Healthcare Cybersecurity in the UAE: Protecting Patient Data and Clinical Systems

Patient data in the UAE is governed by more than one privacy rule. The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021 and classifies health and medical data as sensitive personal data, according to UAE Legislation. For healthcare cybersecurity in the UAE, organisations need to understand which obligations apply to each data flow and facility.

That distinction matters in practice: protecting patient confidentiality must go hand in hand with keeping clinical systems available and supporting safe care. Healthcare organisations in Abu Dhabi also need to translate ADHICS requirements into clear controls, accountable governance and workable resilience measures. Effective safeguards connect these requirements to everyday clinical operations.

This article explains how the PDPL relates to patient information, what ADHICS means for Abu Dhabi facilities, and how access management, monitoring, incident response and recovery work together. It also outlines how to assess gaps and shape a programme around your clinical environment, so security supports compliance efforts and day-to-day care.

Does PDPL apply to patient data?

Patient records need protection under the rules that apply to their organisation and health-data activities. The UAE Personal Data Protection Law is Federal Decree-Law No. 45 of 2021 and classifies health and medical data as sensitive personal data, according to UAE Legislation.

Patient Data Privacy and EHR Security

Electronic health records can bring diagnoses, prescriptions, appointments and identifying details together. Protecting patient privacy means controlling who can view or change each record, and keeping access traceable through audit logs. Assess how patient data moves between clinical teams, systems and connected services. For example, an Abu Dhabi clinic should map staff access to its patient-record system and review whether each role needs the permissions assigned to it.

Retention and Breach Notification

Retention decisions should account for the records held, their purpose and the rules governing the healthcare organisation. Avoid treating a single retention period as universal across the UAE. For breaches, Article 9 of the PDPL requires a controller to notify the UAE Data Office once it becomes aware of a qualifying breach. Notification timing can depend on the circumstances. A response plan should identify who assesses an incident, preserves evidence and coordinates any required notification.

What penalties apply? Article 26 of the PDPL leaves penalties to a Cabinet decision. This section therefore does not assign a specific fine amount to healthcare cybersecurity or patient-data violations. Organisations should treat compliance as an operational responsibility, not rely on an assumed penalty figure.

Federal health-data rules also matter. Federal Law No. 2 of 2019 requires electronic health records to be localised in the UAE and prohibits cross-border transfers without ministerial approval. Map where records are stored and which services can access them, including cloud systems and external processing. That inventory helps distinguish approved local handling from transfers that may need authorisation.

For a practical UAE example, an Abu Dhabi facility connecting clinical systems should document record flows, user access and storage locations. That creates a clearer basis for privacy controls and incident response. The healthcare cybersecurity page relates these considerations to healthcare environments.

Prepare for disruption as well as prevention. Ransomware can affect record access and clinical operations, so response procedures should explain how teams contain affected systems, assess data exposure and restore access from secure backups. Test whether these steps preserve the availability and integrity of patient records. Clarify responsibilities across clinical, privacy and IT teams so decisions and notifications follow an agreed process.

Abu Dhabi healthcare information security programme

In Abu Dhabi, the Department of Health developed ADHICS with healthcare facilities. The standard supports readiness for natural disasters, system failures and denial-of-service attacks. It treats resilience as an operational requirement, not a separate IT exercise. An information security programme should connect clinical priorities with safeguards for health information. This helps teams protect care delivery while sharing records with authorised services.

Begin with a risk assessment that maps clinical systems, data flows and dependencies. Include electronic records, diagnostic services, cloud workloads, email and external connections. For each area, identify likely disruptions, potential patient impact and existing safeguards. Assign an owner and remediation priority to every gap. For example, a hospital assessment can examine how an outage affects appointments, treatment decisions and authorised information sharing. This gives leaders a practical basis for sequencing improvements.

Business continuity planning should describe how essential services continue during disruption. Identify which clinical functions depend on each system, who makes recovery decisions and how staff communicate if normal channels fail. Secure backups and tested recovery procedures support data availability after system failure or ransomware. Information sharing also needs defined access and approved channels. In Abu Dhabi, a facility exchanging health information with another authorised care provider should document the systems involved and the safeguards protecting each transfer.

Privileged access needs focused oversight because administrative accounts can change systems and permissions. Limit elevated access to defined responsibilities, review accounts when roles change and retain logs for investigation. Apply the same discipline to cloud workload security: map hosted systems, configuration ownership and connections to clinical networks. Check whether permissions, security settings and monitoring suit each workload’s role. These controls reduce avoidable exposure without obstructing authorised clinical work.

