FREE TEMPLATE PACK

ADHICS V2 Policy Pack

Twelve ADHICS-aligned policies covering every control family DoH expects at Basic, Transitional and Advanced tier. Written for Abu Dhabi healthcare operations and ready to customise.

12 policies, one pack

Information Security Policy

Top-level policy approved by executive owner, aligned to ADHICS V2 governance requirements.

Human Resources Security Policy

Background checks, onboarding/offboarding, security awareness training on hire and annually.

Asset Management & Classification Policy

Inventory and classification of information assets, labelling of ePHI.

Access Control Policy

MFA on clinical systems, role-based access, quarterly review cadence, privileged access management.

Cryptography Policy

Encryption at rest and in transit for ePHI, key management and rotation.

Physical Security Policy

Clinical-site access controls, visitor procedure, equipment protection, secure disposal.

Operations Security Policy

Patching, antivirus/EDR, backups, centralised logging with ADHICS-aligned retention.

Communications Security Policy

TLS everywhere, VPN for remote access, network segmentation across clinical and admin.

Supplier Relationships Policy

HIMS vendor register, ADHICS-aligned contract clauses, sub-processor flow-down.

Incident Management Policy

Incident response runbook with DoH notification path, incident register, tabletop cadence.

Business Continuity Policy

Clinical-service continuity, DR plan with RTO/RPO, test cadence.

Compliance & Audit Policy

Quarterly compliance report workflow, TRBA readiness, Malaffi connection controls.

How to use the pack

Confirm your tier

Basic (clinics, dental, pharmacies, labs), Transitional (multi-site) or Advanced (hospitals). The pack scales with tier — Advanced adds governance and internal-audit depth.

Customise organisation details

Replace placeholders (facility name, accountable owner, DoH licence number, Malaffi connection IDs) across every policy.

Executive approval

Information security policy is approved by the executive owner (or CEO at Advanced tier). Record the approval date in the policy header.

Publish and train

Make policies accessible to all staff with ePHI access. Capture training completion in your LMS for the TRBA evidence pack.

Annual review

Policies are reviewed at least annually and whenever controls change materially. Track review dates in your Statement of Applicability.

Want the whole programme managed for you?

LowerPlane keeps every policy version-controlled, maps it to ADHICS controls automatically, and runs the quarterly report workflow with your dedicated advisor.

See the ADHICS Platform