ADHICS — the Abu Dhabi Healthcare Information and Cyber Security Standard — is the mandatory information security standard issued by the Department of Health Abu Dhabi. It applies to healthcare providers, payers and health IT suppliers operating in the Emirate, and sets control requirements across governance, asset management, access control, third parties, incident management and medical device security.
Key Takeaways
- ADHICS applies to hospitals, clinics, payers, laboratories, pharmacies and health IT vendors operating in Abu Dhabi.
- Controls are tiered — the requirements that apply depend on how your entity is classified.
- Medical device and clinical system security are explicitly in scope, which pulls biomedical engineering into a security programme.
- Patient data handling obligations sit alongside UAE PDPL, so the two programmes should be run together.
- Evidence of operating controls matters more than documentation volume at assessment.
What is ADHICS?
ADHICS is the control standard that governs information and cyber security for the Abu Dhabi healthcare sector. It was issued by the Department of Health Abu Dhabi (DoH) to establish a consistent baseline across an ecosystem where patient data moves constantly between providers, insurers and platforms.
The structure will look familiar to anyone who has worked with ISO 27001. Controls are grouped into domains covering governance, human resources, asset management, physical and environmental security, access control, operations, communications, acquisition and development, third-party security, incident management, continuity and compliance.
What makes ADHICS distinctly healthcare is the emphasis on clinical systems and medical devices, and the recognition that availability failures in a hospital are patient safety events, not just IT outages.
Who needs to comply?
- Hospitals, clinics and day surgery centres licensed in Abu Dhabi.
- Diagnostic laboratories, imaging centres and pharmacies.
- Health insurance providers and third-party administrators processing claims data.
- Health information exchange participants and telehealth providers.
- Technology suppliers hosting or processing health data on behalf of licensed entities.
Requirements are not uniform across all of these. Entities are classified, and the control set that applies scales with classification — a large tertiary hospital carries materially more obligation than a single-practitioner clinic. Establishing your classification correctly is the first task, because it determines the size of the entire programme.
Which controls cause the most difficulty?
In our experience across UAE healthcare engagements, five areas consume most of the remediation effort:
- Medical device security. Imaging systems, infusion pumps and monitoring equipment often run unsupported operating systems that cannot be patched without vendor approval. Compensating controls and network segmentation do the work that patching cannot.
- Asset inventory. Clinical environments accumulate devices through departmental purchases, and a complete inventory frequently does not exist until the programme forces one.
- Access control in clinical workflow. Shared workstations, urgent access needs and high staff turnover pull against least privilege. Break-glass access with proper logging is usually the right answer.
- Third-party assurance. Healthcare runs on specialist suppliers, and evidencing their security posture is a programme in itself. Our advisory team treats this as structured third-party risk management rather than a questionnaire exercise.
- Continuity for clinical systems. Downtime procedures must be exercised, not just documented, because the recovery plan is used under genuine pressure.
How ADHICS relates to UAE PDPL and other frameworks
ADHICS and UAE PDPL overlap heavily but are not the same thing. ADHICS is a security control standard for the Abu Dhabi healthcare sector. PDPL is federal data protection law covering personal data across sectors, with obligations around lawful basis, data subject rights and breach notification.
Healthcare entities are typically subject to both. The sensible approach is one programme with a mapped control set — an access control that satisfies ADHICS generally also supports PDPL security obligations, and evidence captured once can serve both assessments.
If you also hold or plan ISO 27001 certification, that management system becomes the backbone. Risk assessment, policy, internal audit and continual improvement are shared; the sector-specific controls sit on top.
Preparing for an ADHICS assessment
- Confirm classification and scope, including every site, system and supplier in play.
- Run a gap assessment against the applicable control set and rank findings by patient-safety and data-exposure impact.
- Close the high-impact gaps first — medical device segmentation, privileged access, backup recoverability.
- Capture evidence as controls operate: access review records, incident tickets, continuity test reports, training completion.
- Perform an internal audit and fix findings before the formal assessment.
The single most common cause of a difficult assessment is evidence that was never collected. Controls that genuinely operate but produce no artefact are scored the same as controls that do not operate at all.
Frequently Asked Questions
What does ADHICS stand for?
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health Abu Dhabi. It sets mandatory information security control requirements for healthcare entities licensed to operate in the Emirate.
Is ADHICS mandatory for private clinics?
Yes, for entities licensed in Abu Dhabi, though the applicable control set depends on entity classification. A small private clinic carries a lighter requirement than a large hospital group, but it is not exempt.
How is ADHICS different from ISO 27001?
ISO 27001 is a voluntary international management system standard where you can justify excluding controls. ADHICS is a mandatory sector standard with a prescribed control set and specific healthcare requirements, particularly around medical devices and clinical systems. ISO 27001 work transfers substantially but does not replace ADHICS.
Do medical devices fall under ADHICS?
Yes. Connected clinical and biomedical equipment is explicitly in scope, which is often the hardest part of a programme because many devices run unsupported software and cannot be patched without manufacturer approval. Segmentation and compensating controls usually carry the load.
How long does ADHICS readiness take?
For an entity starting without a formal security programme, six to twelve months is realistic. Medical device inventory and segmentation are usually the longest workstreams because they require coordination with biomedical engineering and device vendors.
Does ADHICS compliance cover our PDPL obligations?
It supports them but does not replace them. ADHICS addresses security controls; PDPL adds obligations around lawful processing, data subject rights, records of processing and breach notification. Most healthcare entities need both, which is why running them as one mapped programme is more efficient.
Talk to a UAE Cybersecurity Team
Cybersecurity MEA works with Abu Dhabi healthcare providers on ADHICS scoping, gap assessment, medical device segmentation and assessment readiness. Our cyber consulting and advisory practice runs ADHICS alongside PDPL and ISO 27001 as a single programme, supported by security testing where clinical systems need validation. Speak to our healthcare security team.