Regulation hub
Run ADHICS on one record, across every suite
The Department of Health's information and cyber security standard for healthcare in Abu Dhabi. It sets the controls that healthcare entities and their technology and service providers must implement to protect health information. Pritect maps each control group to the suite that carries it, so a control is implemented, evidenced and reported once.
- Instrument
- DOH/SD/ICSO/ADHICS/V2/2024
- Version
- V2
- In force
- Aug 2024
ADHICS
DOH/SD/ICSO/ADHICS/V2/2024
Ready
Data protection
Draft3 obligations mapped
Records of processing, consent, rights requests and impact assessments
- DP 1
- DP 2
- DP 3
Incident Centre
Draft3 obligations mapped
Breach logging, notification decisions and the timeline
- IM 1
- IM 2
- IM 3
Third-party governance
Draft3 obligations mapped
Processor due diligence, contract terms and monitoring
- TP 1
- TP 2
- SA 6
Cybersecurity
Draft39 obligations mapped
Security controls and the evidence behind them
- A 5
- HR 1
- HR 2
- HR 3
- HR 4
- +34
Governance
Draft3 obligations mapped
Policies, committees, compliance and audit
- A 2
- A 4
- A 6
Enterprise risk
Draft1 obligation mapped
Risk register, assessments and treatment
- A 3
ADHICS is now mapped across 6 suites. Each mapping waits for your Data Protection Officer to confirm it.
01 · Article to module
Every obligation lands in a suite.
ADHICS V2 has 131 primary controls in Section B, organised into eleven domains. This page lists 52 units, the five governance chapters of Section A and the Section B control groups that hold those controls, and maps each one to the Pritect suite that carries it.
Headings are quoted verbatim from the Department of Health - Abu Dhabi, V2. Read the official text
Governance, risk and compliance (Section A)
A 2 to 6
| Control | Heading | Pritect suite |
|---|---|---|
| A 2 | Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Governance | Governance |
| A 3 | Information Security Risk Management | Enterprise risk |
| A 4 | Statement of Applicability | Governance |
| A 5 | Information Asset Classification | Cybersecurity |
| A 6 | Control Adoption, Compliance and Audit | Governance |
Human resource security
HR 1 to 4
| Control | Heading | Pritect suite |
|---|---|---|
| HR 1 | Human Resources Security Policy | Cybersecurity |
| HR 2 | Prior to Employment | Cybersecurity |
| HR 3 | During Employment | Cybersecurity |
| HR 4 | Termination or Change of Employment and Role | Cybersecurity |
Asset management
AM 1 to 5
| Control | Heading | Pritect suite |
|---|---|---|
| AM 1 | Asset Management Policy | Cybersecurity |
| AM 2 | Management of Asset | Cybersecurity |
| AM 3 | Asset Classification & Labelling | Cybersecurity |
| AM 4 | Asset Handling | Cybersecurity |
| AM 5 | Asset Disposal | Cybersecurity |
Physical and environmental security
PE 1 to 3
| Control | Heading | Pritect suite |
|---|---|---|
| PE 1 | Physical and Environmental Security Policy | Cybersecurity |
| PE 2 | Secure Areas | Cybersecurity |
| PE 3 | Equipment Security | Cybersecurity |
Access control
AC 1 to 6
| Control | Heading | Pritect suite |
|---|---|---|
| AC 1 | Access Control Policy | Cybersecurity |
| AC 2 | User Access Management | Cybersecurity |
| AC 3 | Equipment and Devices Access Control | Cybersecurity |
| AC 4 | Access Reviews | Cybersecurity |
| AC 5 | Network Access Control | Cybersecurity |
| AC 6 | Operating System Access Control | Cybersecurity |
Communications and operations management
CO 1 to 12
| Control | Heading | Pritect suite |
|---|---|---|
| CO 1 | Communications and Operations Management Policy | Cybersecurity |
| CO 2 | Operational Procedures and Responsibilities | Cybersecurity |
| CO 3 | Planning and Acceptance | Cybersecurity |
| CO 4 | Malware Protection | Cybersecurity |
| CO 5 | Backup and Archival | Cybersecurity |
| CO 6 | Logging and Monitoring | Cybersecurity |
| CO 7 | Security Assessment and Vulnerability Management | Cybersecurity |
| CO 8 | Patch Management | Cybersecurity |
| CO 9 | Information Exchange | Cybersecurity |
| CO 10 | Electronic Commerce | Cybersecurity |
| CO 11 | Information Sharing Platforms | Cybersecurity |
| CO 12 | Network Security Management | Cybersecurity |
Data privacy and protection
DP 1 to 3
| Control | Heading | Pritect suite |
|---|---|---|
| DP 1 | Privacy and Protection Practices | Data protection |
| DP 2 | Appointment of Data Protection Officer | Data protection |
