What Is ADHICS and Who Must Comply?
ADHICS (Abu Dhabi Healthcare Information and Cyber Security) is a mandatory cybersecurity framework established by the Abu Dhabi Department of Health (DoH) for all healthcare entities operating in the Emirate of Abu Dhabi. ADHICS compliance is required for hospitals, clinics, laboratories, pharmacies, health insurance providers, diagnostic centres, and any organisation processing patient health information in Abu Dhabi.
The ADHICS standard covers 12 security domains including access control, cryptography, network security, incident management, business continuity, and third-party risk management. It aligns with international standards (ISO 27001, NIST CSF) while adding Abu Dhabi-specific requirements for healthcare data protection, patient privacy, and cross-border data transfers.
ADHICS v2.0 — Key Requirements and Control Domains
ADHICS v2.0 introduced enhanced requirements for cloud security, medical device cybersecurity, and telehealth platform security. The framework is structured across 12 control domains:
| Domain | Key Requirements | eShield Support |
|---|---|---|
| 1. Information Security Governance | Security policies, roles, responsibilities, CISO appointment | Policy development, vCISO services |
| 2. Risk Management | Risk assessment, risk treatment, risk register maintenance | Risk assessment workshops, risk register setup |
| 3. Asset Management | Asset inventory, classification, acceptable use policies | Asset discovery, classification framework |
| 4. Access Control | Identity management, MFA, privileged access, access reviews | IAM audit, PAM implementation |
| 5. Cryptography & Encryption | Data encryption at rest and in transit, key management, PKI | Encryption assessment, key management review |
| 6. Network Security | Network segmentation, firewall rules, IDS/IPS, wireless security | Network architecture review, firewall audit |
| 7. Application Security | Secure SDLC, code review, application testing, API security | Application security audit, VAPT |
| 8. Endpoint Security | EDR, patch management, mobile device management, medical device security | Endpoint assessment, MDM review |
| 9. Incident Management | Incident response plan, DoH reporting, forensic readiness | IRP development, tabletop exercises |
| 10. Business Continuity | BCP, DRP, backup procedures, recovery testing | BCP development, DR testing |
| 11. Third-Party Security | Vendor risk assessment, SLA security requirements, supply chain | TPRM framework, vendor assessments |
| 12. Cloud & Telehealth Security | Cloud configuration, telehealth platform security, data residency | Cloud security assessment, telehealth audit |
ADHICS Compliance Cost in UAE — 2026 Pricing
ADHICS compliance costs depend on organisation size, current security maturity, and the scope of healthcare services. eShield provides fixed-price ADHICS compliance packages:
| Entity Type | Scope | Timeline | Cost (AED) |
|---|---|---|---|
| Small Clinic / Pharmacy | Gap assessment + remediation | 2–3 months | 25,000–40,000 |
| Mid-size Hospital / Lab | Full 12-domain compliance | 4–6 months | 50,000–90,000 |
| Large Hospital Group | Multi-facility programme | 6–9 months | 100,000–200,000 |
| Health Insurance Provider | ADHICS + data privacy | 3–5 months | 40,000–80,000 |
ADHICS Penetration Testing Requirements
ADHICS requires healthcare entities to conduct regular penetration testing as part of Domain 7 (Application Security) and Domain 6 (Network Security). The standard mandates:
- Annual penetration testing of all internet-facing systems including patient portals, appointment systems, and telehealth platforms
- Vulnerability assessments at least quarterly for critical healthcare systems including HIS, LIS, RIS, and PACS
- Medical device security testing for networked medical devices (IoMT) — a requirement introduced in ADHICS v2.0
- Wireless security assessment of hospital WiFi networks, especially in areas with medical devices
eShield provides ADHICS-specific penetration testing with reports formatted to satisfy DoH audit requirements. Our testers have direct experience with healthcare IT environments including HL7/FHIR interfaces, DICOM systems, and EHR platforms.
ADHICS Risk Assessment — Abu Dhabi Healthcare
An ADHICS risk assessment evaluates your healthcare organisation against all 12 ADHICS control domains, identifying gaps between current security posture and DoH requirements. eShield’s ADHICS risk assessment includes:
- Control-by-control gap analysis across all 12 ADHICS domains
- Risk scoring using a healthcare-specific risk matrix (likelihood × impact on patient safety)
- Prioritised remediation roadmap with quick wins (0–30 days), short-term (30–90 days), and strategic (90–180 days) actions
- Evidence collection guidance for DoH audit preparation
- Benchmark comparison against similar Abu Dhabi healthcare entities
ADHICS vs ISO 27001 vs NESA — Which Do You Need?
| Aspect | ADHICS | ISO 27001 | NESA IAS |
|---|---|---|---|
| Applicability | Abu Dhabi healthcare only | Any organisation globally | UAE critical infrastructure |
| Mandatory? | Yes (Abu Dhabi DoH) | Voluntary (but often required by RFPs) | Yes (for designated entities) |
| Healthcare-specific? | Yes — medical devices, EHR, telehealth | No — generic ISMS | No — general critical infra |
| Certification body | Abu Dhabi DoH assessment | Accredited CB (BSI, SGS, etc.) | UAE government assessment |
Many Abu Dhabi hospitals pursue both ADHICS and ISO 27001 simultaneously. eShield offers combined implementation programmes that satisfy both frameworks with a single set of policies and controls, reducing duplication and cost by up to 30%.
eShield IT — ADHICS Compliance Services
eShield IT Services provides end-to-end ADHICS compliance for Abu Dhabi healthcare organisations:
- ADHICS Gap Assessment: Control-by-control evaluation across all 12 domains with risk-rated findings
- ADHICS Implementation: Policy development, technical control deployment, staff training, and evidence preparation
- ADHICS Penetration Testing: Annual pentest of patient portals, EHR systems, medical devices, and hospital networks
- ADHICS Audit Preparation: Pre-audit readiness review, evidence compilation, and mock audit walkthrough
- Ongoing ADHICS Maintenance: Quarterly vulnerability scans, policy updates, and continuous compliance monitoring
Our team has direct experience with Abu Dhabi healthcare IT environments including Cerner, Epic, and Meditech EHR systems, HL7/FHIR interfaces, and PACS/DICOM imaging systems.
Ready to achieve ADHICS compliance? Get a free ADHICS gap assessment consultation or call us at +971 585 778 145.
