ADHICS requirements explained: video brief

A governance frame and eleven control domains

ADHICS pairs a governance frame, Section A, with eleven control domains in Section B. Section A sets the frame: a governance structure with a committee and a Chief Information Security Officer, risk management, asset classification, control adoption, compliance and audit. Section B sets the controls themselves across the domains that protect health information and the systems, devices and facilities that hold it. This short film walks through that structure.

The governance structure has two bodies: an Information Security Governance Committee providing management oversight, and a Healthcare Information Infrastructure Protection workgroup led by an appointed Chief Information Security Officer. Together they own the programme, adopt the controls and report on compliance.

Basic, transitional and advanced controls

Every control carries a category. Basic controls are described as the absolute minimum and apply to every entity. Transitional controls are added for listed facility types, from smaller hospitals to primary health care, diagnostic centres, home care and pharmacies. Advanced controls are added for larger hospitals. Each level includes the requirements of the levels beneath it, so the first step for any entity is to confirm its facility type and bed capacity.

The standard applies to every healthcare entity regulated by the Department of Health – Abu Dhabi: hospitals, clinics, laboratories, pharmacies and insurers, their staff with access to patient information, and their suppliers. The version EIAC lists for accrediting certification bodies is the DoH standard issued on 3 February 2019, and entities should confirm with DoH whether a later revision applies. DoH enforces it as a sector requirement; EIAC-accredited certification bodies can audit and certify against it, and ISO/IEC 27001 supports it without replacing it.

Under the 2019 text every entity meets the Basic requirements, while Transitional and Advanced apply by facility type. Governance runs on three levels: an Information Security Governance Committee chaired by a nominated senior manager, a Healthcare Information Infrastructure Protection workgroup led by the Chief Information Security Officer, who is also the regulator's point of contact, and implementation staff. Suppliers are drawn in through the third-party security domain, so EMR, laboratory and imaging vendors, cloud providers and outsourcers are covered by the healthcare entity's programme.