| DP 3 | Data Subject Rights | Data protection |
Cloud security
CS 1
| Control | Heading | Pritect suite |
|---|---|---|
| CS 1 | Cloud Security Policy | Cybersecurity |
Third party security
TP 1 to 2
| Control | Heading | Pritect suite |
|---|---|---|
| TP 1 | Third Party Security Policy | Third-party governance |
| TP 2 | Third Party Service Delivery and Monitoring | Third-party governance |
Systems acquisition, development and maintenance
SA 1 to 6
| Control | Heading | Pritect suite |
|---|---|---|
| SA 1 | Information Systems Acquisition, Development, and Maintenance Policy | Cybersecurity |
| SA 2 | Security Requirement of Information Systems and Applications | Cybersecurity |
| SA 3 | Cryptographic Controls | Cybersecurity |
| SA 4 | Security of System Files | Cybersecurity |
| SA 5 | Outsourced Software Development | Cybersecurity |
| SA 6 | Supply Chain Management | Third-party governance |
Incident management
IM 1 to 3
| Control | Heading | Pritect suite |
|---|---|---|
| IM 1 | Information Security Incident Policy | Incident Centre |
| IM 2 | Incident Management and Improvements | Incident Centre |
| IM 3 | Information Security Events and Weakness Reporting | Incident Centre |
Systems continuity management
SC 1 to 2
| Control | Heading | Pritect suite |
|---|---|---|
| SC 1 | Information Systems Continuity Management Policy | Cybersecurity |
| SC 2 | Information Systems Continuity Planning | Cybersecurity |
02 · Timeline
When it applies.
Published
May 2024
Effective
Aug 2024
03 · Overlaps
One record answers several laws.
Where ADHICS and its neighbours cover the same ground, Pritect keeps one record and maps every law to it. The grouping is ours, for navigation, and is not a statement that the provisions are legally equivalent.
| Obligation | ADHICS | UAE PDPL | UAE Health ICT Law | GDPR |
|---|---|---|---|---|
| Processing principles | DP 1 | Art. 5 | Art. 15 | Art. 5 |
| Lawful basis | Not tracked | Art. 4 | Not tracked | Art. 6, Art. 9 |
| Consent | Not tracked | Art. 6 | Art. 16 | Art. 7 to 8 |
| Data subject rights | DP 3 | Art. 13 to 19 | Not tracked | Art. 12 to 22 |
| Records of processing | Not tracked | Not tracked | Not tracked | Art. 30 |
| Security of processing | A 5, HR 1 to 4, AM 1 to 5, PE 1 to 3, AC 1 to 6, +4 | Art. 20 | Art. 4, Art. 8, Art. 14 | Art. 32 |
| Breach notification | IM 1 to 3 | Art. 9 | Not tracked | Art. 33 to 34 |
| Impact assessment | Not tracked | Art. 21 | Not tracked | Art. 35 to 36 |
| Data protection officer | DP 2 | Art. 10 to 12 | Not tracked | Art. 37 to 39 |
| Processors | TP 1 to 2 | Art. 8 | Not tracked | Art. 28 to 29 |
| Cross-border transfers | Not tracked | Art. 22 to 23 | Art. 13 | Art. 44 to 49 |
04 · Questions
What teams ask first.
Who must comply with ADHICS?
ADHICS applies to healthcare entities in the Emirate of Abu Dhabi and to the healthcare technology and service providers that serve them, as the standard itself sets out. Your counsel or compliance team should confirm how it applies to you. Pritect records that decision once, on the entity, so every later assessment uses it.
What are the Basic, Transitional and Advanced levels?
Every primary control in ADHICS carries a criteria level. To reach Transitional, an entity meets all Basic and Transitional criteria, and Advanced adds the Advanced criteria on top. Providers of healthcare technology and services follow a separate Service Provider category. Pritect keeps the level on each control, so you can plan the road map the standard asks for and report against it.
Does Pritect hold the ADHICS controls?
Yes. Pritect's catalogue carries the ADHICS V2 controls as published by the Department of Health, reproduced with its permission, and they are awaiting review by a subject matter expert. Each control keeps its reference, so your evidence and your compliance reporting cite the standard directly.
How does ADHICS relate to the federal health ICT law?
They work at different levels. The federal law on information and communications technology in health sets the rules for health data across the UAE, including where it is stored. ADHICS sets the security controls a healthcare entity in Abu Dhabi implements. The controls you evidence for ADHICS can also support the security articles of the federal law.
This page summarises publicly available legal text so you can orient yourself. It is not legal advice.