ADHICS v2 · Department of Health – Abu Dhabi
ADHICS Compliance Services
We help hospitals, clinics, pharmacies, insurers and health-tech suppliers meet ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard. We assess you against version 2, put the right controls and policies in place, and prepare the evidence the Department of Health – Abu Dhabi will review.
- 23+ years in UAE cybersecurity
- 500+ clients
- 99% client satisfaction
What is ADHICS?
ADHICS (the Abu Dhabi Healthcare Information and Cyber Security Standard) is the mandatory information and cyber security standard for healthcare entities licensed by the Department of Health – Abu Dhabi (DoH). It sets the governance, policies and technical controls needed to protect patient health information and the systems that hold it. Version 2 took effect in August 2024.
| Full name | Abu Dhabi Healthcare Information and Cyber Security Standard |
|---|---|
| Issued by | Department of Health – Abu Dhabi (DoH) |
| Current version | Version 2, published May 2024, effective August 2024. Replaces the 2019 version |
| Applies to | All DoH-licensed healthcare entities: hospitals, clinics, pharmacies, diagnostic centres, home care providers and health insurers, plus suppliers that handle their health data |
| Control levels | Basic, Transitional and Advanced. Every entity meets the Basic controls; higher levels depend on the entity’s size, type and risk |
| Structure | A governance section plus 11 control domains, supported by a set of mandatory policies |
| Health data location | Patient health data must be stored and processed in the UAE unless an exception applies. Version 2 sets the conditions for using cloud services |
Does ADHICS apply to you?
You need to meet ADHICS if any of these describe you:
- You hold a DoH licence for a hospital, clinic, medical centre, pharmacy, laboratory or diagnostic centre in Abu Dhabi
- You provide health insurance or third-party administration in the Abu Dhabi health sector
- You offer home care, telemedicine or other licensed health services in the emirate
- You supply software, cloud, IT or medical-device services that store or process patient data for a DoH-licensed entity
- You are opening a new facility or renewing your licence and have been asked for ADHICS evidence
Operating across emirates? Dubai and the Northern Emirates have their own health regulators. We map ADHICS against their requirements, ISO 27001 and the UAE IA Standard, so you run one programme.
What ADHICS compliance involves
ADHICS combines governance requirements with controls across 11 domains. In practice the work falls into eight areas.
Governance and accountability
An information security steering committee, a named information security lead, and management sign-off on security decisions and risk acceptance.
Risk management
A documented risk assessment of the systems and data that support patient care, with a treatment plan your leadership approves.
Policies and procedures
The mandatory policy set, covering areas such as access control, acceptable use, incident management and data classification, approved and communicated to staff.
People and awareness
Security checks before hiring, role-based awareness training for clinical and non-clinical staff, and secure off-boarding.
Assets and health information
An inventory of systems, medical devices and data, with classification and handling rules for patient health information.
Access and operations
User access management, privileged access, logging, patching, malware protection and secure network and communications.
Third parties and cloud
Security requirements in supplier contracts, oversight of vendors with access to patient data, and controls for any cloud service you use.
Incidents and continuity
Detecting, responding to and reporting security incidents to DoH, and keeping critical clinical systems running during disruption.
How we get you ADHICS compliant
A fixed sequence, so you always know what happens next and what you will have at the end of each stage.
- 1
Scoping call
We confirm your entity type, the control level that applies to you, the facilities and systems in scope, and any DoH deadlines you are working to.
Week 0 · free
- 2
Gap assessment
Interviews, document review and technical checks against the ADHICS v2 controls for your level. Every gap is rated by risk and by the control level it belongs to.
Weeks 1–4
- 3
Roadmap and quick wins
A prioritised remediation plan with owners and dates, starting with the Basic controls and anything that exposes patient data today.
Weeks 4–5
- 4
Policies and governance
The mandatory policy set, the steering committee terms of reference, risk register and roles, written for your organisation rather than copied from a template.
Weeks 4–10
- 5
Technical remediation
Access control, logging, vulnerability management, backup, network and endpoint controls, implemented by our engineers or alongside your IT team.
Weeks 6–20
- 6
Internal audit and DoH readiness
A mock audit against the standard, a completed self-assessment and an evidence pack organised by domain, ready for DoH review.
Final 3–4 weeks
A clinic or pharmacy at the Basic level typically completes the programme in 2 to 3 months. Hospitals at the Advanced level usually need 4 to 6 months.
What you get
- Confirmation of your control level and scope
- Gap assessment against ADHICS v2, rated by risk
- Prioritised remediation roadmap with owners and dates
- The mandatory ADHICS policy and procedure set
- Steering committee terms of reference and security roles
- Risk assessment and risk treatment plan
- Asset and health information inventory with classification
- Incident response and DoH reporting playbook
- Internal audit report, self-assessment and evidence pack
- Control mapping to ISO 27001 and the UAE IA Standard
Choose how we work with you
ADHICS gap assessment
3–4 weeksBest for: Knowing exactly where you stand
- · Control level confirmed
- · Gap report against v2
- · Remediation roadmap
Full ADHICS implementation
2–6 monthsBest for: Getting compliant end to end
- · Everything in the gap assessment
- · Policies and technical controls
- · Internal audit and DoH readiness
Ongoing compliance support
MonthlyBest for: Staying audit-ready year round
- · Virtual security lead
- · Quarterly control reviews
- · Annual internal audit
Not sure which ADHICS level applies to you?
