Key takeaways
- ADHICS is the Abu Dhabi Healthcare Information and Cyber Security Standard from the Department of Health – Abu Dhabi (DoH), issued in February 2019.
- It applies to any entity that stores, processes or deals with health information from the emirate of Abu Dhabi.
- Its 692 controls fall into three categories: Basic (328), Transitional (218) and Advanced (146). Which apply depends on your facility type.
- Compliance is continuous. DoH runs an audit programme, so evidence, findings and corrective actions need tracking all year.
What ADHICS is
DoH issued ADHICS on 3 February 2019 and required healthcare facilities in Abu Dhabi to comply by 29 February 2020. It sets the governance, controls and practices for protecting health information. In 2020 DoH announced an audit programme to check that healthcare entities comply.
DoH’s implementation guidelines note that entities that already follow standards such as ISO/IEC 27001 meet a majority of ADHICS controls. ADHICS adds requirements specific to health information.
Who must comply
According to DoH, any entity that stores, processes or deals with health information from the emirate of Abu Dhabi falls within scope. That includes hospitals, centers, clinics and pharmacies, and can extend to payers and to technology and service providers that handle health information.
Which controls apply to you
| Category | Controls | Applies to |
|---|---|---|
| Basic | 328 (73 primary, 255 sub-controls) | All facility types |
| Transitional | 218 (56 primary, 162 sub-controls) | In addition to Basic: hospitals with 1–20 beds, centers and clinics, and pharmacy establishments |
| Advanced | 146 (33 primary, 113 sub-controls) | In addition to Basic and Transitional: larger entities, such as hospitals with more than 20 beds. Check the standard for your category. |
The controls cover areas such as governance, human resources security, asset management, physical and environmental security, access control, operations and communications, health information and data privacy, third-party security, systems acquisition and development, incident management, and business continuity.
Step-by-step checklist
Confirm scope and category
List the facilities, systems and suppliers that handle health information, and confirm which control categories apply.
Set up governance
Put in place the governance structure the standard requires, name owners and assign responsibilities.
Run a gap assessment
Assess each applicable control and record the evidence that exists today.
Write the policies
Adopt the baseline policies and procedures the implementation guidelines describe.
Close technical gaps
Strengthen access control and multi-factor authentication, logging, backups, encryption and network security.
Collect evidence
Keep evidence for each control where auditors can find it.
Audit and correct
Run internal audits, log findings and track corrective and preventive actions (CAPA) to closure.
Manage incidents
Record, handle and report security incidents as the standard and DoH require.
Keep it current
Review controls, risks and exemptions on a fixed schedule, and when systems or suppliers change.
Map once, comply many times
Many entities also follow the UAE Information Assurance Regulation, ISO/IEC 27001 or the NIST Cybersecurity Framework. Mapping ADHICS controls to these frameworks lets one piece of evidence satisfy several requirements, which cuts audit effort.
Where Manaa fits
Manaa (مناعة) is Birbal AI’s bilingual cyber compliance platform for the health sector. It runs compliance campaigns, audits, findings and CAPA, incidents, exemptions and risk across ADHICS, the UAE IA Regulation, ISO/IEC 27001 and NIST CSF, and can scale to every licensed facility in a health sector. See Manaa.
Questions and answers
What is ADHICS?
The Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health – Abu Dhabi (DoH) in February 2019. It sets the information and cyber security requirements for health information in the emirate.
Who must comply with ADHICS?
Any entity that stores, processes or deals with health information from the emirate of Abu Dhabi, according to DoH.
How many controls does ADHICS have?
692, in three categories: Basic (328), Transitional (218) and Advanced (146). The categories that apply depend on the facility type.
Is ISO/IEC 27001 enough for ADHICS?
Not on its own. DoH’s guidelines say ISO/IEC 27001 covers a majority of ADHICS controls, but ADHICS adds requirements specific to health information.
Does DoH audit ADHICS compliance?
Yes. DoH announced an audit programme in 2020 to check that healthcare entities comply.
Is there software for ADHICS compliance?
Yes. Manaa manages ADHICS campaigns, audits, findings and corrective actions, alongside the UAE IA Regulation, ISO/IEC 27001 and NIST CSF.
Sources
- DoH: ADHICS frequently asked questions (control counts and categories)
- DoH: Department of Health launches ADHICS (March 2019)
- Al Tamimi & Co: the DoH audit programme for ADHICS
Birbal AI is an independent company based in Abu Dhabi. Facts about third parties come from the sources above; check them for the latest position.