What is ADHICS? — Abu Dhabi Healthcare Information and Cyber Security Standard
Direct Definition
ADHICS (Abu Dhabi Healthcare Information and Cyber Security Standard) is a mandatory cybersecurity compliance framework enacted by the Department of Health - Abu Dhabi. It mandates stringent cybersecurity governance, risk management, data protection, and incident response controls across all healthcare providers and technology vendors. ADHICS establishes a comprehensive regulatory framework protecting sensitive health information against unauthorized access, ransomware, and cyber threats. In an increasingly interconnected digital health ecosystem, adherence to ADHICS cybersecurity controls safeguards patient privacy, guarantees clinical system availability, and reinforces institutional resilience across healthcare networks.
Statutory Authority & Legal Framework
Department of Health Abu Dhabi Policy on Information and Cyber Security in the Healthcare Sector.
Technical Architecture & Data Standards
Zero-trust network architecture, AES-256 encryption at rest, TLS 1.3 encryption in transit, automated SIEM event forwarding, and strict role-based access control (RBAC) with multi-factor authentication.
Who Must Comply
- Public and private hospitals, clinics, and medical rehabilitation facilities in Abu Dhabi
- Health tech software vendors, cloud service providers, and medical device integrators
- Third-party healthcare administrators, medical claims clearinghouses, and diagnostic labs
Key Regulatory Requirements
- Comprehensive implementation of Tier 1 and Tier 2 technical and administrative security controls
- Mandatory multi-factor authentication (MFA) and granular role-based permissions for health record access
- Continuous vulnerability scanning, third-party penetration testing, and breach reporting within regulatory timeframes
Enterprise Software & Integration Requirements
- Demands native support for enterprise identity federation, SAML 2.0 / OIDC, and immutable audit logging
- Requires architectural validation ensuring no unencrypted electronic protected health information (ePHI) in transit or rest
- Mandates infrastructure hosting exclusively within approved UAE-based sovereign cloud availability zones