ADHICS compliance doesn’t end when you pass an assessment. The real work is keeping those controls working afterwards.
For healthcare organizations in Abu Dhabi, that means understanding which ADHICS requirements apply, how those requirements are implemented and what evidence demonstrates that the controls are working.
Some ADHICS requirements are about policies and governance. Others need someone actively monitoring, maintaining and testing them. Something which a dedicated managed security team can take care of.
This guide explains the main ADHICS security requirements, how to prepare for a compliance assessment, what evidence to maintain and where managed detection and response (MDR) can support ongoing security operations.
TL; DR
- ADHICS applicability: First, establish which ADHICS V2 controls apply to your healthcare facility and operations in Abu Dhabi.
- Security requirements: ADHICS V2 covers everything from access control and asset management to incident response and security monitoring.
- Compliance assessment: Map the applicable controls, identify gaps and gather evidence that each requirement is being met.
- Ongoing security: Keep access reviews, vulnerability management, logging and incident response on track between assessments.
- MDR support: DC Technologies’ UAE-based SOC can help monitor threats and investigate incidents. Your organization remains responsible for ADHICS compliance.
What is ADHICS and Who Needs to Comply?
ADHICS stands for Abu Dhabi Healthcare Information and Cyber Security Standard. It is issued by the Department of Health (DoH) Abu Dhabi to protect healthcare information and strengthen cybersecurity across the emirate’s healthcare sector.
The standard covers healthcare entities that generate, access, store, use, process or transmit health information. Its scope extends to the relevant applications, medical devices, infrastructure and third-party systems supporting those activities.
ADHICS is mandatory for applicable public and private healthcare entities in Abu Dhabi.
However, organizations are not all assessed against an identical set of controls. DoH uses control categories that reflect the type of entity and the level of requirements applicable to it.
Which ADHICS Control Categories Apply to Your Organization?
DoH identifies Basic, Transitional and Advanced control categories, alongside a Service Provider category for applicable healthcare technology and service providers. The relevant requirements depend on the organization’s classification and the applicable DoH guidance.
Hospitals with 21 or more beds and relevant payers, as specified by DoH.
Applicable healthcare technology and service providers within the standard’s defined scope.
These categories reflect DoH’s published applicability guidance. Organisations should verify their specific requirements against the current ADHICS V2 standard and relevant DoH documentation.
For example, a hospital expanding from 20 to 21 beds should review whether its control obligations change.
That could affect the security measures, monitoring processes and supporting evidence the organization needs to maintain.
Before implementing individual controls or preparing for an assessment, confirm which ADHICS requirements apply to your facility.
Refer to the official DoH AAMEN resources and ADHICS V2 Implementation Guidelines for the relevant requirements.
What Are the Main ADHICS V2 Security Requirements?
ADHICS covers multiple security domains, ranging from governance and human resource security to access control, operations, communications, incident management and continuity.
For most healthcare organizations, the requirements fall into several practical areas.
The table below connects these areas to examples of evidence that may help demonstrate implementation. The examples are illustrative, not a universal official audit checklist. The exact evidence required depends on the applicable ADHICS V2 controls.
ADHICS area
Define who owns security, how risks are managed and how security decisions are overseen.
Approved policies, risk assessments and review records.
Build security into hiring, onboarding, employee responsibilities and offboarding.
Training records, documented responsibilities and access removal records.
Know what hardware, software, systems and information assets you have, where they are and how they are classified.
Asset inventories, classifications and ownership records.
Control physical access to facilities, equipment and areas where sensitive systems or information are handled.
Access logs, authorization records and physical security procedures.
Ensure users have appropriate permissions and privileged access is controlled and reviewed.
Access review records, account changes and privileged-login logs.
Protect sensitive information through appropriate encryption and key-management controls.
Encryption configurations and key-management procedures.
Secure networks and the exchange of information between systems, users and healthcare entities.
Network configurations, security rules and relevant monitoring records.
Build security into procurement, development, changes, testing and maintenance of information systems.
Change records, security reviews and testing results.
Assess suppliers and define security responsibilities when external parties access or handle healthcare information.
Vendor assessments, access approvals, and contractual security requirements.
Maintain malware protection, vulnerability management, backups, logging, and monitoring.
Vulnerability scans, patch records, backup reports and monitoring records.
Detect, analyze, contain, and recover from security incidents using defined processes.
Incident tickets, timelines, escalation records, and investigation findings.
Maintain the processes and capabilities needed to recover relevant systems and services.
Recovery plans, backup test results, and records of recovery exercises, where applicable.
These are illustrative examples of assessment evidence, not a universal ADHICS audit checklist. Required evidence depends on the applicable controls.
These areas are connected.
For example, a vulnerability assessment may identify an outdated server. The asset inventory should identify its owner, the vulnerability management process should track the issue, and the change-management process should document how it was resolved.
Similarly, a supplier may have legitimate access to a clinical application. Third-party security requirements establish the supplier’s responsibilities, while access controls determine what the supplier can access.
