Most ADHICS checklists I see online have one problem: they tell you what the standard says, but not what "done" looks like. So here's a different version. For each area, I've listed what to have in place, and the simple test I'd use to see if it's real.
One suggestion before you start. Print this, sit down with your IT lead and one person from clinical operations, and go through it honestly for an hour. It's the cheapest gap assessment you'll ever do. Use it as your ADHICS checklist, and mark anything you're unsure about as "no". You'll learn more from the arguments than from the ticks.
Before you begin: three things to confirm
Your control level. Every entity meets the Basic controls. Transitional and Advanced depend on your size, type and risk.
Which version you last assessed against. ADHICS version 2 was published in May 2024 and took effect in August 2024, replacing the 2019 standard.
What's in scope. List your sites, systems and any supplier that holds patient data.
1. Governance and accountability
| Have in place | The test |
|---|---|
| An information security steering committee | Can you show minutes from its last meeting? |
| A named information security lead | Does that person know they hold the role, and have time for it? |
| Management sign-off on security decisions | Who accepted your last risk, and where is that recorded? |
2. Risk management
| Have in place | The test |
|---|---|
| A documented risk assessment of systems supporting patient care | Does it mention your actual systems by name? |
| A treatment plan approved by leadership | Does each risk have an owner and a date? |
| A regular review | When was it last updated, and what changed? |
3. Policies and procedures
| Have in place | The test |
|---|---|
| The mandatory policy set, updated for version 2 | Do they describe how your organisation really works, or are they downloaded templates? |
| Approval and communication to staff | Could a receptionist tell you where to find them? |
| Regular review dates | Is anything overdue? |
Version 2 expanded the mandatory policy set. If your policies date from the 2019 standard, assume there are gaps.
4. People and awareness
| Have in place | The test |
|---|---|
| Security checks before hiring | Are they on file for your latest hires? |
| Role-based training for clinical and non-clinical staff | Can you show attendance records from this year? |
| Secure off-boarding | Pick your last leaver. Was their access removed the same day? |
That last test is the one I like most. It takes five minutes, and it tells you a great deal about how the rest of the system is working.
5. Assets and health information
| Have in place | The test |
|---|---|
| An inventory of systems, medical devices and data | Is the newest device on the list? |
| Data classification and handling rules | Do staff know how to share a patient record safely? |
| Health data location | Can you confirm where each system stores patient data? |
Patient health data must stay in the UAE unless an exception applies. Ask your software vendors in writing where their data sits, including backups. It's a common surprise.
6. Access and operations
| Have in place | The test |
|---|---|
| Individual user accounts | Are there any shared logins on a ward or front desk? |
| Privileged access control | Who has admin rights, and is that list short? |
| Logging, patching and malware protection | What is the oldest unpatched system you have? |
| Technical testing | When was your last independent penetration test in Abu Dhabi? |
Medical devices often run old software that can't be patched easily. That isn't a failure in itself, but you do need to know about them and keep them separated on the network.
7. Third parties and cloud
| Have in place | The test |
|---|---|
| Security requirements in supplier contracts | Open your clinic software contract. Is security mentioned? |
| Oversight of vendors with access to patient data | Can you list everyone who can log in remotely? |
| Controls for cloud services | Have you checked each one against version 2 conditions? |
8. Incidents and continuity
| Have in place | The test |
|---|---|
| A process to detect, respond to and report incidents to DoH | Who would call DoH, and do they know how? |
| A plan to keep critical clinical systems running | What would reception do if systems went down this minute? |
| Tested backups | When did you last restore from one? |
If you only act on one item from this entire list, make it the backup test. An untested backup is only a hope. If you want a structured response plan, our incident response planning service can help.
What should your evidence pack look like?
When audit time comes, organise evidence by domain, not by date. For each control, keep the policy, one or two recent records that prove it happens, and the name of its owner. Screenshots with dates, training records, access review sign-offs and meeting minutes are all useful. Avoid the classic mistake of creating everything in the week before the audit. Auditors can usually tell.
Common mistakes
Treating version 2 as a small update to the 2019 work.
Leaving it all to IT. Clinical operations must be in the room.
Buying templates and changing only the logo.
Forgetting suppliers, especially the small IT company that "looks after everything".
Assuming ISO 27001 covers it. It helps a lot, but ADHICS adds healthcare-specific requirements and DoH reporting.
Not sure why this matters beyond the audit? I've written about that in why ADHICS compliance is important. If you'd like a second pair of eyes, our ADHICS team can run a formal gap assessment against version 2.
Comparing providers? See the Top 10 ADHICS Compliance Consultants in Abu Dhabi.
Talk to us about ADHICS or contact our team.
Frequently asked questions
What should an ADHICS checklist cover?
Governance, risk management, policies, people and awareness, assets and health information, access and operations, third parties and cloud, and incidents and continuity, all matched to your control level.
What are the ADHICS requirements for a small clinic?
Every entity must meet the Basic controls. For a small clinic, that typically means named responsibility, individual logins, secure off-boarding, staff awareness, tested backups and a plan for incidents and outages.
What do auditors look for in an ADHICS audit?
Evidence that controls are working, not only written policies. Keep the policy, recent records that prove it happens and the name of its owner, organised by domain.
Does ISO 27001 cover ADHICS?
Partly. ISO 27001 gives you a strong management system and many overlapping controls, but ADHICS adds healthcare-specific requirements, mandatory policies and DoH reporting duties.
Can we store patient data in the cloud under ADHICS?
Yes, under conditions. Version 2 recognises cloud services, but patient health data must stay in the UAE unless an exception applies. Check each provider, including where backups are held.