ADHICS · Healthcare information and cyber security (Abu Dhabi, United Arab Emirates)

ADHICS compliance consulting for patient information protected across Abu Dhabi's hospitals, clinics and pharmacies.

ADHICS is the healthcare information and cyber security standard that the Department of Health – Abu Dhabi (DoH) applies to every healthcare entity it regulates in the Emirate of Abu Dhabi, United Arab Emirates. Sterling's expert and experienced consultants build the programme it expects with your management, IT, clinical and biomedical teams: governance, risk management, the controls for your category and the evidence behind each. Led from our regional headquarters in Dubai, we stay with you through the audit and after it. We ensure successful ADHICS compliance programmes for our clients.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced healthcare cybersecurity consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the controls, the governance and the evidence; compliance is assessed by DoH and by accredited certification bodies

ADHICS at a glance

Purpose: Protecting patient health information, and the systems, medical devices and facilities that hold it, across the Abu Dhabi healthcare sector
Relevant to: Every DoH-regulated healthcare entity in the Emirate of Abu Dhabi: hospitals, clinics, laboratories, pharmacies and insurers, their staff with access to patient information, and their suppliers
Edition: The DoH standard issued on 3 February 2019 (DOH/SD/ADHICS/0.9), the version EIAC lists for accrediting certification bodies; confirm with DoH whether a later revision applies to you
Certification: Enforced by DoH as a sector requirement. Certification bodies accredited by EIAC for ADHICS can audit and certify against it; ISO/IEC 27001 supports it but does not replace it
Sterling's role: Programme build with your team, Effivity, training, the yearly internal audit and audit readiness, then Sustain™
Cost and timing: Total investment for an ADHICS compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months

8,100+ client engagements in 60+ countries.

ADHICS client experience

What it is

What is ADHICS and what is it used for?

ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard, is the Department of Health – Abu Dhabi's standard for protecting health information and the technology that carries it in the Emirate of Abu Dhabi, United Arab Emirates. It covers all DoH-regulated healthcare entities and services and reaches well beyond IT: information on paper and in digital form, medical devices and equipment, applications and information systems, data centres, and the people who support care delivery all fall within its scope.

The standard is built in two parts. Section A sets the frame: a governance structure with a committee and a Chief Information Security Officer, risk management, asset classification, control adoption, compliance and audit, and the responsibilities of each party. Section B sets the controls in eleven domains, each graded Basic, Transitional or Advanced, so a pharmacy and a large hospital are held to requirements in proportion to what they run.

Current text and status. The text available on the policy page of Malaffi, the Emirate's health information exchange, is the standard DoH issued on 3 February 2019, document reference DOH/SD/ADHICS/0.9. The Emirates International Accreditation Centre (EIAC) lists the same 2019 standard among the schemes for which it accredits certification bodies. Check DoH's standards library for any later revision or circular before a programme is scoped; where one applies, the gap analysis is mapped to it. ADHICS versions and DoH circulars: what to check

Who it is for

Who needs ADHICS compliance?

ADHICS applies to every healthcare entity and service that DoH regulates in the Emirate of Abu Dhabi: hospitals and other medical facilities, diagnostic laboratories, pharmacies and insurance providers, with the professionals and support staff who have access to patients' health, diagnostic or personal information. Suppliers are drawn in through the standard's third party security and supply chain controls, which the entities they serve have to apply. Organisations come to Sterling for ADHICS from four starting points:

You are opening or expanding a facility in Abu Dhabi. A new hospital, clinic, laboratory or pharmacy is better served by designing the governance, the risk assessment and the controls for its category in from the start than by retrofitting them later.
An audit or a DoH request has exposed gaps. Policies adapted from a template, a committee that rarely meets, no register of medical devices, supplier contracts silent on security. You need a dated remediation plan and evidence that it is working.
You supply the Abu Dhabi health sector. An EMR or laboratory system vendor, a cloud or managed service provider, a billing or coding company: your healthcare clients apply the ADHICS third party security controls to you, and their questionnaires ask for the evidence.
You hold ISO/IEC 27001, or run a group across several Emirates, and want one control set. Much of a working ISMS carries across; the healthcare governance, category requirements, medical devices and health information controls do not. ADHICS becomes an extension, not a second programme.

The intended result is patient information that stays confidential, accurate and available, and a facility that can show DoH that it does. That depends on the controls operating every day, not on the policy set existing.

Business benefits

How ADHICS compliance supports patient trust and clinical continuity

Security in healthcare pays for itself in two places: the patient data it keeps private and the clinical services it keeps running. We begin where exposure is highest in your facility, shared workstations on the wards, medical devices on the network, remote vendor access and paper records at reception, and build outwards from there.

Patient confidenceHealth information handled under documented rules, classified by sensitivity and seen only by those who need it, so privacy is something you can demonstrate rather than assume.
Services that keep runningBackups, monitoring and continuity plans tested for the systems clinicians depend on, so ransomware or an outage becomes an incident to manage, not a closure.
Medical devices under controlDevices and equipment inventoried, configured to a baseline and protected like the rest of the estate, not left to the vendor alone.
Governance the regulator can seeA committee that decides, a CISO who coordinates with the regulator, and quarterly compliance reports that reflect the real state of the controls.
Suppliers held to the same barSecurity terms in contracts, service delivery monitored and outsourced development controlled, so a vendor is not your weakest point.
One set of controls for several frameworksADHICS, ISO/IEC 27001, ISO 22301 and the UAE Information Assurance Standard mapped once and evidenced once, from one workspace.

Track a handful of measures that reflect these priorities: open high-risk findings, access reviews completed on time, devices outside the baseline, backup restores tested and the age of the risk assessment. A policy library carrying last year's approval dates is not a security result.

Requirements

What are the main ADHICS requirements?

ADHICS pairs a governance frame (Section A) with eleven control domains (Section B). Every control carries a category. Basic controls are described as the absolute minimum and apply to every entity. Transitional controls are added for listed facility types, from hospitals of 1 to 20 beds to primary health care, diagnostic centres, home care and pharmacies. Advanced controls are added for hospitals with 21 beds or more. Each level includes the requirements of the levels beneath it. The table is a plain-language map of the 2019 text; your programme is checked against the version DoH applies, control by control, during the build.

Section and domain	What it requires of you	What it looks like in practice
Section A Governance structure	Establish an internal security structure: an Information Security Governance Committee for management oversight, a Healthcare Information Infrastructure Protection workgroup led by an appointed CISO, and implementation stakeholders for day-to-day work	Committee terms of reference and minutes, the CISO appointment, named workgroup members, and the CISO acting as the entity's point of contact with the sector regulator
Section A Risk management and asset classification	Mitigate identified risks under a documented strategy, monitor whether controls remain relevant, perform and stay effective, and classify information assets	A risk register and a mitigation strategy showing effort, resources and cost, periodic control reviews, and assets classified Public, Restricted, Confidential or Secret
Section A Control adoption, compliance and audit	Adopt the controls for your category, define a road map to full compliance, track applicable legal and regulatory obligations, and run formal yearly audit programmes	A recorded category decision, a compliance road map, a register of obligations, yearly audit results kept under the highest access protection, and quarterly progress and compliance reports approved by the committee chair
Human resources security Domain 1	Security before employment, during employment and at termination or change of role, under a human resources security policy	Pre-employment checks, awareness and training that include governmental and organisational security requirements, and access withdrawn or adjusted when roles end or change
Asset management and physical and environmental security Domains 2 and 3	Inventory, classify, label, handle and dispose of assets, medical devices and equipment included; protect secure areas and equipment	An asset register that includes medical devices, encryption of information stored within them, secure-area access rules, equipment protection and disposal records
Access control Domain 4	Control and review access to information, networks, operating systems, applications, and equipment and devices	User access management, password rules applied to medical equipment, provisions for mobile and user-owned devices, and access reviews signed off by system owners
Operations management and communications Domains 5 and 6	Run technology in a controlled, standardised way and protect information exchanged with others, including over information sharing platforms	Operating procedures and configuration baselines, malware protection, backup and archival, monitoring and logging, vulnerability management, network security and rules for information exchange
Health information and security Domain 7	Protect health information and patient privacy under a health information protection policy	A health information protection policy, privacy rules for patient records in every format, and consistency with DoH's Standard on Patient Healthcare Data Privacy
Third party security and systems acquisition, development and maintenance Domains 8 and 9	Secure supplier relationships and service delivery, and build security into the systems you acquire, develop or outsource	Supplier security requirements and monitoring, security requirements for new systems, cryptographic controls, protected system files, and control of outsourced development and the supply chain
Incident management and information systems continuity Domains 10 and 11	Report security events and weaknesses, manage incidents and learn from them, and plan for the continuity of information systems	An incident procedure and log, a reporting route every employee knows, lessons fed back into the controls, and continuity plans for the systems clinical services rely on

What does useful ADHICS evidence look like?

