ADHICS V2 is the Abu Dhabi Healthcare Information and Cyber Security Standard issued by the Department of Health (DoH), published in May 2024 and effective from August 2024. It applies to healthcare facilities, payers and technology providers that handle health information in the emirate, with controls in 11 domains at three maturity levels plus a service provider category.
This guide is for information security managers, CISOs, IT leads and compliance officers in Abu Dhabi healthcare entities and their suppliers.
What is ADHICS V2 and who must comply?
ADHICS V2 carries the DoH reference DOH/SD/ICSO/ADHICS/V2/2024. It replaced three earlier DoH documents: ADHICS V0.9 of 2019, the Internet of Medical Things (IoMT) Security Standard V0.9 of 2020 and the Standard on Patient Healthcare Data Privacy V0.9 of 2020. Privacy and medical device security are now inside one standard.
The scope is broad. It covers healthcare facilities, payers and healthcare technology and service providers in Abu Dhabi. It also covers every professional or support staff member with access to patient information, and the systems an entity uses on shared platforms such as Malaffi, the emirate's health information exchange.
DoH runs ADHICS through its AAMEN programme, which groups its information security standards, audits and compliance monitoring. The standard, the implementation guideline, forms and an FAQ are on the DoH AAMEN page. The DoH FAQ says even a small clinic with one doctor must comply with the controls for its category. The current AAMEN applicability matrix (V3, February 2023) lists facility types by name, and marks a few as out of scope, such as first aid posts, school clinics and traditional and complementary medicine practitioners.
Which control category applies to your facility?
ADHICS V2 sorts controls into categories by entity type and risk. Each higher level includes everything below it.
- Basic: the minimum for every in-scope entity. Where a Basic control is not relevant, the entity reports a business justification to DoH with evidence.
- Transitional: Basic plus Transitional, for hospitals with 1 to 20 beds and for centres such as diagnostic, dialysis, IVF and rehabilitation centres.
- Advanced: all three levels, for hospitals with 21 beds or more, the Malaffi health information exchange, insurers and third-party administrators.
- Service Provider: a separate set for external suppliers of healthcare technology, such as medical device, electronic medical record and web or mobile app providers.
The standard set a compliance timeline of six months from onboarding to the programme or from the standard's release, whichever came first. Entities must also keep a roadmap to full compliance and submit their updated compliance status to DoH as part of periodic reporting.
What does ADHICS V2 cover?
The ADHICS V2 standard has two sections. Section A sets the governance and framework: the governance structure, the information security policy, document control, risk management, the Statement of Applicability and information classification. Section B holds the control requirements in 11 domains:
- Human resources security, asset management, physical and environmental security, and access control.
- Communications and operations management, data privacy and protection, and cloud security.
- Third party security, and information systems acquisition, development and maintenance.
- Information security incident management, and information systems continuity management.
Many controls carry a reference to the UAE Information Assurance Regulation, so an entity already working to that regulation will recognise much of the content. The DoH implementation guideline, also V2 of May 2024, explains how to apply each control.
How is ADHICS different from ISO/IEC 27001?
ADHICS and ISO/IEC 27001:2022 share a risk-based logic, so an existing ISMS is a useful start. The differences decide whether that ISMS is enough. The comparison below is AGS's reading of both documents, not DoH wording. Our ISO/IEC 27001:2022 guide covers the ISO side.
| Topic | ISO/IEC 27001:2022 | ADHICS V2 |
|---|---|---|
| Who sets it | ISO and IEC, voluntary | DoH Abu Dhabi, mandatory for in-scope entities |
| How compliance is shown | Certification by an accredited certification body | DoH compliance reporting, audits and licensing under AAMEN |
| Control selection | Chosen from Annex A by risk assessment | Fixed categories by entity type, plus risk-based controls justified in the Statement of Applicability |
| Governance | Top management roles, no set committee | Governance Committee, HIIP Workgroup and a CISO or equivalent |
| Classification | Scheme chosen by the organisation | Public, Restricted, Confidential and Secret, or a mapped equivalent |
| Healthcare content | None specific | Medical devices, patient data privacy, health data exchange |
The practical gap is evidence. An ISO toolkit will not give you the committee structure, the classification levels or the DoH reporting that ADHICS asks for. Those need writing to the standard itself.
What evidence will a DoH assessment look for?
An assessor reads records, not intentions. These are the items ADHICS V2 Section A asks for most directly, in AGS's practical summary:
- Information Security Governance Committee minutes and action plans. The committee needs a 60% quorum to meet.
- A risk assessment that rates confidentiality, integrity and availability from 1 to 5 for each in-scope asset, with owners and target dates for treatment.
- A Statement of Applicability listing the controls selected, why, their status, and the reasons for any exclusion.
- An asset inventory with each asset classified and labelled.
- A controlled document procedure covering review, approval, versions and obsolete documents.
- An annual audit programme, with independent audits at least once a year or after a significant change.
- Compliance status reports to DoH, and business justifications for any Basic control marked not relevant.
DoH says ADHICS compliance is part of its audit process and of facility licence registration and renewal. The same FAQ says Malaffi requires a minimum set of ADHICS controls before an entity can connect. For the wider DoH licensing picture, see our guide to DoH hospital standards or the healthcare collection.
How AGS can help
The Healthcare Information and Cyber Security Management System (ADHICS) contains 43 editable Microsoft Word documents. It includes a security manual, policy and scheme, and 13 procedures from risk assessment to incident and continuity management. It also has 16 forms and registers, such as the risk register and asset inventory, and 7 checklists, including an ADHICS self-assessment summary.
Frequently asked questions
What does ADHICS stand for?
Abu Dhabi Healthcare Information and Cyber Security Standard. DoH also writes it as ADHICS V2 for the 2024 version.
Can health data be stored in a cloud outside the UAE?
DoH's ADHICS FAQ says no for health information related to services provided in the UAE, citing Federal Law No. 2 of 2019 on the use of ICT in healthcare. Cloud controls sit in the standard's cloud security domain.
Does ADHICS apply to facilities in Dubai?
ADHICS is issued by DoH for the Emirate of Abu Dhabi. A facility that handles health information only outside Abu Dhabi should check the rules of its own regulator.
When will ADHICS V2 be revised?
The standard sets a three-year revision period, with May 2027 as its revision date. Check the DoH AAMEN page for any later version.
AGS provides independent documentation toolkits. This guide and the referenced kit are prepared to support DoH Abu Dhabi ADHICS requirements. They are not affiliated with, endorsed by or approved by the Department of Health, and they do not guarantee any assessment, audit or licensing outcome.
Reviewed October 2026. Facts checked against the sources current at publication.
