What does ADHICS ask of a clinic in Abu Dhabi?

Controls on every system that handles health information, scaled to your maturity, with health information kept in the UAE unless DOH approves an exemption, and breaches reported to DOH within 72 hours. ADHICS is in version 2, effective August 2024, and assessed through AAMEN.

Who it applies to

ADHICS version 2 applies to any healthcare facility, payer or technology or service provider that generates, accesses, stores, uses, processes or transmits health information. Health information is not stored, processed or transferred outside the UAE unless DOH approves an exemption, and a data breach form goes to DOH within 72 hours.¹ Compliance is assessed through DOH's AAMEN programme.²

1. List every system. Every system that touches health information, and where its data lives.
2. Confirm UAE hosting. In writing, from every vendor.
3. Control access. Named accounts, roles, and a log of every read.
4. Rehearse a breach. Who fills the form, and how it reaches DOH within 72 hours.
5. Schedule the AAMEN assessment. And keep the evidence for it current.

1. System ______ Vendor ______
2. Health data it holds ______
3. Hosted in ______ Confirmed in writing on ______
4. Access by role ______ Access log ______

Copy template

Questions

Which ADHICS version is current?

Version 2, published May 2024, effective August 2024.

How fast must a breach be reported?

The data breach form goes to DOH within 72 hours.

Can health data be hosted outside the UAE?

Only with an exemption approved by DOH.

Sources

1. 1Department of Health Abu Dhabi, 2024Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS), version 2Read source
2. 2Department of Health Abu Dhabi, 2026AAMENRead source

Written by the wai team from Department of Health Abu Dhabi guidance, checked on 15 October 2026. This is guidance, not legal advice. DOH does not endorse wai or any software.