ADHICS
Abu Dhabi Healthcare Information and Cyber Security Standard — the Department of Health's mandatory security standard for licensed healthcare entities operating in Abu Dhabi.
ADHICS V2 is the current revision of the Abu Dhabi Department of Health's healthcare security standard. It applies to every DoH-licensed clinic, hospital, pharmacy, dental practice and HIMS vendor operating in Abu Dhabi, and compliance is a condition of licensure renewal. The standard uses three tiered control sets — Basic, Transitional and Advanced — organised around twelve control families drawn from the ISO 27001 Annex A structure, plus Abu Dhabi healthcare-specific overlays (DoH notification paths, Malaffi connection controls, quarterly compliance reporting to DoH). Audits are performed by Technical Review Boards; findings carry a 90-day remediation window.
Examples
- →A multi-site clinic group maps to the Basic tier, designates the IT lead as accountable owner, and submits a quarterly compliance report to DoH.
- →A hospital at the Advanced tier appoints a dedicated CISO, runs a formal ISMS, and completes an internal audit before the annual TRBA review.
Common mistakes
- ✗Treating ADHICS as optional for DoH licensure. It isn't — the TRBA audit outcome drives renewal.
- ✗Leaving TRBA findings open past the 90-day remediation window, which can affect licensure.
How LowerPlane handles it
LowerPlane ships an ADHICS-aligned policy pack, Statement of Applicability, 90-day findings tracker and a quarterly DoH report workflow. Teams running ISO 27001 reuse ~70% of their Annex A evidence against ADHICS requirements.
Authoritative sources
Related reading on LowerPlane
Related terms
- Malaffi — The Abu Dhabi health information exchange — the shared electronic health record platform all Abu Dhabi healthcare providers connect into.
- ISO 27001 — International standard for an Information Security Management System (ISMS), certifiable by accredited bodies.
- HIPAA — US Health Insurance Portability and Accountability Act — governs the privacy and security of protected health information.