NABIDH Cybersecurity Requirements for Dubai Healthcare Facilities

For healthcare facilities operating under NABIDH, compliance is an operational requirement, not an optional integration project. Under Dubai Health Data Law No. 11 of 2018, regulated facilities are required to integrate with the platform. Meeting the nabidh cybersecurity requirements helps protect patient information as it is accessed and shared across connected healthcare providers throughout the region.

That responsibility goes beyond connecting a health information system. Teams also need to manage user access, secure data exchanges, assess risk, and retain evidence that controls are working. If you are translating these standards into day-to-day practice, this guide explains what NABIDH cybersecurity requirements mean for your healthcare facility. It covers core security controls, system connections, encryption, monitoring, staff training, and audit readiness, with practical steps for building a manageable security programme supported by OAD Technologies.

Benefits of Implementing NABIDH?

NABIDH connects Dubai healthcare providers through a health information exchange. It supports secure access to a unified patient record and the exchange of medical information across healthcare settings. By the end of June 2025, the network held 10.41 million medical records and connected 1,888 healthcare facilities. For a hospital, that connected view can help clinical teams understand a patient’s history across providers.

Information security governance calls for documented policies, clear accountability and risk-based controls. NABIDH facilities are expected to plan periodic information security risk assessments and define acceptable-risk criteria. Authentication and authorisation standards must also align with applicable laws, DHA regulations and the DHA Health Information Security Standard. These measures help teams assess risks to health information before integration and record how they address identified gaps.

A Dubai provider can demonstrate compliance through a structured assessment, evidence collection and self-assessment audit. Review each system connection, its data flows, user access and security controls, then record findings, owners and remediation actions. A practical example: a Dubai hospital connecting an electronic medical record system can map how patient data moves, assess access permissions and retain evidence of control reviews. Healthcare cybersecurity services support facilities addressing these security needs.

Integration reviews can identify weaknesses before they disrupt clinical workflows. Assess the EMR’s ability to exchange health information securely, the interfaces between systems and the processes for managing change. When selecting an EMR, compare candidate systems with the facility’s interoperability and security needs. Record the assessment rationale, identified risks and decisions: connectivity alone does not demonstrate compliance.

Use a repeatable self-assessment process to turn requirements into evidence:

• Identify relevant laws, DHA requirements and internal policies.
• Inventory systems, integrations and information assets in scope.
• Assess each control, record evidence and document any gap.
• Assign remediation owners and track actions to closure.
• Retain assessment records for audit review and future reassessment.

These steps make audit preparation more practical by linking each requirement to a control, evidence and accountable owner. They also help leadership prioritise remediation according to risk, rather than relying on assumptions about system security.

Failure to meet NABIDH requirements can lead to penalties, including suspension of DHA licence renewal. A documented risk assessment and compliance review can help a facility identify shortcomings early and show how it is addressing them.

Cybersecurity controls and risk treatment

NABIDH security controls cover governance, risk assessment, identity, access and incident handling. Facilities must maintain authentication and authorisation standards aligned with applicable laws, DHA regulations and the DHA Health Information Security Standard. A periodic risk assessment plan should define acceptable-risk criteria and record how the facility addresses each finding.

For a healthcare provider in Dubai, DHA requirements apply to systems that access or exchange health data. Controls should link each risk to an owner, a treatment decision and supporting evidence. For example, an assessment might identify excessive access to patient records, leading to a review of role permissions and a documented outcome.

Access procedures should document rules for permissions, clear desks and screens, and password management. Authenticate users before granting access, and base authorisation on their job function and information needs. NABIDH users must be authenticated against an identity access management system. Remove access promptly when an employee or contractor leaves the organisation.

Apply these operational controls to the platform and its users:

• Set HIE Node user sessions to log off automatically after no more than 15 minutes of inactivity.
• Use secure authentication for individual remote access.
• Require node authentication for HIE Nodes exchanging Personal Health Information, following standards referenced in Section 8.
• Log system access, including access connected with supplier relationships.
• Allow emergency break-glass access only with auditing, review and required notifications.

