Attackers use the common routes: an exposed system, a stolen password, a supplier. In a hospital, those routes lead to devices that cannot be patched on demand, to health records the law keeps inside the UAE, and to a health authority that differs by emirate.
Time rules that touch a UAE health provider. From the shortest rule to the longest.
Abu Dhabi: remove a leaver’s access within 24 hours of exit (ADHICS V2, control HR 4.3).
Dubai: report a breach in health information sharing to DHA. The policy also names the UAE Information Office as a recipient.
Keep health records for at least 25 years from the person’s last health procedure (Federal Law No. 2 of 2019, Article 20).
An exposed system that is not patched, a phishing message, a stolen password.
20%of healthcare breaches started with an exploited vulnerability, and 14% with phishing (Verizon DBIR 2026, healthcare sector)Not only administrators. Clinicians on shared ward workstations, vendors who maintain imaging and lab equipment, and the help desk that can reset any of them.
The patient record, lab and imaging systems, connected medical devices, and the hosted services and suppliers behind them.
Two things can go wrong: care slows down, or records leave the country. Both are settled before the incident, by who may take a system offline and where the data sits.
Federal law sets the base for health data. The Abu Dhabi Department of Health and the Dubai Health Authority each add their own standard, and a group with sites in both answers to both.
Federal Law No. 2 of 2019 (Article 13) bars storing, processing, generating or transferring health data outside the State, except where the health authority allows it by decision. Breaking Article 13 carries a fine of AED 500,000 to 700,000 (Article 24).
ADHICS V2, effective August 2024, covers Abu Dhabi facilities, payers and health technology providers. Its governance committee approves quarterly compliance reports, and independent audits run at least annually.
In Dubai, sharing health data with an outside party needs a data sharing agreement or contract. The entity stays responsible for what it shares, and sub-processors must follow DHA policy.
Source: UAE Ministry of Justice and Cabinet, Federal Law No. 2 of 2019 and Cabinet Resolution 32 of 2020; Abu Dhabi Department of Health, ADHICS V2; Dubai Health Authority, Policy for Health Data and Information Sharing. This is analysis, not legal advice.
UAE rules, by who you are
Health data has a federal law, and each emirate adds its own standard: ADHICS in Abu Dhabi, NABIDH in Dubai. Manufacturers and distributors are not hospitals. Their rules differ.
Standard or policyDoH Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS V2) and the AAMEN programme, with Federal Law No. 2 of 2019 and Cabinet Resolution No. 32 of 2020.
Run the required information-security programme. Protect patient information. Manage risk, access, vulnerabilities, incidents and continuity of critical systems. Apply ADHICS controls to the scope the DoH sets for your entity.
Confirm: ADHICS V2 states its own frequencies: independent audits at least yearly or after significant change (section 6.2), and yearly schedules for vulnerability assessment and penetration testing (CO 7.1). Check the applicability matrix and any DoH direction for your entity.
Standard or policyADHICS V2 as the DoH applies it to your licence, with the federal health ICT law.
Protect electronic and other health information. Manage user access, endpoints, clinical applications, backups and incidents. The control set depends on the DoH’s requirements for your facility.
Standard or policyDHA NABIDH Information Security Standards (HISS), with Federal Law No. 2 of 2019 and Cabinet Resolution No. 32 of 2020.
Review the information-security policy at least yearly. Run periodic risk assessments. Keep asset inventories, access control, vulnerability management, malware protection, backups, incident management and continuity. The NABIDH Audit Policy calls for independent reviews at planned intervals and after significant change.
Confirm: This does not create one monthly or quarterly test cycle. The NABIDH Audit Policy also states external audits at least yearly. Confirm who that binds and your NABIDH compliance level.
Standard or policyDHA NABIDH Information Security Standards, as they apply to your licence.
Protect health information and the assets that process it. Assess technical vulnerabilities. Manage access and logs. Secure system interfaces, medical devices and third-party links.
Binding lawFederal Law No. 2 of 2019 and Cabinet Resolution No. 32 of 2020, with ADHICS or DHA standards where they apply.
Protect electronic health data from disclosure and alteration. Apply suitable controls. Work out which emirate standard and information-exchange duties apply to your licensed activity.
Binding lawFederal Law No. 2 of 2019 and Cabinet Resolution No. 32 of 2020, with ADHICS or DHA HISS where they apply.
Secure electronic consultations, authentication, connected apps and data exchange. Check cloud and third-party risk, remote access and confidentiality against the rules for your licence and integrations.
