Compliance walkthrough
How to comply with ADHICS in Abu Dhabi: video walkthrough
A walkthrough of building an ADHICS compliance programme for a Department of Health – Abu Dhabi regulated healthcare entity.
Key takeaways
- ADHICS applies to every DoH-regulated healthcare entity in Abu Dhabi.
- It covers paper and digital information, medical devices, systems and people.
- Facility type and bed capacity decide which control levels apply.
- A governance committee and an appointed CISO are required.
- DoH enforces ADHICS; EIAC-accredited bodies can certify against it.
Health information security across the Abu Dhabi sector
ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard, is the Department of Health – Abu Dhabi's standard for protecting health information and the technology that carries it in the Emirate of Abu Dhabi. It covers all DoH-regulated healthcare entities and services and reaches well beyond IT: information on paper and in digital form, medical devices and equipment, applications and information systems, data centres, and the people who support care delivery all fall within its scope.
DoH enforces ADHICS as a sector requirement. Certification bodies accredited by EIAC for ADHICS can audit and certify against it, and ISO/IEC 27001 supports it but does not replace it. This short film walks through how a healthcare entity builds its compliance programme.
Built, operated, then demonstrated
First confirm the category and scope: the facility type and bed capacity decide which controls apply. Basic controls are the absolute minimum for every entity, transitional controls are added for listed facility types, and advanced controls are added for larger hospitals, each level including the requirements of the levels beneath it.
The programme then establishes the governance structure ADHICS requires, with a governance committee for management oversight and a protection workgroup for healthcare information infrastructure, led by the entity's appointed Chief Information Security Officer, along with risk management, asset classification, control adoption, compliance and audit. The controls for the entity's category are implemented across the control domains, run long enough to generate evidence and checked through the yearly internal audit. The result is shown to DoH and, where the entity chooses or is asked, to a certification body accredited for ADHICS.
Sterling's expert and experienced consultants build the programme and the evidence with your team under Sterling OS™, with the work held in Effivity. Judging compliance belongs to DoH and the independent auditors. Entities should confirm with DoH which version of the standard applies to them.
ADHICS (Abu Dhabi) at a glance
- Purpose
- Protecting patient health information, and the systems, medical devices and facilities that hold it, across the Abu Dhabi healthcare sector
- Relevant to
- Every DoH-regulated healthcare entity in the Emirate of Abu Dhabi: hospitals, clinics, laboratories, pharmacies and insurers, their staff with access to patient information, and their suppliers
- Edition
- The DoH standard issued on 3 February 2019 (DOH/SD/ADHICS/0.9), the version EIAC lists for accrediting certification bodies; confirm with DoH whether a later revision applies to you
- Certification
- Enforced by DoH as a sector requirement. Certification bodies accredited by EIAC for ADHICS can audit and certify against it; ISO/IEC 27001 supports it but does not replace it
- Sterling's role
- Programme build with your team, Effivity, training, the yearly internal audit and audit readiness, then Sustain™
- Cost and timing
- Total investment for an ADHICS compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
ADHICS (Abu Dhabi): questions people ask
Is ADHICS mandatory?
For healthcare entities and services regulated by DoH in the Emirate of Abu Dhabi, yes. The standard covers hospitals and other medical facilities, diagnostic laboratories, pharmacies and insurance providers, and the professionals and support staff with access to patient information. DoH establishes and enforces it, and Malaffi requires compliance of itself and every participant.
Which category applies to us: Basic, Transitional or Advanced?
Under the 2019 text, Basic applies to every entity, whatever its facility type. Transitional applies to listed types: hospitals with 1 to 20 beds, day care surgery, primary health care, diagnostic, rehabilitation, dialysis and fertilisation centres, mobile healthcare units, home care and pharmacies. Advanced applies to hospitals with 21 beds or more. Each level includes all the requirements of the levels below it.
Is there such a thing as ADHICS certification?
Certification against ADHICS exists: the Emirates International Accreditation Centre lists the 2019 standard among the schemes for which it accredits certification bodies, so an accredited body can audit and certify your programme. A certificate does not replace your obligations to DoH, which sets and enforces the standard. Before engaging a certification body, confirm what DoH expects of your facility and check the body's ADHICS accreditation with EIAC.
We are certified to ISO/IEC 27001. Are we ADHICS compliant?
Not automatically. The two are commonly aligned in practice, and a working ISMS covers much of the risk management and many operational controls. ADHICS adds its own governance structure, the category requirements, medical devices, health information controls and quarterly compliance reporting, and its controls carry references to the UAE Information Assurance Standard. We extend the control set you have rather than starting again.
How does ADHICS relate to Malaffi?
Malaffi is the Emirate's health information exchange, a DoH initiative launched in 2019. Malaffi states that it and all participants are required to comply with Emirate-wide and federal health privacy laws and with ADHICS. On its policy page, ADHICS sits beside DoH's policy on the Abu Dhabi Health Information Exchange of April 2020 and DoH's Standard on Patient Healthcare Data Privacy of 15 September 2020.
Keep exploring
Related to this video
The complete guide
Everything on ADHICS (Abu Dhabi)
Start with the ADHICS (Abu Dhabi) page, or go straight to the guide you need.
On the ADHICS (Abu Dhabi) page
Often combined with ADHICS (Abu Dhabi)
More videos: Healthcare, medical devices and life sciences
- How to comply with the EU IVDR (Regulation 2017/746)Compliance walkthrough · 3 min 15 s
- EU IVDR requirements explainedTwo-minute brief · 2 min
- How to comply with the EU MDR (Regulation 2017/745)Compliance walkthrough · 3 min 15 s
- EU MDR requirements explainedTwo-minute brief · 2 min
- How to comply with the FDA QMSR (21 CFR Part 820)Compliance walkthrough · 3 min 15 s
- FDA QMSR (21 CFR Part 820) requirements explainedTwo-minute brief · 2 min
- How to implement GMP for medicines (PIC/S, EU, WHO)Implementation walkthrough · 3 min 15 s
- GMP requirements explained (PIC/S, EU, WHO)Two-minute brief · 2 min
- How to implement HITRUST CSFImplementation walkthrough · 3 min 15 s
Talk to a consultant
Plan your ADHICS compliance programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice