ADHICS Explained: What the Abu Dhabi Healthcare Cyber Security Standard Requires

ADHICS stands for Abu Dhabi Healthcare Information and Cyber Security Standard. According to the DoH ADHICS FAQ, it is a sector-level standard by the Department of Health, mandated for all healthcare entities in Abu Dhabi.

• Controls. The FAQ (version 1.3) states 692 controls, made up of 162 primary controls and 530 secondary controls, in 11 domains.
• AAMEN programme. DoH uses AAMEN as the name for all its information security standards, related audits, compliance monitoring and certifications.
• Version. The standard has been revised since the 2019 document published on the DoH site. Always confirm the current version and the current guidance with DoH before you plan.

The DoH FAQ says any entity that stores, processes or deals with health information from the emirate of Abu Dhabi needs to comply with the applicable controls. It also says a small clinic with one doctor, two nurses and an administrator must comply: the minimum mandatory controls depend on the type of entity, not on its size alone.

If a Basic control is not relevant to your operation, the standard expects a valid business justification with evidence, not silence.

The requirements section of the standard groups controls into these domains. A short plain-language reading of each:

1. Human resources security. Checks before hiring, rules during employment and removing access when people leave.
2. Asset management. Knowing what devices, systems and data you hold, who owns them and how they are classified and disposed of.
3. Physical and environmental security. Secure areas, server rooms and equipment protection.
4. Access control. Who can use which system, how accounts are approved and how access is reviewed.
5. Operations management. Day-to-day procedures, malware protection, backup, logging and vulnerability management.
6. Communications. Network security and safe exchange of information.
7. Health information and security. Protecting and keeping private the health records themselves.
8. Third-party security. Suppliers and vendors who touch your systems or data.
9. Information systems acquisition, development and maintenance. Security when you buy, build or change systems, including cryptography and outsourced development.
10. Information security incident management. Detecting, reporting and handling security incidents.
11. Information systems continuity management. Keeping systems running and recovering them after a failure.

The DoH FAQ states what happens if an entity does not comply: the compliance requirements are added to the existing audit process and to the licence registration and renewal process.

It also says a minimum set of ADHICS controls, identified by the Malaffi team, must be met before an entity can connect to Malaffi, the Abu Dhabi health information exchange. See the DoH FAQ for the contacts DoH publishes.

The standard also expects each entity to run its own formal audit programme to check its compliance. An external audit is a separate step: it is carried out through DoH's process, not by your IT supplier.

The DoH FAQ says cloud computing controls are set out in the standard. It also states that storing, developing or transferring health information outside the UAE, where it relates to health services provided in the country, is not permitted under Federal Law No. 2 of 2019 on the use of information and communications technology in healthcare.

Before you sign with a cloud, email or backup provider, ask in writing where the data is stored and processed.

This is a practical starting list, not a replacement for the standard. Work through it, then compare it with the current requirements for your facility type.

1. Confirm your category. Which control categories apply to your facility type, and which Basic controls, if any, are not relevant to you.
2. Assign roles. Name who is responsible for information security, even in a small clinic. The FAQ says roles must be assigned to competent people.
3. List your assets. Computers, servers, medical devices, software and where health data sits.
4. Write the policies. Short, signed policies for access, backup, incidents and acceptable use.
5. Control access. Individual accounts, removal when staff leave and regular access reviews.
6. Protect and test backups. Back up health data and test a restore, not only the backup job.
7. Find and fix weaknesses. Patch systems and run a vulnerability assessment; see the VAPT buyer's guide.
8. Keep logs. Record who accessed what and keep the records.
9. Plan for incidents. A written plan for who does what, and who is told, when something goes wrong.
10. Review suppliers. Contracts and data location for every vendor that touches your systems.
11. Train staff. Short, regular awareness training with records.
12. Collect evidence by control. One organised folder per control so an auditor can follow it quickly.

Quicknet Computers is an independent IT and security provider in Abu Dhabi and Al Ain. It is not an ADHICS accreditation body, an audit firm or a certificate-issuing authority: the audit is carried out through DoH's process. Quicknet helps with the technical side: a time-boxed ADHICS pre-audit readiness engagement, ongoing healthcare IT and Malaffi support and IT support for ADHICS audits, and security testing described in the VAPT services page.

ADHICS pre-audit readiness · Healthcare IT, ADHICS and Malaffi · IT support for ADHICS audits · VAPT vs penetration test guide · VAPT services · IT AMC · Medical centre PC maintenance · Clinic IT, CCTV and EMR package

• Department of Health, ADHICS frequently asked questions (version 1.3)
• Department of Health, ADHICS standard (2019 document)

Links checked 5 November 2026. Last reviewed 5 November 2026. This page is general information, not legal or compliance advice. Confirm the current version and requirements with the Department of Health.