Abu Dhabi's healthcare information and cyber security standard, automated. Basic / Transitional / Advanced control sets by facility type, TRBA audit prep, quarterly reports to the Department of Health, and Malaffi connection controls. Starting at $4,995.
ADHICS is a licensure condition. Here is how we make it predictable.
Traditional vendors: 4–6 months with a consultant
LowerPlane: 30 days with an advisor
Your dedicated advisor runs you through the Basic / Transitional / Advanced control set that applies to your facility and builds the evidence pack the TRBA auditor will ask for.
Traditional vendors: AED 60,000+ with consultants
LowerPlane: From $4,995 (~AED 18,300)
Flat annual price. Policy pack, control mapping, quarterly report workflow and incident runbook included. The TRBA audit fee is paid separately to the audit firm.
Traditional vendors: Rebuild evidence per regime
LowerPlane: 70%+ control overlap mapped
If you already run ISO 27001, LowerPlane maps Annex A controls against ADHICS requirements so one evidence item covers both. Teams running SOC 2 or HIPAA get similar reuse.
ADHICS — Abu Dhabi Healthcare Information and Cyber Security Standard — is the Department of Health's mandatory security standard for healthcare entities and HIMS vendors operating in Abu Dhabi.
ADHICS V2 is the current revision. It applies to every DoH-licensed healthcare provider (clinics, dental practices, pharmacies, diagnostic labs, hospitals) and the HIMS vendors they rely on. Compliance is a condition of DoH licensure and of connection to the Malaffi health information exchange.
See the full ADHICS requirements →The control families auditors look at, plus the artefacts the TRBA will want on file.
A 4-week process from scoping to the TRBA engagement.
Identify your ADHICS tier (Basic / Transitional / Advanced) based on facility type, scope and risk profile. Deploy the ADHICS-aligned policy pack.
Close the technical control gaps most common at Abu Dhabi clinics — MFA on clinical systems, encryption for ePHI, centralised logging.
Stand up vendor oversight for your HIMS and subprocessors, plus the DoH-notification incident runbook.
Advisor-led readiness walkthrough, then prepare and submit your first quarterly compliance report to DoH.
Clinics, dental practices and HIMS vendors moving from spreadsheets to a managed program.
We were four weeks from a DoH licence renewal and the TRBA finding list was still open. LowerPlane's advisor rebuilt our evidence pack in two weeks and we closed every finding inside the 90-day window.
Running ADHICS and ISO 27001 together halved the work. Our Annex A evidence tags straight into the ADHICS Statement of Applicability.
Quarterly reporting used to burn two days per quarter and introduce typos. The LowerPlane quarterly report workflow pulls the data straight from our control dashboards.
What a readiness platform does better than hourly consulting.
| Feature | LowerPlane | Consultant A | Consultant B | In-house |
|---|---|---|---|---|
| Starting Price | $4,995/yr | AED 60,000+ | AED 80,000+ | Headcount cost |
| ADHICS tier mapping | ✅ Automated | ⚠️ Manual | ⚠️ Manual | ❌ DIY |
| Quarterly report workflow | ✅ Pre-filled from controls | ⚠️ Billable hours | ⚠️ Billable hours | ❌ Spreadsheets |
| TRBA findings tracking | ✅ 90-day timer per finding | ⚠️ Email threads | ⚠️ Email threads | ❌ Ad-hoc |
| Malaffi connection controls | ✅ Pre-mapped | ⚠️ Document | ⚠️ Document | ❌ DIY |
| ISO 27001 / SOC 2 reuse | ✅ 70%+ overlap mapped | ⚠️ Partial | ⚠️ Partial | ❌ Rebuild |
| Dedicated advisor | ✅ All plans | ✅ Billable | ✅ Billable | ❌ |
Abu Dhabi healthcare teams often pair ADHICS with ISO 27001 (for global buyers) and HIPAA (for US affiliates).
70%+ of Annex A maps into the ADHICS Statement of Applicability.
For Abu Dhabi providers with US-affiliate or cross-border PHI flows.
For HIMS vendors selling into enterprise or regulated US buyers.
Book a 20-minute assessment. We'll confirm your ADHICS tier, map your current controls to V2, and lay out the 30-day path to audit-ready.