Compliance guide · Abu Dhabi, United Arab Emirates
ADHICS v2: a practical compliance guide for Abu Dhabi healthcare
ADHICS is the Department of Health - Abu Dhabi's information and cyber security standard for the health sector. This guide explains version 2's scope, control categories and timelines, and how to prepare. It does not reproduce the standard; use the official DoH document for the requirement text.
What it is and who must comply
Regulator and edition
ADHICS is issued by the Department of Health (DoH), the health sector regulator in the Emirate of Abu Dhabi. Version 2 (reference DOH/SD/ICSO/ADHICS/V2/2024) was published in May 2024 and became effective in August 2024. Its stated revision date is May 2027.
Who must comply
- Any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes or transmits health information, including healthcare facilities, payers, and healthcare technology and service providers.
- Healthcare professionals and support staff who have access to patient information.
Control categories
- Basic applies to every entity in scope. If a Basic control is not relevant to your operations, you must justify that to DoH with evidence.
- Transitional adds controls for hospitals with 1 to 20 beds and for centres (for example diagnostic, dialysis, IVF and rehabilitation centres).
- Advanced adds controls for hospitals with 21 or more beds, the health information exchange (Malaffi), insurers and third-party administrators.
- Service Provider is a separate category for external healthcare technology and service providers.
Each level includes the levels below it. The standard sets a compliance timeline of six months from programme on-boarding or the standard's official release, whichever comes first.
How it is structured
Section A covers governance, risk management and the statement of applicability. Section B sets the control requirements in eleven domains, identified by the codes HR, AM, PE, AC, CO, DP, CS, TP, SA, IM and SC. Entities submit periodic compliance status to DoH, including a roadmap and any deviations.
How to comply
- Identify your entity type and category: Basic, Basic + Transitional, Basic + Transitional + Advanced, or Service Provider.
- Obtain ADHICS v2 from DoH.
- Set up governance as Section A describes: roles, a risk assessment, and a statement of applicability that justifies any exclusion.
- Assess every control in your category across the eleven domains.
- Build a roadmap with owners and dates, inside the six-month timeline.
- Collect evidence per control with expiry dates.
- Report compliance status to DoH periodically, including roadmap timelines and deviations.
- Check Malaffi requirements if you connect to the Abu Dhabi health information exchange.
Evidence checklist
- Information security governance structure and assigned roles
- Risk assessment, risk treatment plan and statement of applicability
- Policies for each domain, approved and reviewed
- HR security records and awareness training completion
- Asset inventory, including medical devices
- Access control records and periodic access reviews
- Operations and communications records: logging, monitoring, change, backup
- Data privacy and protection records
- Cloud and third-party security assessments and contracts
- Incident management and continuity test records
- Compliance status reports submitted to DoH
How it maps to ISO/IEC 27001:2022
Domain-level only. This table is Pravitrust's interpretation for planning evidence reuse; it is not a mapping published by the regulator or by ISO.
| ADHICS v2 | ISO/IEC 27001:2022 |
|---|---|
| Section A: governance, risk, statement of applicability | Clauses 4-10 (ISMS), including 6.1.3 statement of applicability |
| HR human resources | A.6 people controls |
| AM asset management, AC access control | A.5.9 to A.5.18, A.8.2 to A.8.5 |
| PE physical and environmental | A.7 physical controls |
| CO communications and operations, SA acquisition and development | A.8 technological controls |
| DP data privacy and protection | A.5.33, A.5.34, A.8.10 to A.8.12 |
| CS cloud, TP third party | A.5.19 to A.5.23 |
| IM incident management, SC continuity | A.5.24 to A.5.30 |
How to choose software for ADHICS v2
These criteria are neutral: they apply to any tool you evaluate, including Pravitrust.
- Regulator mapping you can trace. The tool should hold the framework's own identifiers and structure, and show which version it carries. Ask how it is updated when the regulator issues a revision.
- Licence-known content. Ask where the control content came from and on what terms. A vendor that cannot answer has a problem you will inherit.
- Evidence reuse. One piece of evidence should be attachable to every control it supports, across frameworks, without uploading it twice.
- Arabic support. Check the user interface, reports and exports separately; support in one does not imply the others.
- Hosting location. Ask where data and backups are stored, and match that against your own data-residency obligations and any sector rules.
- Honest status. A control with no test or evidence should never display as compliant.
- Exit. Confirm you can export everything, including history, in an open format.
- Category scoping. The tool should let you adopt only the categories that apply to your entity type, Basic, Transitional, Advanced or Service Provider, and add a category later without losing history.
Where Pravitrust stands today
- Adopt a framework pack into your control library at the scope that applies to you, with the pack version recorded so later assessments stay tied to the revision you assessed against.
- Attach evidence to each control, with an expiry date and reminders when evidence goes stale.
- Show a control with no test result as untested, never as healthy.
- Keep an append-only, hash-chained audit trail of changes.
- Export registers to CSV or Excel.
Moving from ServiceNow or Archer
Pravitrust does not import data from ServiceNow, Archer or any other GRC platform today. An import and migration feature is in design and is not available yet; this page will say so when it ships.
What you can do today:
- Export your current register from the existing tool so you hold a complete copy, including history, before you change anything.
- Adopt the framework pack in Pravitrust at your scope.
- Record control status and attach evidence against each control. Evidence you already hold for ISO/IEC 27001 can be attached to the controls it supports.
- Run both systems in parallel until your next assessment cycle closes, then retire the old one.
Frequently asked questions
Who must comply with ADHICS?
Any entity in the Emirate of Abu Dhabi that generates, accesses, stores, uses, processes or transmits health information, including healthcare facilities, payers, and healthcare technology and service providers.
When did ADHICS v2 take effect?
It was published in May 2024 and became effective in August 2024.
Which controls apply to a small clinic?
Basic controls apply to every in-scope entity. Transitional and Advanced add controls for specific entity types, such as hospitals and centres, as set out in the standard.
What is the compliance timeline?
Six months from programme on-boarding or the standard's official release, whichever comes first.
What if a Basic control does not apply to us?
You must provide a valid business justification to DoH, with supporting evidence.
Do technology vendors need to comply?
Yes. External healthcare technology and service providers that handle health information follow the Service Provider category.
How does ADHICS relate to ISO/IEC 27001?
Its governance section follows a management-system approach similar to ISO/IEC 27001, and its domains cover much of Annex A. ISO evidence is often reusable, but DoH assesses against ADHICS.