FREE CHECKLIST
ADHICS V2 Compliance Checklist
The complete 12-family ADHICS checklist for Abu Dhabi clinics, hospitals and HIMS vendors preparing for TRBA audit and DoH licensure renewal.
The 12 control families
🏛️
Governance & accountability
- ✓Information security policy approved by executive owner
- ✓Accountable security owner designated (CISO at Advanced tier)
- ✓Security committee cadence documented
- ✓Risk management procedure reviewed quarterly
👥
People & training
- ✓Background checks for clinical and admin staff
- ✓Security-awareness training on hire + annually
- ✓Role-based ADHICS training for IT and clinical leads
- ✓Documented onboarding / offboarding procedure
🔐
Access control
- ✓MFA on every account with access to ePHI
- ✓Role-based access with periodic review (quarterly)
- ✓Separate accounts for admins and clinicians
- ✓Privileged-access management for IT staff
- ✓Access logs retained per ADHICS retention requirements
🔑
Cryptography
- ✓Encryption at rest for ePHI and backups
- ✓TLS for all clinical and admin applications
- ✓Key management procedure documented
- ✓Encryption of removable media
🏢
Physical security
- ✓Clinical-site access controls documented
- ✓Visitor sign-in procedure for restricted areas
- ✓Equipment protection (clean-desk, locked workstations)
- ✓Secure disposal of printed PHI and old hardware
⚙️
Operations security
- ✓Automated OS and application patching
- ✓Antivirus / EDR on managed endpoints
- ✓Backups tested at least annually
- ✓Centralised logging with ADHICS-aligned retention
- ✓Change-management procedure for clinical systems
🌐
Communications security
- ✓TLS everywhere, HTTPS enforced
- ✓VPN for remote access to clinical systems
- ✓Network segmentation between clinical and admin
- ✓Firewall rulesets reviewed semi-annually
🤝
Supplier & vendor security
- ✓HIMS vendor register with ADHICS-aligned contracts
- ✓Vendor risk assessment on onboarding
- ✓Data processing agreements on file
- ✓Subcontractor flow-down obligations documented
🚨
Incident management
- ✓Incident response runbook with DoH notification path
- ✓Incident register with 90-day findings tracking
- ✓Tabletop exercise at least annually
- ✓Post-incident review with lessons captured
🔄
Business continuity
- ✓Business continuity plan for clinical services
- ✓Disaster-recovery plan with RTO / RPO defined
- ✓DR test completed within last 12 months
- ✓Alternative-site arrangement documented
📊
Compliance & audit
- ✓Statement of Applicability per facility
- ✓Risk register (reviewed quarterly)
- ✓Quarterly compliance report workflow to DoH
- ✓TRBA audit evidence pack maintained
- ✓Malaffi connection controls documented
- ✓Internal audit cycle (Advanced tier)
Prefer this as a PDF?
Get the complete ADHICS V2 checklist as a one-page PDF, plus the quarterly report template.