WAF?

Compliance & Governance

UAE PDPL

Compliance & Governance

UAE IA Standard

Get Started

Ready to Improve Your Security?

Our team can help you implement the security measures discussed in this guide. Get expert guidance tailored to your organization.
Get started Continue Learning