Published: Sep 9, 2020

The DoH Audit Program regarding Abu Dhabi Healthcare Information and Cyber Security Standards

The Abu Dhabi Department of Health (“DoH”) has published a Circular (DoH Circular No. (71) of 2020) which states that it will be initiating an audit program to ensure that all healthcare entities in the Emirate of Abu Dhabi are complying with the Abu Dhabi Healthcare Information and Cyber Security Standards (“ADHICS Standards”).


What are the ADHICS Standards?

DoH issued the ADHICS Standards on 3 February 2019 to ensure that the healthcare sector in Abu Dhabi harmonises its practices regarding privacy and information security to meet international standards and complement the Abu Dhabi Government’s Policy on the Healthcare Information Exchange (“HIE”) (dated 29/11/2018) to enhance the safety and security of health information.

Effectively there was a 12-month transition period to comply with the ADHICs standards.


What are the Health Information and Cyber Security Requirements within the ADHICS Standards?

The healthcare information and cyber security requirements within ADHICS Standards include standards for the following:

  • Human Resources Security;
  • Asset Management;
  • Physical and Environmental Security;
  • Access Control;
  • Operations Management;
  • Communications, Health Information and Security;
  • Third Party Security;
  • The Acquisition, Development and Maintenance of Health Information Systems;
  • Information Security Incident Management;
  • Information Security Continuity Management.

A significant control in the ADHICS Standards is Section CM 4.2 which provides that no healthcare entity can use cloud services or infrastructure to store, process or share information that contain the health information of a patient.

The control further states that healthcare entities must identify and disconnect integration of a system that processes, stores or utilises health information with any systems that connect or utilise cloud services and not share identified or de-identified health information with third parties, inclusive of counterparts and partners, unless authorised by the DoH.


Who is conducting the audit and what happens on completion?

The audit program will be undertaken by the Emirates Classification Society (TASNEEF) through their subsidiary TASNEEF-RINA Business Assurance (TRBA).

The audit program will be conducted in three year cycles, where in the first year of the cycle, there will be an audit conducted by TRBA to check for compliance with ADHICS, where a conformance certificate will be awarded.

In the second and third year of the cycle, there will be a surveillance audit to check for compliance with ADHICS, but no certification is provided for surveillance audits.


More Information

For more information regarding compliance with ADHICS Standards, Al Tamimi & Company’s Healthcare Sector and Technology, Media & Telecommunications teams regularly advise on laws and regulations impacting the healthcare sector. For further information please contact


Key Contacts:

Andrea Tithecott
Partner, Head of Regulatory, Head of Healthcare

Andrew Fawcett
Senior Counsel, Technology, Media & Telecommunications

Related Insights

back Chat with us

Disclaimer: This chat service should not be relied upon as a substitute for professional advice which takes account of your specific circumstances and any changes in the law and practice. No warranty is made as to the accuracy or completeness of the information provided via this service and no liability is accepted by Al Tamimi & Company Limited, its affiliates, partners or employees for any loss arising as a result of reliance upon the information provided.

I Agree   

Kindly accept the disclaimer to proceed to a live chat.

Please choose one of the following options below:

Thank you for your inquiry. We will connect you to one of our agents now.

Thank you. Which service are you looking for?

Thank you for your interest in working with Al Tamimi & Company. Please click here to view our latest job openings.

Please click here leave a message and we will get back to you shortly.