ADHICS is the mandatory information and cyber security standard for healthcare in Abu Dhabi. Here is what it expects, who it applies to, and how security testing delivers the audit evidence.
ADHICS — the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health — is mandatory for healthcare providers, insurers and their service partners operating in Abu Dhabi. It defines controls across governance, human resources, asset management, access control and — crucially — technical security, and it expects those controls to be demonstrated, not just documented. ADHICS compliance is checked through audits, and evidence of security testing is one of the strongest artefacts you can put on the table.
The standard requires organisations to identify technical vulnerabilities and to verify that controls actually work. In practice that means periodic vulnerability assessment and penetration testing (VAPT) of the systems that process health information — patient portals, EMR integrations, internal networks — plus remediation and retesting. Reports should map findings to the ADHICS control set, so your auditor can trace evidence directly.
The practical route to ADHICS compliance evidence:
The full standard is published by the Department of Health Abu Dhabi. For how ADHICS sits next to the other UAE frameworks, see our UAE cybersecurity compliance guide.
ADHICS stands for the Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health Abu Dhabi.
Yes — for licensed healthcare providers, insurers and their service partners operating in Abu Dhabi.
The standard requires organisations to identify technical vulnerabilities and verify controls, which in practice means periodic VAPT with remediation and retesting.
At least annually, and after significant changes to systems that process health information.
Next step
Book a free 30-minute strategy call. You get clarity on scope, approach and a fixed price — no obligations.