Committee minutes with decisions, the CISO appointment, an asset register that includes medical devices, the risk assessment and mitigation strategy, access reviews, logs that someone reviews, vulnerability and technical assessment results, supplier agreements and monitoring records, incident records, continuity plans with test results, awareness training records, the yearly audit report and the quarterly compliance reports. We identify the records your controls actually produce, without writing documents to fill a folder, and keep them in Effivity from the first workshop.

ADHICS requirements explained, domain by domain

Compliance process

How do you become ADHICS compliant?

ADHICS compliance is built, operated and then demonstrated. You establish the governance, implement the controls your category requires, run them long enough to generate evidence and show the result: to DoH, which enforces the standard, and, where you choose or are asked to, to a certification body accredited for ADHICS. Sterling builds the programme and the evidence with you; judging compliance belongs to DoH and to the independent auditors.

01
Confirm your category and scope.Facility type and bed capacity decide whether Basic, Transitional or Advanced controls apply; then the sites, systems, medical devices, Malaffi connection and suppliers in scope are agreed.
02
Gap analysis: review current controls against your category.The gap analysis compares governance, policies, controls and records with Section A and the eleven domains, keeps what works and agrees actions, owners, dates and resources.
03
Set up the governance and implement the controls.Committee, CISO and workgroup in place; risk assessment and asset classification completed; controls implemented, suppliers engaged and staff trained.
04
Audit, report and close the findings.The yearly audit programme and technical assessments test the controls, quarterly progress and compliance reports are approved by the committee chair, and findings are raised by us first and closed with evidence.
05
Demonstrate compliance.Respond to what DoH requires of your facility and, where applicable, complete an independent ADHICS audit by a certification body accredited for the standard, resolving any findings.
06
Keep the programme current.Yearly audits, quarterly reports, risk and classification reviews, supplier monitoring, continuity tests and training continue, and DoH revisions are picked up as they are issued.

Judge the route, not only the price. If you are offered an ADHICS certificate, ask which certification body will issue it and whether that body is accredited for the ADHICS scheme, then verify both with EIAC directly. Be wary of offers that skip the governance, the risk assessment or the medical devices: they leave exactly the gaps a DoH review looks for. How to choose a credible ADHICS provider · The compliance buyer's checklist

Cost

How much does ADHICS compliance cost?

There is no meaningful standard price for ADHICS. A single pharmacy working to the Basic and Transitional controls is a different project from a hospital group applying the Advanced controls across several sites, dozens of clinical systems and a large device estate. What we do promise is a proposal in which every component is visible and nothing is added later.

Cost component	What affects it
Consulting and implementation	Your category, the number of facilities, clinical and business systems, the medical device estate, current maturity and how much of the work your team takes on (Design™ or Drive™)
Independent audit, where used	The certification body's fees for an ADHICS or ISO/IEC 27001 audit, its audit days, sites and follow-up visits, shown separately
Internal resources	Time from the CISO, IT, biomedical engineering, HR and department heads, the security tooling the risk assessment calls for, and changes to supplier contracts
Software and learning	Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	The yearly audit programme, support with quarterly reporting, refresher training, supplier reviews and updates when DoH revises the standard, under Sustain™

What moves the price

The category that applies: Basic, Transitional or Advanced
The number of facilities, beds and staff with access to patient information
Clinical systems, medical devices and hosting arrangements in scope
Whether an ISMS, an ISO/IEC 27001 certificate or earlier ADHICS work exists
The deadline, and how much of the work your team can carry

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
Independent audit fees shown separately, so the full cost of the programme is comparable
Effivity, training and Academy access itemised at no additional cost
Payment milestones tied to deliverables, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does ADHICS compliance take?

A realistic ADHICS programme takes three to nine months. A clinic or pharmacy with a small estate and sound IT controls sits at the shorter end; a hospital applying the Advanced controls across many systems and devices sits at the longer one. The pace is set by governance decisions, the remediation the risk assessment uncovers, supplier cooperation and how long the controls must run before the evidence convinces. We plan backwards from that evidence, with milestones tracked in Effivity.

Phase	What determines the pace
Scope, category and gap analysis	Access to facility information, systems, device inventories, existing policies and the people who run them
Governance, build and implementation	Committee and CISO decisions, remediation, tooling and procurement, supplier negotiations and training rollout
Evidence and review	Controls operating long enough to produce logs, reviews and records, followed by the yearly internal audit, technical assessments and a committee review
Regulator or independent review	DoH's timetable for your facility, the certification body's scheduling where an ADHICS or ISO/IEC 27001 audit is used, and the time needed to close findings

If a licensing date, a DoH deadline or an audit date depends on the programme, tell us at the start. We will say what is achievable and which decisions cannot wait. A compliance date promised before anyone has looked at your systems and devices is a sales line, not a plan.

Challenges

Common ADHICS implementation challenges

Most ADHICS programmes stall on the same five problems. Each has a practical answer.

Nobody is sure which category applies, or to which facilities.

We start from the facility licences, bed capacity and services, determine the category for each entity and record the decision. A group with a hospital and several clinics can carry different categories under one governance structure.

Medical devices sit outside IT's line of sight.

Infusion pumps, imaging systems and laboratory analysers are often managed by biomedical engineering or by the vendor. We bring them into the asset register, agree baselines and access rules with those owners, and document where a vendor controls a device.

The committee and the CISO exist on paper only.

A committee that never meets and a CISO title added to a busy IT manager's job fail the first governance question. We set terms of reference, a meeting and reporting rhythm and a CISO role with realistic time, and prepare the quarterly report for the chair to approve.

Supplier contracts say nothing about security.

EMR, laboratory and imaging vendors, cloud and support providers and outsourced developers often hold the widest access. We define the security requirements, work them into contracts with your legal team and monitor how each supplier delivers.

ADHICS, ISO/IEC 27001 and other frameworks run as separate projects.

Map the requirements once to a single control set, evidence each control once and let every framework draw on the same records. The healthcare-specific parts of ADHICS are still met in full; the duplicated effort disappears.

Your engagement

What your ADHICS engagement includes

Your agreed scope brings together everything a working programme and a prepared workforce need. Some providers hand over a policy set and leave the facility to make it real; a Sterling engagement covers the whole journey, from one team, under one all-inclusive proposal.

Category, scope, gap analysis and plan
Your category determined and recorded, the gaps against Section A and the eleven domains, and a plan with owners, dates and decision points agreed before work begins.
Governance, risk and documentation
The committee and CISO structure, the risk assessment and classification scheme, and policies and procedures on Sterling's own template sets, written for your facility.
Effivity ISO & GRC software
Your ADHICS programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Yearly audit programme and committee review
The internal audit the standard expects each year, conducted or facilitated as agreed, with technical assessments coordinated and findings closed with evidence.
Audit readiness and support
Preparation for DoH reviews and for an independent ADHICS or ISO/IEC 27001 audit where you use one, with support until findings are resolved.

Compliance and enforcement decisions remain with DoH; certification decisions remain with the accredited certification body.

How we deliver

How Sterling supports your ADHICS implementation

Every ADHICS engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support that fits your team's capacity; the method, the software and the accountability do not change.

01
Design™Guided implementation: your team builds the programme with Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants carry the agreed work, from the category decision to supplier contracts and training, alongside your process owners.
03
Sustain™After go-live: the yearly audit programme, support with quarterly reporting, refresher and new-hire training and supplier reviews, year after year.
04
Automate™The programme running in Effivity: assets, risks, controls by category, suppliers, incidents, audits and reports in one workspace.
05
Revise™Revisions of ADHICS and new DoH requirements, and changes in your facilities, services, systems or suppliers.

Before work starts we agree the engagement team, the weekly working session, the deliverables and who decides what. Progress is then reviewed against those commitments, so gaps surface early rather than when an auditor is already on site.

How Sterling OS™ works

Often combined with

Standards organisations pair with ADHICS (Abu Dhabi)

Effivity · ADHICS compliance software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of ADHICS (2019).

Every Sterling ADHICS engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the committee's decisions, the asset register with its medical devices, the risk assessment, controls by category, supplier records, incidents, training and audit results live in one place, and an auditor reviews a live system rather than a shared drive. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Governance structure

Committee, CISO and workgroup

Terms of reference, members, minutes and decisions recorded against dates; the quarterly progress and compliance report drafted from live data for the chair to approve.

Risk management

Risks, treatments and control reviews

A risk register with owners and the effort, resources and cost of each mitigation; controls reviewed for relevance, performance and effectiveness on a schedule.

Asset management

Assets, medical devices and classification

Information, systems, applications and medical devices in one register, each classified Public, Restricted, Confidential or Secret, with handling and disposal records attached.

Access control

Access requests and reviews

Joiners, movers and leavers, privileged accounts, medical equipment passwords and mobile devices, with periodic access reviews signed off by system owners.

Operations management

Backups, logs and vulnerabilities

Backup and restore tests, log review sign-offs, malware protection status and vulnerability findings tracked to closure.

Third party security

Suppliers and service delivery

Every supplier with access to patient data or systems, the security terms in its contract, its service reviews and any outsourced development it performs.

Information security incident management

Events, weaknesses and incidents

Reports from any employee, triage, investigation, lessons learned and the corrective action that follows, visible to the CISO from the first report.

Across the programme

Compliance by category and one control set

Each control tagged Basic, Transitional or Advanced with its status and evidence attached, and the same controls mapped to ISO/IEC 27001, ISO 22301 and the UAE Information Assurance Standard.

What this means at the audit

An ADHICS auditor asks for the committee minutes, the CISO appointment, the asset register, the risk assessment, recent access reviews, vulnerability results, supplier agreements, incident records and the last yearly audit report. In Effivity each is a screen with dates, owners and evidence attached, not a folder assembled the week before the visit. After go-live, Sustain™ runs in the same workspace, so the next audit finds a programme that never paused.

Effivity for ADHICS: the guide Effivity GRC on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your registers, policies and records migrated, not retyped
Admin and user training for your team
Modules for ISMS, BCMS, PIMS and QMS when you integrate other standards

ADHICS client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for ADHICS are available on request. The client feedback wall lists every letter by standard.

Programmes with ADHICS in scope

How ADHICS fits beside information security and continuity.

All case studies

01
Healthcare providers: ADHICS, information security and continuity as one programme
How a programme of this kind runs: the ADHICS governance committee steers the whole programme; an ISO/IEC 27001 risk method and control set carries most of the eleven domains; ISO 22301 supplies the impact analysis and tested recovery behind information systems continuity; and the ADHICS layer adds the category decision, medical devices, health information controls, supplier terms and the quarterly compliance report, on one evidence base and one audit calendar.
Integrated management systems

Sterling Academy · ADHICS e-learning

Train every employee on ADHICS, not just the IT team.

Doctors, nurses, pharmacists and reception staff handle far more patient information than anyone in IT, and ADHICS expects awareness and training programmes that reach them. Sterling Academy delivers e-learning for the whole workforce and for the people who run the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

ADHICS awareness for every employee with access to patient information, with the training records an auditor asks for
Practitioner courses for the CISO, committee members, system owners and biomedical engineering
Internal auditor training for the people who will run the yearly audit programme, as applicable to your standard, as part of the engagement
Learner progress by department and facility, and a training status report for the auditor
New hires trained before they are given system access, so records stay current between audits
A Sterling consultant reachable when a learner needs one

Keep exploring

Explore more about ADHICS (Abu Dhabi)

Watch a video on how to comply with ADHICS here.
Watch a video on ADHICS requirements here.

ADHICS resources

Services for ADHICS (Abu Dhabi)

Why Sterling

Want successful ADHICS compliance? Come to Sterling.

Whether you run one clinic, a chain of pharmacies or a multi-site hospital group, Sterling builds an ADHICS programme your clinicians can live with and an auditor can test. We work with the realities of healthcare, round-the-clock services, shared workstations, vendor-managed devices and long supplier chains, so the controls protect patients without slowing care.

Led from our UAE regional headquarters

Your ADHICS programme is led from Sterling's regional headquarters in Dubai, drawing on information security, privacy and continuity work in 60+ countries since 2003, with one engagement team accountable for every facility in scope.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with independent audit fees identified separately. No surprises, ever.

A programme clinicians can work with

Controls designed around wards, clinics, laboratories and pharmacies as they actually operate, so security is adopted at the bedside rather than worked around.

