ADHICS V2 Requirements Explained

ADHICS V2 — the Abu Dhabi Healthcare Information and Cyber Security Standard — defines three control sets by facility type and twelve control families each facility must implement. Here is the plain-English version.

The three ADHICS tiers

🏥

Basic

Clinics, dental practices, pharmacies, standalone diagnostic labs

✓Baseline control set across 12 families
✓Designated accountable owner for security (not a dedicated CISO)
✓Policy pack, access controls, backups, incident runbook
✓Quarterly DoH compliance report
✓TRBA audit on licensure cycle

🩺

Transitional

Mid-size multi-site providers, specialty centres

✓Expanded risk management and third-party oversight
✓Formal incident response + business continuity testing
✓Named security owner, documented reporting line
✓Vendor register with ADHICS-aligned contracts
✓Annual control-effectiveness review

🧬

Advanced

Hospitals and complex providers

✓Dedicated CISO with executive reporting
✓Formal information security management system
✓Risk assessment programme with quantified exposure
✓Internal audit function covering ADHICS
✓Enterprise-grade incident response + DR testing

The 12 control families

Every ADHICS tier is organised around the same twelve control families. Tiers differ in how deeply each family must be implemented and documented.

🏛️

Governance

Policies, roles, security committee cadence.

👥

Human Resources

Background checks, training, onboarding/offboarding.

🗂️

Asset Management

Inventory and classification of information assets.

🔐

Access Control

MFA on clinical systems, role-based access, periodic review.

🔑

Cryptography

Encryption at rest and in transit for ePHI.

🏢

Physical Security

Clinical-site access controls and equipment protection.

⚙️

Operations Security

Patching, backups, logging, change control.

🌐

Communications Security

TLS, VPNs, segmentation across clinical networks.

🤝

Supplier Relationships

HIMS vendor oversight and ADHICS-aligned contracts.

🚨

Incident Management

Detection, response, DoH notification path.

🔄

Business Continuity

Clinical-service continuity and DR testing.

📊

Compliance & Audit

Quarterly DoH reporting, TRBA readiness, Malaffi controls.

How ADHICS maps to ISO 27001

ADHICS V2 adopts the ISO 27001 Annex A control structure as its spine, with Abu Dhabi healthcare-specific overlays. If your organisation runs ISO 27001:

Your Annex A controls populate 70%+ of ADHICS requirements by evidence.
The ADHICS-only additions are DoH notification paths, Malaffi connection controls, quarterly reporting, and tier-specific documentation.
LowerPlane maps ISO 27001 controls to ADHICS families automatically, so you build evidence once.

Running both is the common pattern for HIMS vendors and larger clinical groups selling across Abu Dhabi and global markets. See the ADHICS vs ISO 27001 comparison.

What the TRBA audit looks like

The Technical Review Board Audit (TRBA) is the DoH-approved audit of ADHICS compliance. Expect:

Document review of your policy pack, SoA, risk register and vendor contracts.
Technical validation of access controls, encryption, logging and backup posture at your clinical sites.
Interviews with the accountable owner (or CISO), IT lead and clinical operations lead.
Findings report with a 90-day window to close non-conformities.

Full process in the ADHICS audit guide.

Quarterly compliance reporting

Every ADHICS-covered entity submits a quarterly compliance report to the Department of Health. The report summarises control-effectiveness metrics, incidents, remediation progress on open TRBA findings, and training completion. See how to prepare the quarterly report.

Frequently asked questions

Which ADHICS tier applies to my facility?

The Department of Health designates the tier based on facility type, scale and risk profile. Clinics, dental practices, pharmacies and standalone diagnostic labs typically map to Basic. Mid-size multi-site providers and specialty centres map to Transitional. Hospitals and complex providers map to Advanced. If uncertain, confirm with DoH during the licensure review.

What is the difference between Basic, Transitional and Advanced?

Basic is a baseline control set oriented to smaller facilities with simpler estates. Transitional adds depth across risk management, incident response and vendor oversight. Advanced is designed for hospitals and large providers and requires a formal information security programme with a designated CISO.

Is a CISO required?

A dedicated CISO is explicitly expected at the Advanced tier. Basic and Transitional facilities must designate an accountable owner for information security, which can be a shared or part-time role. See the ADHICS CISO guide for current DoH expectations.

How does ADHICS compare to ISO 27001?

ADHICS V2 draws heavily on the ISO 27001 Annex A control structure, with Abu Dhabi healthcare-specific requirements layered on top (DoH notification paths, Malaffi connection controls, quarterly reporting). Running ISO 27001 alongside ADHICS captures ~70% control overlap.