A 30-minute call is enough to confirm your control level, what is missing and what it will take to fix.
ADHICS version 2 vs the 2019 standard
If you complied with the 2019 standard, much of your work carries over. These are the main areas to revisit.
| Topic | ADHICS 2019 | ADHICS v2 (2024) |
|---|---|---|
| Status | Replaced | In force since August 2024 |
| Cloud services | Limited guidance | Formally recognised, with conditions for hosting and processing health data |
| Policies | Core policy set | Expanded set of mandatory policies to create or update |
| Control levels | Tiered by entity | Basic, Transitional and Advanced, assigned by entity size, type and risk |
| What to do | Not applicable | Run a gap assessment against v2 and update policies, evidence and cloud arrangements |
What affects cost and timeline
You get a written scope and quote after the scoping call. These are the factors that move it:
- Control level
- Basic, Transitional or Advanced: each level adds controls and evidence.
- Facilities and sites
- Each hospital, clinic or branch adds systems, staff and locations to cover.
- Clinical systems and devices
- The number of systems, connected medical devices and integrations that hold patient data.
- Existing work
- ISO 27001, a 2019 ADHICS programme or existing policies can be reused.
- Cloud and suppliers
- Cloud-hosted systems and vendors with access to patient data need extra controls and contract terms.
- Who implements
- Advisory only, or advisory plus our engineers implementing the technical controls.
Why healthcare organisations choose Intello for ADHICS
23+
years in UAE cybersecurity
500+
clients served
99%
client satisfaction
Policy and engineering under one roof. We implement the technical controls ADHICS expects, such as access management, logging and testing, not only the documents.
Built for clinical environments. We plan changes around patient care, so security work does not disrupt clinical systems.
One programme for many frameworks. ADHICS, ISO 27001 and the UAE IA Standard are mapped once, so you do not repeat work.
UAE-based team. We work on site with your teams in Abu Dhabi and across the UAE.
Frequently asked questions
What is ADHICS?
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health – Abu Dhabi. It sets mandatory information and cyber security requirements for every healthcare entity the DoH licenses, to protect patient health information and the systems that support care.
Who must comply with ADHICS?
All DoH-licensed healthcare entities in Abu Dhabi, including hospitals, clinics, pharmacies, diagnostic centres, home care providers and health insurers. Suppliers that store or process patient data on their behalf, such as software, cloud and IT providers, are expected to meet the relevant controls through their contracts.
What changed in ADHICS version 2?
Version 2 was published in May 2024 and took effect in August 2024, replacing the 2019 standard. It formally recognises cloud services for health data under set conditions, expands the mandatory policy set, and keeps a tiered set of control levels so requirements match the size and risk of each entity. Entities compliant with the 2019 version should run a gap assessment against version 2.
What are the Basic, Transitional and Advanced controls?
They are the three control levels in ADHICS. Every entity must meet the Basic controls, which address the most critical threats. Transitional and Advanced controls add requirements for larger and more complex entities, such as hospitals and insurers. Your level depends on your entity’s size, type and risk.
How is ADHICS compliance checked?
The DoH checks compliance through self-assessments and audits, and expects entities to keep evidence that controls are working, not only written policies. We prepare a completed self-assessment and an evidence pack organised by domain, and run a mock audit before any DoH review.
Can we use cloud services under ADHICS?
Yes, under conditions. Version 2 formally recognises cloud services for storing and processing health data, but patient health data must stay in the UAE unless an exception applies, in line with federal health data law. We review your cloud providers and contracts against these conditions.
How long does ADHICS compliance take?
A gap assessment takes 3 to 4 weeks. A clinic or pharmacy at the Basic level typically completes the full programme in 2 to 3 months; a hospital at the Advanced level usually needs 4 to 6 months.
Does ISO 27001 certification cover ADHICS?
Partly. ISO 27001 gives you a strong management system and many overlapping controls, but ADHICS adds healthcare-specific requirements, mandatory policies and DoH reporting duties. A gap assessment against ADHICS v2 shows exactly what is left to do.
Related services
Get a clear view of your ADHICS position
Tell us a little about your organisation and we will set up a free 30-minute readiness check.
What happens next
- 1We reply within one business day
- 2A 30-minute call to confirm your control level and scope
- 3A written scope, timeline and quote
Prefer to talk now? Call +971 55 355 6787
Last reviewed: October 2026. This page is general guidance, not legal advice.
Sources: ADHICS Standard, Version 2 (Department of Health – Abu Dhabi)