Email security is another essential control. A business email compromise attempt may impersonate a supplier or senior employee to request payment changes or sensitive information. Give staff a clear way to report suspicious messages, and use technical controls to detect risky links, attachments and sender impersonation. For example, if a clinic finance team receives an unexpected bank-detail change, staff should verify it through an established channel before acting. This reduces reliance on email alone.

Managed security services can support monitoring and incident coordination where internal capacity is limited. Define what systems they monitor, how alerts reach accountable staff and how findings feed into the risk assessment. Pair that work with periodic vulnerability assessment and remediation tracking. In the Abu Dhabi healthcare sector, a programme is stronger when governance, clinical operations and technical teams share clear responsibilities. Review the programme after system changes, new cloud deployments or incidents, then update priorities to reflect changed risks and dependencies.

Electronic medical record access controls

UAE healthcare providers should protect electronic health records with role-based access, audit logging, network controls and secure connections. In Abu Dhabi, ADHICS aims to protect patient information’s confidentiality, integrity, accuracy, quality and availability.

Start by matching electronic medical record permissions to clinical duties. A clinician may need access to records for assigned care, while administrative staff may need different functions. Configure roles around actual responsibilities, then remove or adjust access when someone changes teams. This reduces unnecessary exposure without blocking legitimate clinical work.

For each account, define permitted actions, not just system access. Separate viewing, editing and administrative privileges where systems allow. Restrict privileged access to authorised duties and review permissions when responsibilities change. For example, a hospital reception role should not automatically have the same record-editing privileges as a treating clinician.

Logging makes access more accountable. Record who accessed or changed a patient record, which system they used and when. Review logs for unusual access patterns and retain them for incident investigations. Audit trails can help a provider distinguish routine clinical use from unexpected access and respond more clearly when a patient or compliance team raises a concern.

Network segmentation adds another layer of control. Separate clinical systems from general office devices and other network zones, then restrict traffic to approved connections. A phishing email opened on an administrative workstation should not create an unrestricted route to an electronic health record system. Map system dependencies first, so segmentation protects critical services without interrupting authorised clinical workflows.

Facilities connecting to a health information exchange, such as Malaffi in Abu Dhabi or NABIDH in Dubai, should consider role-based access controls, mutual TLS and audit logging. Mutual TLS helps authenticate both ends of a connection. Role-based permissions limit which users or systems can access health information, while logs record that access. Together, these measures support controlled exchange rather than broad, untracked connectivity.

Access controls also depend on how healthcare providers manage identity across connected services. Use named accounts rather than shared credentials where possible, and promptly disable access that no longer serves a clinical or operational purpose. For a UAE clinic, a staff transfer should trigger a permissions review across the record system, email and connected clinical applications.

Phishing can undermine carefully configured permissions if a user’s account is compromised. Give staff a clear route to report suspicious messages and connect account-risk alerts with access-review procedures. Department of Health requirements are part of a wider operational picture: providers need controls that protect records while keeping authorised care moving. Review permissions, network pathways and access logs together, because a weakness in one can affect the others.

Abu Dhabi ADHICS cybersecurity requirements

ADHICS sets healthcare-specific information security requirements for Abu Dhabi facilities. The Department of Health introduced the standard to protect health information, systems and infrastructure. It applies to public and private healthcare facilities in the emirate. Unlike a national standard, ADHICS addresses Abu Dhabi’s healthcare environment and operational risks.

The framework organises cybersecurity requirements across different areas of healthcare security. Together, they guide how a facility manages security across governance, technology and clinical operations. Key areas include access management, data protection, risk management, incident response, vulnerability management, staff awareness, compliance governance and continuous monitoring. These areas connect policy with day-to-day controls. A facility can map each requirement to an accountable owner, supporting evidence and remediation action.

DoH published ADHICS v2.0 in May 2024, and the updated standard is now in force. Facilities should therefore treat it as an active compliance priority, not a future project. An initial gap assessment can identify unmet controls, assign remediation owners and organise evidence for review.

ADHICS compliance also supports integration with Malaffi, Abu Dhabi’s health information exchange. Facilities must meet the standard’s mandatory requirements as an initial step towards integration. For example, a clinic preparing to connect clinical systems can document access controls, incident procedures and monitoring evidence against relevant ADHICS requirements. This makes readiness work specific to the systems and workflows involved.

The programme should cover both documented processes and technical safeguards. Establish risk assessment and incident response procedures, then connect them to vulnerability management and continuous monitoring. Staff awareness training should address the risks employees encounter in their roles. External security assessments can test whether controls work in practice, while an annual internal review helps track gaps and programme changes.

For a facility starting without a formal ADHICS programme, the estimated path to full compliance is 6-12 months. The sequence usually involves assessing gaps, prioritising remediation, updating policies and preparing evidence. The time required depends on existing controls, operational complexity and the scope of remediation. A mid-sized hospital’s gap assessment typically takes 4-6 weeks, providing a defined basis for the wider work.

The Department of Health’s ADHICS requirements are tailored to healthcare entities’ maturity, complexity and risk environment. A hospital with connected clinical systems may need different remediation priorities from a smaller facility. Maintain a control register linking each requirement to its evidence, responsible owner and review status. This gives leaders a usable view of compliance progress and helps teams prepare for external assessment without separating cybersecurity from clinical operations.

Cybersecurity governance and resilience

UAE healthcare governance combines federal data rules with emirate-specific health requirements. A resilience programme should connect policies, accountable owners and technical safeguards to patient care.

UAE Healthcare Cybersecurity Governance

Governance assigns responsibility for protecting records, systems and connected devices. Senior leaders set risk priorities, while clinical and IT teams translate them into operating controls. The Department of Health developed ADHICS in collaboration with healthcare facilities, giving Abu Dhabi providers a sector-specific security standard. For practical oversight, link every identified threat to an owner, a control and evidence of review.

Cybersecurity Policies and Governance

Policies turn security expectations into repeatable decisions. A healthcare organisation should define who approves access, how teams report incidents and how recovery priorities protect essential services. ISO/IEC 27001 provides an international information security management standard; ISO/IEC 27799 addresses information security management for health informatics using ISO/IEC 27002. These standards can support governance, while local healthcare requirements remain relevant.

Emirate-Specific Cybersecurity Rules

Rules differ by regulator and location. Abu Dhabi healthcare facilities follow ADHICS, while Dubai healthcare providers operate under DHA oversight; federal facilities fall under MOHAP, and Dubai Healthcare City entities under DHCC. In Dubai, the DHA Policy for Health Data and Information Sharing (HISHD/PP-13) took effect on 10 November 2024. A provider operating across emirates should map each facility to its regulator and applicable requirements.

Feed the regulatory map into one governance register, rather than maintaining separate documents that may conflict. Record each facility’s regulator, applicable security standard, system owner and evidence location. For example, a group with facilities in Abu Dhabi and Dubai can maintain a shared risk view while tracking ADHICS and DHA-specific obligations separately. This helps leaders see where controls align and where local differences call for distinct action.

Resilience planning connects cybersecurity with clinical continuity. Identify which records and devices support critical care, then define recovery priorities and decision-making authority. The Department of Health describes ADHICS as supporting preparation for system failures, natural disasters and denial-of-service attacks. Exercise incident response against realistic disruption scenarios, document decisions and use the findings to update policies, recovery procedures and staff responsibilities.

Governance also needs a review cycle. Reassess risks after changes to clinical systems, cloud workloads or information-sharing arrangements. Track remediation through named owners and evidence, and escalate unresolved risks to leadership. This makes cybersecurity an ongoing management responsibility rather than a one-off policy approval.

OAD Technologies: Healthcare IT and Cybersecurity

OAD Technologies supports healthcare organisations seeking to strengthen patient-data protection, assess technical exposure or improve incident detection. Its Healthcare IT and Cybersecurity services can address priorities identified through an ADHICS gap review or broader security assessment.

Data Loss Prevention (DLP) helps address risks involving sensitive information. Vulnerability Assessment and Penetration Testing (VAPT) examines systems for security weaknesses, while Managed Detection and Response (MDR) supports threat detection and response, backed by sub-15-minute SOC response times. For email, the most common entry point for attacks on clinics and hospitals, OAD deploys and manages email security from its partners Mimecast and Trustifi to block phishing, impersonation and business email compromise before messages reach staff. Secure backup and disaster recovery help clinical systems recover quickly after ransomware or system failure. As an ISO 27001-certified provider, OAD applies the same information security discipline to its own operations. The right combination depends on your clinical systems, existing controls and operational priorities.

For example, an Abu Dhabi provider preparing to improve ADHICS readiness could prioritise a security assessment, then address the most relevant gaps. Contact OAD Technologies to discuss your healthcare cybersecurity requirements.

Build Security Into the Next Stage of Care

Make cybersecurity part of how clinical change is planned, approved and reviewed. As healthcare cybersecurity in the UAE evolves, organisations can connect protection decisions to patient-care priorities, system dependencies and clear ownership, rather than treating each new risk as an isolated project.

Choose a practical improvement that supports both security and clinical operations. Before introducing a new clinical application, for example, bring relevant teams together to consider its data flows, access needs, system connections and recovery requirements. This creates a repeatable decision point before technology becomes embedded in care delivery.

Use lessons from reviews, incidents and system changes to refine policies and priorities. A consistent cycle helps leadership understand where attention is needed and gives technical and clinical teams a shared direction. It also makes security part of responsible digital growth, rather than an obstacle to it.

OAD Technologies can discuss how its healthcare cybersecurity capabilities align with your organisation’s priorities and operating environment.

Clear ownership and a consistent improvement cycle help your organisation support safer, more resilient digital care.

Frequently Asked Questions

What cybersecurity standards apply to healthcare in the UAE?

Requirements depend on the facility’s regulator and location: Abu Dhabi healthcare facilities follow ADHICS, while Dubai providers must address DHA requirements. For an organisation with facilities in different emirates, maintain an applicability map for each site. Record the regulator, relevant systems, accountable owner and required evidence. This helps teams avoid assuming that one security standard or assessment automatically covers every facility.

What healthcare cybersecurity regulations apply in the UAE?

Healthcare organisations may need to account for the UAE PDPL, Federal Law No. 2 of 2019 and the healthcare requirements set by their emirate’s regulator. The practical question is how each applies to the organisation’s role, facilities and handling of health information. Build a register that links each obligation to the responsible team, affected process and supporting records, then review it when services or organisational arrangements change.

What are the UAE health data protection and data residency requirements?

Federal Law No. 2 of 2019 requires electronic health records to be localised in the UAE and restricts cross-border transfers without ministerial approval. For a useful residency review, include more than the primary record store: account for replicas, backups, support access and connected processing services. A data-flow diagram can show where information moves and which service owners need to assess each location and access path.

What cybersecurity standards and frameworks are required for UAE hospitals and clinics?

ADHICS is mandatory for Abu Dhabi healthcare facilities; requirements elsewhere depend on the responsible regulator. ISO/IEC 27001 and ISO/IEC 27799 can provide useful reference points for information security management, but don’t assume they replace local obligations. A practical way to organise implementation is to map each control to a policy, system owner and evidence item, then identify where one operational measure supports several requirements.

What are the most common cyber threats targeting healthcare providers in the UAE?

Threats include compromised credentials, insecure system configurations and unauthorised access through connected services. Consider a supplier account that retains permissions after a project ends: it can create exposure even without an attack on the patient-record system. Review external connections, account ownership and configuration changes alongside risks involving staff. This broader view helps healthcare teams assess how threats could affect clinical operations, not just data confidentiality.

What are the UAE requirements for reporting healthcare data breaches and cyber incidents?

For a qualifying personal-data breach, Article 9 of the UAE PDPL requires the controller to notify the UAE Data Office once aware; it sets no fixed number of hours. A practical response record should capture when the organisation became aware, who assessed the incident, what information may be affected and which decisions followed. Keep cyber incident escalation distinct from privacy notification, while coordinating the teams responsible for both.

What cybersecurity risks do UAE healthcare providers face from cloud systems, medical devices, and third-party vendors?

Risks often arise where environments connect: unclear ownership, excessive access, outdated configurations or limited visibility into supplier activity. For example, a connected diagnostic device may depend on both a vendor-managed service and the hospital network. Document the service owner, permitted access and operational dependencies for each connection. This makes it easier to assess changes and identify which teams need to act when a supplier or system changes.

What steps should a UAE healthcare organisation take after a ransomware attack or data breach?

Follow the organisation’s incident plan, prioritising patient safety and continuity of essential care. Coordinate clinical leaders with technical, privacy and management teams, and preserve relevant evidence while containing affected systems. Before restoring services, confirm that backups and recovered systems are usable and access is controlled. Afterwards, document decisions and lessons, then assign owners to corrective actions. These records can support follow-up reviews and improve readiness for future disruptions.