These connections matter because an individual security policy or product cannot demonstrate that the entire process is functioning.
The organization needs to show that the relevant controls have been implemented and maintained.
How to Prepare for an ADHICS V2 Compliance Assessment?
Preparing for an ADHICS V2 assessment involves more than checking whether your organization has the required policies in place. You need to know which controls apply to you, how they work in practice and whether you can show evidence of them when asked.
Here’s how to approach the preparation.
1. Start With the Requirements That Apply to You
Before reviewing your security controls, confirm your organization’s ADHICS V2 category and assessment scope. The requirements can differ depending on the type of healthcare entity, so a generic checklist may leave important gaps.
Use the current DoH standard and implementation guidelines to establish exactly what you need to meet.
2. Check What You Already Have in Place
Go through the applicable controls and compare them with your existing policies, processes and technical safeguards.
Some requirements may already be covered. Others might only be partially implemented, or depend on a process that nobody regularly reviews. Document these differences so your team knows what needs attention before the assessment.
3. Make Sure You Can Prove It
Having a control in place is one thing. Being able to demonstrate that it works is another.
For example, if access is reviewed regularly, can you produce the review records? If your team manages vulnerabilities, do you have scan results and remediation records? Can you show that backups have been tested or that security incidents were investigated and escalated appropriately?
Check these records early. Chasing evidence across IT teams, application owners and third-party providers can take longer than expected.
4. Give Every Gap an Owner
Once you know what’s missing, decide what needs fixing first. Assign each gap to someone responsible for resolving it, set a deadline and document the action required.
Priorities should reflect the applicable control requirements and the risk involved. Keep track of progress, too. A list of gaps is only useful if your team can show what has been done about them.
5. Check That the Fixes Hold Up
Before the assessment, verify that corrective actions have actually addressed the gaps. Make sure the supporting evidence is available and that someone is responsible for maintaining each control.
Access control
User access reviews, privileged-login records and account removal logs
Asset management
Updated inventories of systems, applications and relevant medical devices
Vulnerability management
Vulnerability assessment reports, remediation tickets and verification results
Security monitoring
Security event logs, investigation records and monitoring reports
Incident management
Incident reports, investigation timelines, escalation and containment records
Backup and recovery
Backup reports, restoration tests and recovery procedures
Third-party security
Vendor assessments, access approvals and documented security responsibilities
These are illustrative examples. The exact evidence required depends on the applicable ADHICS controls and the assessment scope.
The aim is to know where you stand at any point in the year, rather than discovering gaps or scrambling to find evidence when the assessment is around the corner.
How Can MDR Support ADHICS V2 Compliance?
A suspicious login appears in the hospital’s security logs at midnight. The account belongs to a staff member, but the login pattern looks unusual. Was it the employee, a compromised account or someone accessing the system through stolen credentials?
Investigating that question takes more than an alert. Someone needs to trace the activity, check related events and establish what happened.
This is where Managed Detection and Response (MDR) can support a healthcare organization’s ADHICS V2 requirements. Depending on the agreed scope, an MDR provider can help with:
- Monitoring and investigation: Reviewing security events across covered systems and connecting activity that might otherwise look unrelated.
- Incident escalation: Notifying the right people and supporting containment when a threat is identified.
- Investigation records: Documenting findings, timelines and response actions that may support compliance evidence.
There are limits to what the provider can see. If the investigation points to unauthorized access to an electronic health record (EHR), endpoint and identity logs may reveal how the account was used. Confirming which patient records were viewed may require separate audit logs from the EHR system.
That distinction matters when preparing for an ADHICS assessment. An MDR provider can help investigate and document security incidents, but the hospital still needs access to the relevant system records and evidence that applicable controls are being maintained.
Next Steps: How DC Technologies Can Support ADHICS Security Operations
Start by identifying the ADHICS controls your healthcare organization struggles to maintain consistently, particularly security monitoring, incident investigation and response documentation.
If your internal IT team lacks the capacity to manage these activities around the clock, DC Technologies can help.
Our in-house, UAE-based SOC provides 24/7 monitoring, threat investigation and incident response support across your existing security environment.
We work with your IT team to define monitoring coverage, establish escalation procedures and maintain incident records that support your security and assessment requirements.
Talk to DC Technologies about your ADHICS security monitoring needs.
FAQs
Is ADHICS mandatory for private hospitals in Abu Dhabi?
What happens if a healthcare organization does not comply with ADHICS?
How do I prepare my organization for an ADHICS assessment?
How often does ADHICS compliance need to be reviewed?
ADHICS requires ongoing compliance monitoring rather than a one-time review. Organizations should periodically assess their controls and update their compliance status as required by the Department of Health.
Can ADHICS compliance be outsourced to a managed security provider?
Specific security activities can be supported by an external provider, but the healthcare organization remains accountable for its ADHICS compliance and security responsibilities.
How can MDR help with ADHICS compliance?
MDR can support the continuous monitoring, alert investigation and incident response activities that sit within ADHICS. DC Technologies provides MDR support to help healthcare organizations maintain this operational layer.