Document backup and recovery procedures. Define how teams protect essential records, restore systems and maintain clinical operations during disruption. Test the documented recovery process against likely system failures, then record the results and corrective actions. This connects backup arrangements with business continuity, rather than treating them as separate tasks.

Cloud services and third-party arrangements need clear oversight of access, data handling and supplier activity. Federal Law No. 2 of 2019 requires electronic health records to be stored in the UAE and restricts cross-border transfers without ministerial approval. Map where each service stores and processes health data, and document supplier access and system-access audit trails.

Monitoring and incident response complete the control cycle. Require users to report security events, investigate incidents and retain records of decisions. If a suspected breach, virus attack or incident threatens a node, NABIDH may turn off access to that node to limit further damage. A Dubai hospital can prepare by defining who escalates the event and how teams preserve relevant evidence.

For tailored support with healthcare security controls, discuss your requirements with the security team.

Encryption in transit and at rest

NABIDH security procedures call for appropriate encryption when healthcare providers exchange health information, as well as encryption for data at rest. This protects medical records in two distinct states: while moving between systems and while stored on servers or other storage. Map both states before selecting controls, including every interface used by the electronic health record system.

For information in transit, NABIDH technical standards specify SSL/TLS encryption, and TLS 1.2 is identified for protecting patient information during transfer. Apply encrypted connections to system interfaces, user sessions and data exchanges with authorised vendors. For example, a clinic sending a laboratory result to its electronic health system should protect the connection, not rely on network separation alone.

At rest, the stated NABIDH approach uses AES-256 encryption to protect data. Apply the control to health information stored in databases, file repositories and backups. The encryption design should account for where copies are held, including replicated or archived records. A storage inventory helps a facility identify locations that might otherwise sit outside the main electronic health platform.

Encryption is part of a broader set of controls, not a substitute for access management. A user with authorised access to a record through an application may still see its contents. Healthcare providers should therefore combine encryption with role-based permissions, secure authentication and access logging. This links data protection to identity and monitoring controls across the security programme.

Use a repeatable review to implement and maintain encryption:

• Map data flows between clinical systems, vendors and NABIDH connections.
• Mark which records move across a network and which remain in storage.
• Apply SSL/TLS to protected transfers and AES-256 to stored health data.
• Review certificates and encryption settings when interfaces or vendors change.
• Record exceptions, remediation owners and evidence for assessment reviews.

Key management needs its own control process. Restrict access to encryption keys, separate key administration from routine database access, and document how teams manage key rotation and recovery. These measures reduce the risk that a compromised account could expose both encrypted records and the means to decrypt them. Include key access in monitoring and review it alongside system permissions.

A practical test for a UAE facility is to trace a patient record through its journey. Follow it from a clinical workstation to the electronic health system, through any vendor interface and into stored backups. Confirm encryption at each transfer and storage point, then retain configuration evidence. This creates a clear record of how the facility protects medical information for the authority and auditors.

When system changes introduce a new connection or storage location, reassess the encryption design before go-live. This helps maintain consistent protection as healthcare systems and clinical workflows evolve.

Ongoing monitoring, training, and audit readiness

NABIDH security depends on controls that remain active after implementation. Healthcare facilities need monitoring that shows how users, systems and third parties access health records. DHA access reviews cover applications, infrastructure, data centres and third parties. To reinforce physical security across data centres and clinical premises, smart access-control and surveillance solutions from Digital-Vision.AI can help monitor and restrict on-site entry. Use each review to identify changed permissions, unused accounts and access that no longer matches a person’s role.

Build a review cycle that leaves a clear record. Identify the systems and owners in scope, examine access lists, then document findings and corrective actions. For example, when a staff member changes departments, compare their electronic health records permissions with their new duties. Record who approved the change and when the review was completed. These records demonstrate active oversight of access decisions.