Standard or policyDESC Electronic Biomedical Devices Security Standard, developed with the DHA.
Keep a device inventory. Check network exposure. Segment devices from the clinical network. Fix configuration and vulnerabilities. Confirm which devices and systems the standard covers.
Confirm: It does not apply the same way to manufacturers and to every facility.
Regulator ruleMOHAP and the product and establishment licensing rules, with the PDPL where it applies. UAE IA and the CIIP policy only if designated.
Do not apply hospital ADHICS or HISS to a manufacturer by default. Protect production, quality, laboratory, ERP and supply-chain systems. Tie any test frequency to an explicit rule, designation or contract.
Confirm: Product-safety and GxP rules are not automatically cybersecurity rules.
Binding lawFederal Law No. 2 of 2019 for electronic health data, the federal PDPL for other personal data where it applies, health-sector rules for your licence, and contracts.
Protect personal and health data, e-prescription and commerce links. Test APIs. Control third-party access. Reporting duties depend on licence and platform scope.
This is analysis, not legal advice. Do not assume a fixed audit, scan or test cycle unless the standard that applies to you states one. ADHICS V2 states annual independent audits and yearly testing. Other rules may not. These services help meet duties. They are not all mandated purchases from an outside provider. Confirm your licence, the current standard version and any DoH or DHA circular with your counsel.
The same security decision gets a different answer once a patient and a health authority are in the picture.
Domain and cloud administrators.
Clinicians on shared workstations, the vendors who maintain clinical equipment, and the help desk that can reset any of them.
Patch on a schedule, or take the system offline.
A device in use on a ward may be neither patchable nor removable. ADHICS V2 asks for a device inventory and a separate network for medical devices.
Pick the cloud region for cost and speed.
Health data stays in the UAE unless the health authority allows an exception, so cloud, backup and vendor support copies need a location check.
Restore the systems from backup.
Restore the systems that support care in progress first, and rehearse the downtime procedures with the clinicians who will use them.
When the facts are clear.
The authority depends on the emirate and the license. Dubai names 24 to 48 hours for health information sharing breaches. Someone must be named to make the call.
Run an exercise with clinical staff on a record-system outage: who takes systems offline, what runs on paper, what returns first.
Build an inventory of devices on the clinical network and agree compensating controls for those that cannot be patched.
Trace health data across cloud, backups and vendor support copies against the UAE location rule.
Compare current practice with the standard that applies to each site, then set owners and evidence for every requirement.
Of healthcare breaches involved a third party, against 48% across all industries (Verizon DBIR 2026)
UAE rules come first for a UAE business. These are the main rules elsewhere that can reach you through customers, data or offices abroad. Check scope with your own counsel.
Card, privacy, resilience and assurance standards reach a hospital or health group through what it handles and who it serves. Each card says what kind of rule it is and when it applies. This is not a full list. Check scope with your own counsel.
US Health Insurance Portability and Accountability Act, Security Rule
US covered entities, and a business associate that handles their health data.
A rewrite was proposed on 6 January 2025. As of June 2026 it is not final, and the current Security Rule stays in force.
Source: US HHS, HIPAA Security RuleEU General Data Protection Regulation
You serve patients or run trials with participants in the EU. Health data is a special category (Art. 9).
A controller notifies the authority within 72 hours of becoming aware of a breach, unless it is unlikely to risk people’s rights (Art. 33).
Source: EUR-Lex, Regulation (EU) 2016/679EU Network and Information Security Directive 2
EU healthcare providers and pharmaceutical manufacturers.
Member States had to transpose it by 17 October 2024. In July 2026 the Commission referred four states to the Court of Justice for failing to notify their measures.
Source: European Commission, NIS2 DirectivePayment Card Industry Data Security Standard
Patients who pay by card.
Version 4.0.1 is current. Version 4.0 retired on 31 December 2024. The newer requirements have applied since 31 March 2025.
Source: PCI Security Standards CouncilAICPA System and Organization Controls 2
Asked of health technology and hosting vendors.
An auditor’s report on a provider’s controls for security, availability, processing integrity, confidentiality and privacy. No law requires it. Many buyers do.
Source: AICPA, SOC suite of servicesInformation security management systems
A common evidence point for labs, platforms and suppliers.
The 2022 edition is current. Certification is the organization’s choice, not a requirement of the standard.
Source: ISO, ISO/IEC 27001Sources and method. This page is analysis, not legal advice.
