ADHICS Compliance Consulting & Audit Services In UAE

What are the Requirement of ADHICS?

ADHICS states that healthcare services cannot use cloud infrastructure for storing, sharing, or processing patient information unless it is stored within the UAE. It’s also mandatory for healthcare entities to identify and disconnect system integration where, storage or use of health information occurs with systems that use or connect to cloud services that have remote servers outside the UAE; they can only share health information with partners and other third parties with express DoH authorization. The cyber security and healthcare information requirements have set standards for:

• 1. Asset Management – policies regarding classification, labeling, handling, and disposal of assets
• 2. Access Control – policies regarding user access, network access, devices and equipment, OS access, app and information access controls
• 3. HR Security – policies regarding recruitment, employment, and termination
• 4. Physical and Environmental Security
• 5. Communications, Health Information, and Security
• 6. Operations Management – policies regarding operational procedures, malware protection, planning and acceptance, backup and archiving, monitoring and logging, and assessing security and managing vulnerability
• 7. Third-Party Security – policies for the delivery and monitoring of third-party security
• 8. Acquiring, Developing and Maintaining Health Information systems – policies for IS and system file security requirements, supply chain management, software outsourcing, cryptographic controls, etc.
• 9. Information Security Incident Management – policies to improve and manage incidents, and report on weaknesses and events
• 10. Information Security Continuity Management – policy for planning continuity