A patient’s medical records can pass through multiple systems before they reach the right healthcare provider.
In Dubai, the scale of that data exchange is significant: by July 2025, NABIDH had connected 10.41 million medical records across 1,888 healthcare facilities and 91 electronic medical record systems, according to Dubai’s Health Authority.
That connectivity helps healthcare providers share patient information. But when someone accesses records without authorization, it can make the investigation harder.
The hospital may need to piece together access logs from its own systems, audit records from its EHR provider and alerts from its security team to establish what happened.
This is where compliance becomes a practical test of security.
Abu Dhabi’s ADHICS V2 and Dubai’s NABIDH policies set requirements around security monitoring, access auditing and incident records. Hospitals need to show that their controls work and that they can produce reliable evidence when an incident or compliance audit puts them to the test.
This guide explains what ADHICS and NABIDH require, where evidence gaps emerge and how hospitals across both emirates can address them.
TL; DR
- ADHICS vs NABIDH: Both address healthcare data security, but hospitals in Abu Dhabi and Dubai must meet the requirements that apply to their facilities.
- Where evidence gets lost: Logs spread across hospital IT, EHR vendors and SOC providers can make it hard to piece together what happened during an incident.
- Managing evidence centrally: Healthcare groups can standardize monitoring and evidence collection without overlooking each facility's compliance obligations.
- Preparing for an audit: Hospitals should be able to retrieve access logs, incident timelines, investigation findings and corrective-action records when asked.
- Where a managed SOC helps: DC Technologies' UAE-based SOC supports 24/7 monitoring, incident investigation and response documentation. Hospitals remain responsible for their regulatory compliance.
What Evidence Do ADHICS V2 and NABIDH Actually Require?
Imagine being asked to investigate unauthorized access to a patient’s records. Your hospital has login logs. The EHR provider has records of which files were opened. Your security team has an alert showing suspicious activity.
Each system holds part of the story. Your team just needs to connect those records to establish what happened and how it was handled.
That is where the evidence requirements in ADHICS V2 and NABIDH come into play. Both address healthcare data security, but they apply in different regulatory contexts.
ADHICS V2 sets cybersecurity requirements for healthcare entities in Abu Dhabi. NABIDH policies govern the secure exchange of patient information in Dubai, including access auditing and incident investigation.
Here is what hospitals need to be able to demonstrate under each framework.
Evidence area
ADHICS V2 – Abu Dhabi
NABIDH – Dubai
Access records
Logs of user activity, privileged access and login attempts
Records of access to electronic patient information and relevant user activities
Security monitoring
Monitoring of critical systems, security events and defined escalation procedures
Audit records supporting traceability of activity within connected healthcare systems
Incident investigation
Documented incidents, investigation findings and preserved evidence
Records needed to investigate unauthorised access or incidents involving NABIDH
Control effectiveness
Log reviews, monitoring procedures and documented responses to security alerts
Audit processes to assess compliance and the effectiveness of relevant information security controls
Sources: DoH ADHICS V2, Logging and Monitoring (CO 6) and DHA NABIDH Audit Policy.
The differences become clearer when you look at what hospitals must do with those records.
For Dubai facilities, the NABIDH Audit Policy specifies a three-year retention period for relevant audit logs. It also calls for regular log reviews, with anomalies and corrective actions documented.
For Abu Dhabi facilities, ADHICS V2 sets requirements around security monitoring and incident management. Hospitals need to ensure their processes generate the records needed to investigate security events and demonstrate how they were handled.
The challenge is making these records available when they are needed. Logs may sit with different teams and technology providers, leaving hospitals to piece together the evidence during an incident or assessment.
How Should Healthcare Groups Manage Security Evidence Across Abu Dhabi and Dubai?
A healthcare group may have hospitals in both Abu Dhabi and Dubai, each subject to different regulatory requirements. If every facility follows the same process without accounting for those differences, important evidence or retention requirements can slip through the cracks.
That doesn’t mean each hospital needs its own security operations team. Groups can centralize monitoring and incident investigation while keeping each facility’s compliance requirements clear.
What Can Be Managed Centrally?
Several security activities can follow the same process across the group.
Bring relevant alerts and logs from multiple hospitals into a central monitoring function.
Use consistent methods to flag suspicious logins, privileged account activity and unauthorized access attempts.
Follow a common format for recording timelines, investigation findings and response actions.
Set procedures for protecting logs against alteration and applying the correct retention periods.
Establish how EHR, cloud and other technology providers supply evidence during investigations.
For example, if an employee’s account is compromised at a Dubai hospital, a central SOC can investigate suspicious login activity and work with the hospital’s IT team and EHR provider to establish which patient records were accessed.
The group can document the investigation using a shared format. The evidence must still meet the applicable NABIDH requirements. The same process can support investigations at an Abu Dhabi facility, with evidence mapped to the relevant ADHICS V2 controls.
What Must Each Facility Still Own?
Centralizing security operations doesn’t transfer a facility’s regulatory responsibilities to the group SOC. Each hospital must still establish:
- Which ADHICS V2 or NABIDH requirements apply to its operations.
- What evidence it must retain and for how long.
- Who handles incident notification and regulatory communication.
- Which local teams and vendors must be involved in an investigation.
The goal is to make security evidence easier to retrieve across the group while preserving the accountability of each regulated healthcare entity.
Also Read – In-House vs Managed Security Operations Center: What to Pick?
What Should Your Hospital Be Able to Produce During an Incident or Assessment?
Let’s say an assessor asks your team to reconstruct a security incident from six weeks ago. Can you retrieve the original logs, establish which patient records were accessed and show how your team responded?