Expert and experienced consultants

Consultants who have advised on information security, privacy and continuity management systems across sectors and countries since 2003, and who build your ADHICS programme properly the first time, so the audit confirms what already works.

Sterling vs the rest: the full comparison Explore ADHICS client experience

The Sterling Promise

What our ADHICS compliance success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed ADHICS compliance outcome is achieved: the governance and the controls for your category in place, the evidence accumulating, and the DoH review or independent audit your engagement defines supported until its findings are resolved. Clear explanations, practical delivery, included software and workforce learning turn the investment into lasting capability rather than a signed policy set.

The engagement identifies the standard, the category, the scope, the outcome and the responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. DoH enforces compliance, and any accredited certification body makes its own certification decision. Our commitment concerns the agreed compliance support, not a promise that no security incident will ever occur.

After the programme is live

What happens after you achieve ADHICS compliance?

ADHICS compliance recurs; it is never finished. The 2019 text asks for formal yearly audit programmes, quarterly progress and compliance reports, periodic technical assessments and continuing review of whether controls remain relevant and effective. Staff, systems, devices and suppliers change, and each change can open a gap if nobody is looking.

Under Sterling OS™ Sustain™ we review risks, access, suppliers, incidents and the device register with you alongside the yearly audit and the quarterly reports, so the programme stays current between audits instead of being revived when the next one is announced. When DoH revises the standard, Revise™ turns the change into a dated plan.

FAQs

Frequently asked questions about ADHICS

Is ADHICS mandatory?

For healthcare entities and services regulated by DoH in the Emirate of Abu Dhabi, yes. The standard covers hospitals and other medical facilities, diagnostic laboratories, pharmacies and insurance providers, and the professionals and support staff with access to patient information. DoH establishes and enforces it, and Malaffi requires compliance of itself and every participant.

Which category applies to us: Basic, Transitional or Advanced?

Under the 2019 text, Basic applies to every entity, whatever its facility type. Transitional applies to listed types: hospitals with 1 to 20 beds, day care surgery, primary health care, diagnostic, rehabilitation, dialysis and fertilisation centres, mobile healthcare units, home care and pharmacies. Advanced applies to hospitals with 21 beds or more. Each level includes all the requirements of the levels below it.

Is there such a thing as ADHICS certification?

Certification against ADHICS exists: the Emirates International Accreditation Centre lists the 2019 standard among the schemes for which it accredits certification bodies, so an accredited body can audit and certify your programme. A certificate does not replace your obligations to DoH, which sets and enforces the standard. Before engaging a certification body, confirm what DoH expects of your facility and check the body's ADHICS accreditation with EIAC.

We are certified to ISO/IEC 27001. Are we ADHICS compliant?

Not automatically. The two are commonly aligned in practice, and a working ISMS covers much of the risk management and many operational controls. ADHICS adds its own governance structure, the category requirements, medical devices, health information controls and quarterly compliance reporting, and its controls carry references to the UAE Information Assurance Standard. We extend the control set you have rather than starting again.

How does ADHICS relate to Malaffi?

Malaffi is the Emirate's health information exchange, a DoH initiative launched in 2019. Malaffi states that it and all participants are required to comply with Emirate-wide and federal health privacy laws and with ADHICS. On its policy page, ADHICS sits beside DoH's policy on the Abu Dhabi Health Information Exchange of April 2020 and DoH's Standard on Patient Healthcare Data Privacy of 15 September 2020.

Does ADHICS apply to our suppliers and service providers?

Through the healthcare entities they serve, yes. The standard has a third party security domain covering supplier policy and the monitoring of service delivery, and its systems acquisition domain covers outsourced software development and supply chain management. EMR, laboratory and imaging vendors, cloud providers and outsourced developers should expect security terms, questionnaires and monitoring from their Abu Dhabi healthcare clients.

What governance does ADHICS expect?

A three-level structure: an Information Security Governance Committee, chaired by a nominated senior manager, for oversight and direction; a Healthcare Information Infrastructure Protection workgroup led by the Chief Information Security Officer, who is also the entity's point of contact with the regulator; and implementation stakeholders who run the controls day to day. The committee chair approves the quarterly progress and compliance reports.

Which version of ADHICS applies, and has it been revised?

