ADHICS: Abu Dhabi Healthcare Information and Cyber Security Standard
ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health Abu Dhabi. Version 2, published in May 2024 and effective from August 2024, applies to healthcare entities in the Emirate and to technology and service providers handling health information. This page explains how it relates to UAE IA and ISO 27001.
ADHICS is the information and cyber security standard for healthcare in Abu Dhabi. This page explains what it is, who it applies to and how it fits next to the UAE IA Standards and ISO 27001.
What ADHICS is
ADHICS stands for the Abu Dhabi Healthcare Information and Cyber Security Standard. It is issued by the Department of Health Abu Dhabi, the health sector regulator in the Emirate. The first version dates from 2019. Version 2 was published in May 2024, took effect in August 2024 and has a scheduled revision date of May 2027. The current standard and its implementation guideline are published on the AAMEN programme page of the Department of Health Abu Dhabi.
Who ADHICS applies to
ADHICS applies to any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes or transmits health information. That includes healthcare facilities and payers, and, under version 2, healthcare technology and service providers such as medical device, electronic medical record and web or mobile application providers. The standard also covers the entity's use of partner and third-party systems within the Abu Dhabi healthcare ecosystem. Which controls apply depends on the type of entity, so confirm the position with the Department before scoping any work.
ADHICS, UAE IA Standards and ISO 27001
ADHICS is a sector standard in its own right and does not replace the UAE IA Standards or ISO 27001. Its control summary includes a reference column to the UAE Information Assurance Regulation, which shows how closely the two relate. All of these frameworks rest on governance, risk management and a set of controls, so evidence built for one can often support another once the controls are mapped. A single control set with one risk register avoids testing the same safeguard several times.
enterprise infrastructure?
Schedule a technical briefing. No sales pitch, just architects and your team.
How Krasper helps
We can run an information security assessment that can be scoped to ADHICS requirements, testing your controls finding by finding, and use IT security governance, which can also be scoped to ADHICS requirements, to map the result into one control set with a risk register and board reporting.
How the standard is structured and checked
Version 2 opens with introduction, governance and framework requirements, including the roles an entity must assign for information security. The control requirements follow in eleven domains, from human resource security and asset management to data privacy and protection, cloud security, third party security and information systems continuity management. Controls are grouped into four categories: Basic, Transitional, Advanced and Service Provider. Which categories apply depends on the type and size of the entity.
Compliance is checked through the Department's AAMEN programme. The standard requires each entity to run an annual audit programme and to submit its compliance status and roadmap to the Department as part of periodic reporting. Check the current standard on the Department's website for the exact obligations that apply to your entity type.