Give training a defined schedule. Healthcare facilities must provide authorised NABIDH users with refresher training annually. Cover safe handling of patient data, account security, incident reporting and appropriate use of clinical systems. Keep attendance records and training materials together so auditors can see who received the instruction and which topics it covered.

Monitoring should link technical alerts to clear response ownership. Decide who reviews security events, how staff escalate concerns and where investigation records are stored. A useful operational record captures the event, its impact on health information, actions taken and any follow-up. This creates a traceable path from detection to resolution, without relying on informal messages or individual memory.

Prepare audit evidence through routine operations, rather than assembling it at the last moment. Keep current access-review results, training records, policies, risk decisions and remediation evidence. Organise each item by control or requirement, with an owner and review date. This makes it easier to demonstrate how the facility applies standards across systems and teams.

• Maintain an inventory of applications and data owners.
• Record access review scope, findings, approvals and corrective actions.
• Keep annual refresher-training attendance and course materials.
• Retain monitoring records with investigation outcomes and follow-up actions.
• Link each audit item to its responsible owner and supporting evidence.

For a practical UAE example, a Dubai clinic can review access to its electronic health records after staff role changes. The clinic can preserve the review record, approval and resulting permission updates as audit evidence. Repeating this process across applications, infrastructure, data centres and third parties helps make oversight consistent.

Use review findings to improve the next cycle. If an audit identifies incomplete records or delayed access updates, assign an owner and track corrective action through to completion. This makes audit readiness a continuous discipline and keeps monitoring and training connected to patient data protection.

What is NABIDH and which healthcare entities in Dubai must comply?

NABIDH is the Dubai Health Authority’s health information exchange platform. It supports secure sharing of patient information across public and private healthcare providers. The platform can give clinical teams a broader view of medical history, helping inform care decisions with records from different providers. Its purpose is connected care, not simply storing information in one facility’s system.

Dubai Health Data Law No. 11 of 2018 requires healthcare facilities operating in Dubai to integrate with NABIDH. The requirement covers public and private facilities within Dubai’s healthcare network. A hospital, clinic or other healthcare facility should therefore assess how its electronic records and information systems connect to the exchange. The applicable obligations depend on the facility’s role and systems, but location in Dubai is central to the scope.

NABIDH operates in a wider UAE legal setting. Federal Law No. 2 of 2019 concerns the use of information and communications technology in health fields. Cabinet Decision No. 32 of 2020 is also part of the rules followed by NABIDH in Dubai. Together, these requirements make integration a governance and security responsibility, not only an IT implementation task.

For a Dubai provider, the practical starting point is to identify its regulated facility, systems and information flows. Map where patient records originate, which applications use them, and how authorised staff access them. Then assign owners for integration, privacy and security decisions. This gives leadership a clear view of responsibilities before connection changes affect clinical operations.

For example, a private clinic in Dubai that uses an electronic medical record system should assess how it exchanges patient information with NABIDH. The clinic can document the system owner, the data exchanged, access roles and review evidence. A public hospital can apply the same mapping across its departments and connected applications, making responsibilities visible across operational teams.

The nabidh cybersecurity requirements also sit alongside other duties that apply to health information. Federal Law No. 2 of 2019 requires electronic health records to be stored in the UAE and restricts cross-border transfers without ministerial approval. Facilities should include hosting locations and data flows in their compliance assessment, rather than treating NABIDH connectivity as the full compliance picture.

Use this scope check to organise the initial review:

• Confirm the facility operates within Dubai’s healthcare network.
• List the electronic systems that create, store or exchange patient records.
• Identify the teams accountable for integration, security and governance.
• Record applicable Dubai and federal requirements alongside evidence.

A clear scope helps a facility plan integration work and maintain consistent oversight as systems change. It also gives executives and technical teams a shared view of their responsibilities.

OAD Technologies: Data Loss Prevention (DLP)

OAD Technologies helps healthcare facilities strengthen protection for sensitive patient information through Data Loss Prevention (DLP). DLP can support controls to reduce the risk of health data being shared or used outside approved processes. It complements a broader NABIDH security programme that includes access management, monitoring and staff procedures.

Consider DLP when a facility needs clearer oversight of how sensitive information moves across its systems. OAD Technologies also provides Vulnerability Assessment and Penetration Testing (VAPT), Managed Detection and Response (MDR), and Security Information and Event Management (SIEM). These services address distinct needs, from identifying weaknesses to monitoring security events, and can be considered in line with the facility’s priorities.

To discuss your healthcare security priorities with OAD Technologies, discuss your requirements.

Build the next step into your security programme

Dubai healthcare facilities can treat NABIDH cybersecurity requirements as an ongoing part of operational planning, not a one-off technical milestone. As systems, suppliers and clinical workflows change, revisit how security responsibilities, evidence and remediation decisions fit together. A clear roadmap helps teams direct effort towards the risks that matter most to patient care and service continuity.

OAD Technologies provides Data Loss Prevention (DLP), Vulnerability Assessment and Penetration Testing (VAPT), and Managed Detection and Response (MDR). These services address different needs: protecting sensitive information, identifying technical weaknesses and supporting detection and response. The right starting point depends on the facility’s priorities and the gaps identified through assessment.

Use the next planning cycle to turn findings into owned actions, with progress visible to technical teams and leadership. This connects security work to healthcare operations and upcoming system changes.

Thoughtful, ongoing preparation can help your facility strengthen its security posture as care and technology evolve.

Frequently Asked Questions

Why you Should be NABIDH Compliant?

Dubai healthcare facilities must integrate with NABIDH under Dubai Health Data Law No. 11 of 2018. Compliance supports secure sharing of patient information and gives authorised care teams a broader record to inform treatment. It also helps facilities organise their legal duties and security evidence. For example, a clinic can use connected records to give a treating provider relevant history, rather than relying solely on information patients bring themselves.

Is NABIDH DHA Secure?

NABIDH defines security controls, but security also depends on each connected facility’s systems and practices. Requirements include authentication, role-based authorisation, node authentication and encryption for health information exchanges. Facilities remain responsible for managing access and safeguarding their own environments. Assess both the exchange connection and the systems, accounts and suppliers that can access records.

What are NABIDH requirements for access control, authentication, and user accounts?

NABIDH access controls verify a user’s identity, role and affiliation at logon, and deny access if any is revoked or expired. Authorisation should reflect job function and the information needed for that role. Facilities must authenticate users before granting data access and terminate registered employees’ or contractors’ privileges when employment ends. Emergency break-glass access requires auditing, review and notification of relevant parties.

What are NABIDH requirements for encryption, data protection, and patient privacy?

NABIDH procedures call for appropriate encryption during health information exchange and encryption for stored data. Technical standards identify SSL/TLS for data in transit, TLS 1.2 for transfer protection and AES-256 for data protection. Facilities should also assess who can view patient records and where health data is stored. Federal Law No. 2 of 2019 requires electronic health records to remain in the UAE, subject to its stated exceptions.

What are NABIDH requirements for cybersecurity monitoring, logging, and incident reporting?

Facilities should retain system-access audit trails, require users to report security events and investigate incidents. Monitoring should help teams link an alert to affected systems, records and response actions. For example, a provider can preserve access records while investigating an unusual account event, then document findings and follow-up. NABIDH may disable access to a node after a suspected breach, virus attack or incident to limit further damage.

What are NABIDH requirements for vulnerability assessments and penetration testing?

NABIDH facilities are expected to plan periodic information security risk assessments and define acceptable-risk criteria. Vulnerability assessment and penetration testing can help identify technical weaknesses in systems and integrations, but the requirements do not establish a universal VAPT schedule. Facilities can use risk findings, system changes and exposed connections to set assessment scope, then document issues, treatment decisions and remediation evidence for governance and audit purposes. For identifying security flaws across internet-facing portals and APIs, services like webscan.readysecure.app provide automated scanning to support ongoing risk management.