The text available through Malaffi's policy page is the standard DoH issued on 3 February 2019, reference DOH/SD/ADHICS/0.9, and it is the version EIAC lists for accrediting certification bodies. DoH can revise the standard and issue circulars, so confirm the current position with DoH before scoping; the gap analysis is mapped to the version that applies.

Does Sterling certify or audit our ADHICS compliance?

No. Sterling builds the programme and the evidence with you, and conducts internal audits where agreed. DoH enforces the standard, and an accredited certification body, if you use one, audits and decides independently. A provider offering to implement and certify the same programme is offering paper.

What do you need to prepare an ADHICS proposal?

Your facility types and bed capacity, the number of sites and of staff with access to patient information, the main clinical and business systems, the size of the medical device estate, any ISO/IEC 27001 or earlier ADHICS work, and your deadline. That is enough for a scoped, all-inclusive proposal; no policy manual is needed first.

Before the first call

Prepare a useful ADHICS readiness brief

You do not need a policy manual before the first discussion. Bring a short account of your facilities, your systems and what DoH or an auditor has asked of you. Seven questions are enough:

Which facilities are in scope, what type is each licensed as, and how many beds does each hospital have?
Which clinical and business systems hold patient information, such as EMR, laboratory, imaging, pharmacy and billing, and where is each hosted?
How many medical devices connect to your network, and who manages them: IT, biomedical engineering or the vendor?
Is there an information security committee and a CISO today, and when did the committee last meet?
Which suppliers have access to patient information or to your systems, and what do their contracts say about security?
What do previous audits, incidents or DoH correspondence tell you about the starting point?
Which frameworks do you already run, such as ISO/IEC 27001, and is there an audit, licensing date or deadline to plan around?

These answers let us scope the work and price it realistically. They prepare a conversation; they are not a scored assessment or a compliance determination.

Don’t be fooled by certification scams

If it takes ten days, it is not ADHICS compliance.

ADHICS has attracted its own shortcuts: template policy sets with another hospital's name still inside, tools sold as making a facility compliant on installation, and certificates from bodies nobody has accredited for the scheme. They look economical until DoH, an accredited auditor or an incident asks for the risk assessment, committee minutes and device register behind them.

How to choose a credible ADHICS provider

Ask who issues the certificate, if one is offered, and check with EIAC that the body is accredited for the ADHICS scheme, not only for ISO/IEC 27001.
Ask how your category was determined. A programme that never asked about your facility type and bed capacity cannot know which controls apply.
Check whether the policies describe your facility. Documents that never mention your systems, devices, sites or suppliers describe nobody in particular.
Ask about the governance. Without a working committee, an appointed CISO and approved quarterly reports, the programme has no owner the regulator can see.
Ask what happens to medical devices and suppliers. Offers that cover only servers and laptops leave out much of what the standard reaches.
Walk away from "ADHICS compliant in 7 days", "install this tool and you are compliant" and one invoice for consulting and certificate. Controls have to operate before they can be audited.

All ten warning signs of shortcut compliance

What credible ADHICS compliance always involves

Implementation time, in months not days, scaled to your category and facilities
A governance committee, an appointed CISO and a workgroup that meet and decide
A risk assessment, an asset register that includes medical devices, and classified information
The controls for your category implemented across the eleven domains, with records
Supplier security requirements in contracts, and service delivery monitored
A yearly audit programme and quarterly progress and compliance reports
Any certificate issued by a body accredited for ADHICS, after its own audit

Sterling's position. Sterling does not certify ADHICS compliance and does not enforce it: DoH enforces the standard, and accredited certification bodies audit and decide on certification. We build, train and prepare you. We do not sell policy sets or certificates without implementation, and we tell you when an offer you have received is one. Accreditation is an independent check of a certification body's competence; its absence is not proof of fraud, but it is a reason to verify the body, the scheme and what DoH expects of you.

Holding or been offered an ADHICS certificate you are unsure about? Send it to us and we will tell you, at no charge, whether it would stand up to scrutiny.

Keep exploring

More on ADHICS (Abu Dhabi) and related standards

More in Healthcare, medical devices & life sciences

Talk to a consultant

Plan your ADHICS compliance programme with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Build an ADHICS compliance programme for the first timeUnderstand cost, scope and timingPrepare for a DoH review or an ADHICS auditAlign ADHICS with ISO/IEC 27001 or other standards

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice