Abu Dhabi Healthcare Information and Cyber Security Standard
We support your ADHICS review with roles, permissions, two-factor sign-in and audit records, while UAE hosting provides a confirmed starting point for deployment review.
Set by Department of Health, Abu Dhabi
Subject type: security standard set by the Department of Health, Abu Dhabi. This page gives the external context and the product controls a reviewer can inspect. It is not a certification claim.
What is built
- Roles and permissions control access within the selected product scope.
- Two-factor sign-in is available for the supported product workflows.
- Audit records capture read and write activity for review.
- Flow policy workflows retain named preparation, review and approval signatures.
- UAE hosting is the starting position for UAE deployments. The region, provider and specifications are agreed for each deployment.
Who is responsible for what
NextHealth builds and supports the application controls listed above. Your facility owns its policies, risk assessment, access reviews, staff procedures and the assessment itself. Roles and sign-in are configured during implementation and reviewed by your accountable people.
Illustrative example: reviewing who opened a chart
This example uses synthetic data. A reviewer asks who opened the chart of a synthetic patient last week. Care’s chart-access record shows the person, the page, when it was opened, whether the person was in the care team and whether a clinical access grant was used. The record shows the activity. Whether the access was appropriate is a judgement for your facility.
Version and scope
DoH currently presents ADHICS V2 through its AAMEN programme. Identify the version and the scope of your assessment before mapping any evidence. This page does not claim a complete clause-by-clause mapping, certification, immutable audit storage or automatic fulfilment of any control. Policy templates also need professional review before use.
Security documentation
Encryption standards, backup arrangements, recovery targets, security testing and enterprise identity specifications are not set out on this page. Ask our team for the security documentation for your deployment, and see Security and privacy for the controls this site confirms. Flow’s clinical incident workflow is not a managed cybersecurity response service.
Official source
Department of Health, Abu Dhabi. Use the current ADHICS publication from the Department of Health for the requirements themselves.
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
No ADHICS certificate or complete control assessment is claimed. The page identifies confirmed controls and records that support your facility’s review, alongside technical and organisational evidence that still needs confirmation.
-
DoH’s AAMEN page currently presents ADHICS V2. Confirm the applicable assessment scope with your responsible team; this content does not claim that every V2 control has been mapped or independently assessed.
-
Not on this page. Request the deployment’s encryption, backup and recovery specifications before relying on them in your assessment; the access-control evidence does not answer those separate questions.
-
A managed cybersecurity response service is not established. Flow’s clinical and facility incident records serve a different purpose, so security monitoring, escalation and notification arrangements require separate confirmation.
-
NextHealth supports the application controls. Your facility decides who holds which role, how often access is reviewed and what evidence it keeps, and records those decisions in its own procedures.
Not answered here? Contact the team
NXH Flow