The ADHICS Quarterly Compliance Report
Every DoH-licensed facility submits a quarterly compliance report. Here is what goes in it, how to source the data, and how to run the submission in 90 minutes instead of two days.
What is the quarterly report?
The quarterly compliance report is a facility’s standing update to the Abu Dhabi Department of Health on the state of its ADHICS programme. It covers control effectiveness, incidents, open TRBA findings, vendor changes, Malaffi connection status and training completion for the quarter.
Reports are due within 15 business days of each calendar quarter close. A missed submission becomes a major finding at the next TRBA audit — recovery is costly, and the fix is simply to run a reliable workflow.
The 10 required sections
Report structure follows DoH guidance for the ADHICS tier that applies to your facility. Advanced-tier reports add deeper governance and internal-audit sections, but every tier covers the ten areas below.
Executive summary
One-page narrative on quarter posture, open findings and material changes. Signed by the accountable owner.
Control-effectiveness metrics
Per-family metrics: MFA coverage, access-review completion, patching SLA, backup test results, training completion, incident counts.
Incident log
All security incidents in the quarter with impact, remediation status and DoH notification record where applicable.
Open TRBA findings
Status of every finding from the most recent TRBA report. 90-day timer position, remediation evidence, close date.
Vendor and sub-processor changes
New vendors engaged, sub-processors added, contracts renewed with ADHICS-aligned clauses, right-to-audit activity.
Malaffi connection status
Authentication posture, access-review evidence, logging coverage, any Malaffi-related incidents or configuration changes.
Training completion
Security awareness training completion for all staff with ePHI access. Role-based training for IT and clinical leads.
Testing evidence
Backup restoration test record, business continuity / DR test record, tabletop exercise record where applicable.
Changes since last report
Scope changes, new sites, new HIMS systems, organisational changes affecting the information security programme.
Lessons and next quarter plan
What was learned, control changes planned for next quarter, remediation milestones committed to.
The 15-day submission workflow
Four phases from quarter close to DoH submission. The LowerPlane workflow pulls the system-sourced data on day zero so your team only drafts the narrative and reviews the metrics.
Data collection kicks off
- ✓Control metrics pulled from connected systems automatically
- ✓Open findings list refreshed from the TRBA tracker
- ✓Vendor register changes exported
- ✓Training completion pulled from the LMS
Draft prepared
- ✓Report pre-filled with system-sourced data
- ✓Advisor reviews metrics for anomalies
- ✓Incident log reviewed and summarised
- ✓Narrative sections drafted
Internal review
- ✓Accountable owner / CISO reviews the draft
- ✓Executive sponsor (clinic director / CEO) reviews summary
- ✓Legal spot-checks vendor and incident sections
- ✓Final sign-off collected
Submission to DoH
- ✓Report filed via the DoH portal (or email per facility arrangement)
- ✓Submission receipt saved to the evidence pack
- ✓Next-quarter commitments logged in LowerPlane
- ✓Open items roll forward into the live finding tracker
What gets pulled automatically
The majority of a quarterly report is numeric — metrics, counts, SLA adherence, finding status. LowerPlane pulls these directly from your connected systems so the quarterly submission is a review-and-sign exercise, not a data-collection scramble.
Identity provider
MFA coverage, SSO enrolment, dormant-account count, quarterly access-review completion
Cloud / infrastructure
Patching SLA, backup test results, encryption posture, logging coverage
Security tooling
Vulnerability-count trend, open critical / high findings, remediation SLA adherence
HR / LMS
Training completion rates, onboarding / offboarding counts, background-check status
LowerPlane finding tracker
Open TRBA findings, 90-day timer position, remediation evidence links
Vendor register
New vendors, sub-processor changes, contract renewals, ADHICS-clause coverage
The narrative sections — executive summary, lessons captured, next-quarter plan — remain human-written. Your advisor reviews the full draft on day T+3 and flags any metric that looks anomalous before internal review.
Common pitfalls
- Treating the report as a formality. DoH reads them. Missing data triggers follow-up questions and sets a tone for the next TRBA audit.
- Starting on day T+10. You lose the five-day review buffer and burn weekends. Start on T+0 with the system-sourced metrics already pulled.
- Repeating last quarter’s narrative. DoH notices. Every quarter needs genuine updates on control changes, incidents and the next-quarter plan.
- Forgetting the Malaffi section. Facilities new to ADHICS often skip Malaffi connection status in early reports. Include it from quarter one.
Related resources
- The TRBA audit guide — what the quarterly report feeds into.
- ADHICS V2 requirements — the control families reported each quarter.
- ADHICS cost breakdown — including the quarterly-reporting line item.
Frequently asked questions
When is the quarterly report due?
Reports are due within the first 15 business days following the close of each calendar quarter. Facilities should confirm the exact submission date with their DoH contact, as licensure-specific schedules can shift the deadline slightly.
Who signs the quarterly report?
The accountable owner for information security — typically the designated owner at Basic / Transitional tier, or the CISO at Advanced tier. The practice owner, clinic director or hospital CEO co-signs depending on tier and facility governance.
What happens if we miss a submission?
A missed submission is logged by DoH and becomes a major finding at the next TRBA audit. Recovery is submitting the overdue report with a documented root-cause note and a committed cadence commitment for future quarters.
Does the report include incident disclosures?
Yes. Any security incident affecting ePHI, clinical systems or the Malaffi connection is included with the incident date, impact summary, remediation status and lessons captured. Incidents also follow the DoH incident notification path at the time they occur — the quarterly report is a summary, not the first disclosure.
Can the report be automated?
Most of it, yes. Control-effectiveness metrics, access-review counts, training completion, backup test records and open findings can all be pulled directly from your connected systems. The narrative sections — summary and lessons captured — remain human-written and advisor-reviewed.
Want the quarterly report workflow running?
Book a 20-minute call. We’ll walk the LowerPlane workflow against your current reporting process and lay out the first automated submission.
See the Quarterly Report Workflow