ADHICS vs HIPAA: Which Do You Need?
ADHICS is the Abu Dhabi Department of Health’s mandatory security standard — a licensure condition for every DoH-licensed healthcare facility and HIMS vendor. HIPAA is a US federal law covering Protected Health Information for Covered Entities and their Business Associates. They apply in different jurisdictions. Abu Dhabi facilities with US affiliates or US-based telehealth typically need both.
ADHICS and HIPAA both protect health data, but the trigger, scope and audit regime differ sharply. If you operate in Abu Dhabi you comply with ADHICS whether or not you ever touch a US patient. If you touch US patient data you comply with HIPAA regardless of where your clinic sits.
Quick comparison
| Factor | ADHICS | HIPAA |
|---|---|---|
| Type | Mandatory standard (licensure condition) | Federal law (mandatory) |
| Issuer | Department of Health, Abu Dhabi | US Department of Health & Human Services |
| Jurisdiction | Abu Dhabi | United States |
| Who it applies to | DoH-licensed healthcare facilities and HIMS vendors | Covered Entities and Business Associates handling PHI |
| Structure | 12 control families, 3 tiers (Basic / Transitional / Advanced) | 18 safeguards across 3 categories (Admin / Physical / Technical) |
| Audit | Technical Review Board Audit (TRBA) | No official certification — HHS enforcement |
| Reporting cadence | Quarterly compliance report to DoH | Annual risk assessment; breach notification per Breach Notification Rule |
| Penalties | Licensure risk, remediation orders, operational restrictions | $100 – $2M+ per violation; criminal penalties for wilful misuse |
| Timeline to ready | 30 days with LowerPlane | 30 days with LowerPlane |
Understanding the key differences
ADHICS: licensure in Abu Dhabi
ADHICS V2 is published by the Department of Health in Abu Dhabi. Compliance is a condition of DoH licensure for every healthcare provider operating in the emirate — clinics, dental practices, pharmacies, diagnostic labs, hospitals — and for the HIMS vendors they rely on. The standard also governs connection to the Malaffi health information exchange.
The three ADHICS tiers
- • Basic: clinics, dental practices, pharmacies, standalone diagnostic labs
- • Transitional: multi-site providers and specialty centres
- • Advanced: hospitals and complex providers (CISO required)
HIPAA: protecting US patient data
HIPAA (Health Insurance Portability and Accountability Act) is a US federal law. It applies to Covered Entities (healthcare providers, health plans, clearinghouses) and Business Associates handling Protected Health Information. HIPAA has no certification — compliance is proven through risk assessments, documented safeguards and signed Business Associate Agreements.
HIPAA safeguard categories
- • Administrative Safeguards: policies, procedures, workforce training
- • Physical Safeguards: facility access, workstation security, device controls
- • Technical Safeguards: access controls, encryption, audit logs
You need ADHICS if…
- ✓ You operate a DoH-licensed facility in Abu Dhabi
- ✓ You are a HIMS vendor serving Abu Dhabi healthcare providers
- ✓ Your systems connect to Malaffi
- ✓ You are preparing for licensure renewal or expansion in Abu Dhabi
- ✓ Your TRBA audit cycle is approaching
You need HIPAA if…
- ✓ You are a Covered Entity (US healthcare provider, health plan, clearinghouse)
- ✓ You are a Business Associate handling PHI for Covered Entities
- ✓ Your product stores, processes or transmits US patient data
- ✓ You integrate with US EHRs or healthcare systems
- ✓ You provide services to US healthcare organisations
You need BOTH if…
- ✓ You are an Abu Dhabi facility with a US affiliate (clinical research, telehealth, parent company)
- ✓ Your HIMS platform serves both Abu Dhabi and US buyers
- ✓ You run cross-border clinical studies or data flows
- ✓ You handle PHI from US patients visiting or referred to Abu Dhabi
- ✓ You are a HIMS vendor expanding from the UAE into the US market
Control overlap: ~70%
ADHICS and HIPAA overlap heavily on the technical and administrative controls. The ADHICS 12-family model and the HIPAA 3-safeguard model use different vocabulary but ask for very similar things.
Overlapping requirements
- • Access control and MFA on PHI/ePHI systems
- • Encryption at rest and in transit
- • Audit logging and monitoring
- • Incident response procedures
- • Workforce security training on hire and annually
- • Vendor / BAA / HIMS supplier oversight
- • Backup, disaster recovery and continuity testing
Key differences
- • ADHICS requires a per-facility SoA
- • ADHICS requires quarterly DoH compliance reports
- • ADHICS adds Malaffi connection controls
- • HIPAA requires signed Business Associate Agreements
- • HIPAA has a 60-day Breach Notification Rule
- • HIPAA enforcement is monetary and criminal; ADHICS risk is licensure
- • ADHICS is certified by TRBA; HIPAA has no certification
Timeline comparison
ADHICS timeline
- Tier scoping: 1 week
- Policy + control rollout: 2–3 weeks
- TRBA audit prep + first quarterly report: 1 week
- With LowerPlane: 30 days
HIPAA timeline
- Risk assessment: 2–4 weeks
- Implementation: 2–6 months typical
- BAA rollout: ongoing
- With LowerPlane: 30 days
Running both together
For HIMS vendors and clinical groups bridging Abu Dhabi and the US, running ADHICS and HIPAA together is the smartest path. One evidence pack feeds both — the differences live in jurisdictional artefacts (BAAs for HIPAA, SoA + quarterly reports for ADHICS).
Common questions
Does HIPAA satisfy ADHICS?
No. HIPAA covers a lot of the same technical and administrative controls but does not satisfy ADHICS-specific requirements — per-facility SoA, quarterly DoH reports, TRBA audit, Malaffi connection controls. DoH requires ADHICS-specific artefacts even if you also comply with HIPAA.
Does ADHICS satisfy HIPAA?
No. ADHICS does not require signed Business Associate Agreements or the HIPAA Breach Notification Rule timeline. If HIPAA applies you need its specific artefacts on top.
Which should I do first?
Start with the one your jurisdiction forces. If you operate in Abu Dhabi, ADHICS is a licensure condition — do it first. If you handle US PHI, HIPAA is federal law — do it first. If both apply, run them together.
What about the DoH Malaffi connection?
Malaffi connection controls are ADHICS-specific. HIPAA has no equivalent. If your HIMS platform connects to Malaffi you need the ADHICS-specific authentication, logging and access-review evidence pack.
Related resources
Run ADHICS + HIPAA on one evidence pack
LowerPlane maps the overlapping controls once and keeps the jurisdiction-specific artefacts (SoA, quarterly reports, BAAs) separate but in sync. One advisor, one platform, 30 days to audit-ready.