If you run a clinic in Abu Dhabi, cyber security probably isn't what keeps you up at night. You're thinking about staffing, insurance approvals, patient waiting times and the next DoH inspection. When someone mentions ADHICS, it can sound like one more compliance burden landing on an already full desk.
I understand that. But I'd like to make a case for why ADHICS is important that has nothing to do with paperwork.
Picture a Monday morning
Imagine a busy Abu Dhabi clinic. Reception opens at 8. Patients are already waiting. The receptionist logs in and the patient system won't load. Then the lab results system stops. A message appears on a screen saying your files have been encrypted, and giving a deadline.
Now the questions start, and none of them are technical. Which patients are booked today? What medication is this person on? Do we have the allergy records? Can we bill anyone? Who do we tell? Do we have to tell the regulator? Has patient data been stolen, or only locked?
This is a scenario, not a real clinic. But nothing about it is far-fetched. Healthcare is a tempting target because stopping a hospital's systems creates pressure to pay quickly. Most of what ADHICS asks you to do comes down to being able to answer those questions calmly, before that Monday arrives.
What is ADHICS, in plain language?
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health. It sets the governance, policies and technical controls that protect patient information and the systems that hold it.
| Question | Answer |
|---|---|
| Who must comply? | All DoH-licensed entities: hospitals, clinics, pharmacies, diagnostic centres, home care providers and health insurers. Suppliers handling their health data are expected to meet the relevant controls |
| Which version applies? | Version 2, published May 2024, effective August 2024 |
| Is it the same for everyone? | No. Basic, Transitional and Advanced control levels depend on size, type and risk |
| Where must patient data live? | In the UAE, unless an exception applies. Version 2 sets the conditions for cloud services |
| How is it checked? | Through self-assessments and audits, with evidence that controls are working |
Why ADHICS compliance matters beyond the audit
It protects care, not just data
In most industries, a cyber attack costs money. In healthcare, it can also delay treatment. That's why ADHICS includes keeping critical clinical systems running during a disruption, and why I'd start any conversation with a clinic there.
Patients trust you with their most private information
A leaked credit card can be cancelled. A medical history can't be taken back. Patients rarely ask how you protect their records, but they would certainly ask after a breach.
It makes you answer the "who" question
ADHICS expects a named information security lead and a steering committee. For a small clinic, that can feel like overkill. But when something goes wrong at 8am on a Monday, "who decides?" is the first question, and it's far better answered in advance.
It covers your suppliers
Your clinic management software, your IT provider and your cloud backup all touch patient data. If your IT person can log in from anywhere with a shared password, that's your risk too. Our advice is to check what your contracts actually say.
The costs of getting it wrong are real
IBM's 2026 research puts the average data breach in the Middle East at about USD 8 million. A small clinic won't face that number, but the pattern holds: lost business and recovery usually cost far more than prevention.
"We're only a small clinic." What ADHICS means for you
This is the objection I understand most. A three-doctor practice isn't a hospital group, and ADHICS doesn't treat it like one. Every entity must meet the Basic controls, which focus on the most critical threats. Much of that is sensible hygiene:
Everyone has their own login, and nobody shares passwords.
Leavers lose access the day they leave, not months later.
Patient data is backed up, and someone has tested restoring it.
Staff know what a phishing email looks like, and who to tell.
Someone is named as responsible, and knows they are.
There's a one-page plan for what to do if systems go down.
None of that needs a large budget. It needs someone to own it. For a detailed list, see our ADHICS v2 compliance checklist.
Where should you start?
Find out your control level. It decides how much work there is, so don't guess.
Check when your last assessment was done. If it was against the 2019 standard, you need a gap assessment against version 2.
List your systems and suppliers. You can't protect what you haven't written down.
Name your information security lead. A part-time virtual CISO can support whoever you appoint, though the named role itself is worth checking against DoH's expectations.
Test your backups. It's the cheapest way to find out whether a bad Monday stays a bad Monday.
If you need help, Intello's ADHICS compliance team works with healthcare providers of different sizes, and a penetration test in Abu Dhabi can give you the security testing evidence auditors look for.
Comparing providers? See the Top 10 ADHICS Compliance Consultants in Abu Dhabi.
Talk to us about ADHICS or contact our team.
Frequently asked questions
What is ADHICS?
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health – Abu Dhabi. It sets mandatory requirements to protect patient health information and the systems that support care.
Is ADHICS compliance mandatory?
Yes, for all healthcare entities licensed by the Department of Health – Abu Dhabi. Suppliers that handle their health data are expected to meet the relevant controls through their contracts.
Does a small clinic need to comply with ADHICS?
Yes, but requirements scale. Every entity must meet the Basic controls, while Transitional and Advanced controls apply to larger and more complex entities based on size, type and risk.
Why is ADHICS important if we have never been attacked?
Because attacks on healthcare can delay care as well as expose records. ADHICS helps you prepare, so you know who decides, what to do and how to recover before an incident happens.
What changed in ADHICS version 2?
Version 2 was published in May 2024 and took effect in August 2024. It formally recognises cloud services under set conditions, expands the mandatory policy set and keeps tiered control levels.