Or would you need to chase your EHR provider for audit records, ask your SOC for its investigation notes and piece the timeline together from old tickets?
To avoid that scramble, your hospital needs to know what evidence to collect, where it lives and who is responsible for providing it. This table is a practical starting point.
User access records
EHR and identity management systems
Hospital IT / EHR vendor
Security event logs
Firewalls, endpoint protection and servers
IT team / Managed SOC
Incident timeline
SIEM and SOC investigation records
Managed SOC / Security team
Investigation findings
Incident reports and application audit logs
Managed SOC / Application vendor
Containment actions
Security tools and incident tickets
Managed SOC / Hospital IT
Corrective actions
Risk register and remediation tickets
Hospital IT / Security manager
Evidence of control reviews
Access reviews, monitoring reports and assessment records
Security / Compliance team
The exact evidence depends on the incident and the applicable ADHICS V2 or NABIDH requirements. What matters is being able to retrieve the relevant records and connect them into a clear account of what happened.
Put Your Evidence Collection to the Test
Pick a recently resolved security incident and ask your IT team and managed SOC to reconstruct the timeline using the original records, not just the final incident report.
Check five things:
- Availability: Were the relevant records generated and retained for the required period?
- Access: Could authorized investigators retrieve them promptly?
- Integrity: Can you show that the records haven’t been altered?
- Traceability: Can you connect records from different systems to establish what happened?
- Ownership: Is it clear who is responsible for supplying each record?
If your group operates across Abu Dhabi and Dubai, repeat the exercise at a facility in each emirate. This will help you identify gaps in the shared process and check that each facility can meet its applicable requirements.
If your team cannot reconstruct an incident from its original records, the evidence process needs work, even if the incident itself was resolved.
Also Read – Your First 30 Days with MDR Services: What to Expect
How Can a Managed SOC Help Hospitals Maintain Security Evidence?
A hospital can have years of security logs and still struggle to explain a single incident. The problem is often that nobody has connected the records across its systems.
A managed Security Operations Centre (SOC) can help close that gap by monitoring agreed systems around the clock, investigating suspicious activity and documenting what happens next.
What Does the SOC Actually Contribute?
Records of security events and suspicious activity detected across connected systems.
Findings showing what triggered an alert, which systems were examined and what the investigation uncovered.
A timeline of escalations, containment actions and the teams involved.
Connections between identity, network and endpoint activity that help reconstruct an incident.
Investigation summaries, outstanding findings and documented follow-up actions.
There is one important limitation: a SOC can only investigate the evidence it can access. It may detect suspicious access through identity logs, for example, but need the EHR vendor’s audit records to establish which patient files were viewed.
Agreeing on log access and vendor cooperation in advance can make a real difference when an incident occurs.
What Remains the Hospital's Responsibility?
A managed SOC supports security operations; it does not take over the hospital’s regulatory accountability. The hospital remains responsible for determining which requirements apply, approving access to sensitive information and ensuring that applicable retention and reporting obligations are met.
For groups operating across Abu Dhabi and Dubai, the SOC can provide a consistent approach to monitoring and investigation while each facility maintains responsibility for its ADHICS V2 or NABIDH obligations.
How Can DC Technologies Support This?
DC Technologies operates an in-house, UAE-based SOC providing 24/7 security monitoring, threat investigation and incident response support across supported security platforms.
For healthcare providers, the value lies in having security analysts investigate suspicious activity, maintain investigation records and coordinate with internal IT teams when action is needed.
Before engaging any managed SOC, hospitals should establish four things:
- which systems it will monitor
- which logs it can access
- what evidence it will retain
- how quickly those records can be retrieved during an investigation or assessment.
The aim is to make incident evidence part of everyday security operations, not a scramble that begins when someone asks to see it.
Next Steps
Before your next assessment, select one recently closed security incident and request its complete evidence trail from your IT team and managed SOC. Set a deadline for retrieving the records.
Check for missing timestamps, incomplete investigation findings and delays in obtaining vendor logs. Assign owners to close those gaps and repeat the exercise after remediation.
If your hospital lacks the monitoring coverage or resources to maintain reliable incident records, DC Technologies can help assess your existing setup and identify where managed SOC support could improve visibility and evidence collection.
FAQs
What is the difference between ADHICS V2 and NABIDH?
ADHICS V2 sets healthcare cybersecurity requirements for entities in Abu Dhabi. NABIDH is Dubai’s health information exchange, with policies covering secure data sharing, access auditing and related security requirements.
What evidence do hospitals need for ADHICS V2 compliance?
Hospitals should maintain relevant access logs, security monitoring records, incident investigation findings, response actions and evidence of control reviews, as required by their applicable ADHICS V2 controls.
How long must NABIDH audit logs be retained?
The DHA NABIDH Audit Policy specifies a three-year retention period for relevant audit logs. It also requires regular reviews at least quarterly, with anomalies and corrective actions documented.
What should hospitals prepare for a cybersecurity compliance audit?
Hospitals should be able to produce relevant access logs, security event records, incident timelines, investigation findings and evidence of corrective actions. They should also know where records are stored and who can retrieve them.
Can a managed SOC help with ADHICS V2 and NABIDH compliance?
Yes. A managed SOC can support compliance through security monitoring, incident investigation, log correlation and response documentation. The hospital remains responsible for meeting its regulatory obligations.
How can hospitals in Abu Dhabi and Dubai manage both ADHICS V2 and NABIDH requirements?
Healthcare groups can centralize monitoring and evidence management while mapping records to each facility’s applicable requirements. They must still follow the relevant retention, reporting and regulatory obligations in each emirate.
