Dubai Health Authority — health information, data protection and NABIDH policies and the NABIDH Information Security Standard,
chapter by chapter

AI Policy ss 4.6-4.9Artificial intelligence

Facilities using AI must follow ICT Health Law, report AI incidents to DHA, and provide feedback on adverse events promptly.

EMR Transition Guideline ss 6-9EMR transition

EMR transitions must include comprehensive data management and retention measures, ensuring no records are destroyed before the retention timeline.

Genomic Data Standard ss 5, 10, 11Genetic and genomic data

Genetic and genomic data must be securely retained as per UAE laws, with access requests fulfilled within 30 days.

Health Data Classification Policy ss 4.8-4.15Health data classification

Health information assets must be classified by value and retained for 25 years, shared only with consent or lawful basis under ICT Health Law.

Health Data Quality Policy ss 4.6-4.9Health data quality

Entities must record Emirates ID and mandatory data, meet DHA clinical dataset criteria, and standardize data entry fields, reviewing data policies biennially.

Health Data Sharing Policy PP-13 s 4Data sharing

Data sharing agreements require registration by the Information Governance team and recording in the Information Asset Register, ensuring access is limited to legitimate staff.

Health Information Assets Management Policy ss 4.4-4.7; Closure Standard s 6Health information retention

Health information must be retained for 25 years, with digital conversion required and a custodian appointed if the facility closes or merges.

Health Information Consent Standard ss 8-14Consent and access control

Managers must report role changes affecting access permissions, and consent for data sharing requires parental approval for minors.

Health Tourism Data Policy ss 4.3Health tourism data

Eligible health tourism facilities must designate a lead to collect and submit health tourism data approved by the Health Tourism Department.

NABIDH Audit, Identity and Authentication PoliciesNABIDH audit and identity

Facilities must retain NABIDH audit logs for 3 years, notify NABIDH 2 days before access revocation, and report terminations for health information misuse.

Psychotherapy Notes Standard ss 10Psychotherapy notes

Psychotherapy notes must be retained for at least 25 years, securely managed, and records of deceased patients should be made inactive after five years.

Health Information Assets Policy s 4.6.1-retRecord Retention — Health information assets (medical records)

Health information assets must be retained for at least 25 years from the last health procedure or encounter.

Psychotherapy Notes Standard s 10.3-retRecord Retention — Psychotherapy notes

Psychotherapy notes must be retained for at least 25 years after the last encounter.

NABIDH Audit Policy s 3.2.11-retRecord Retention — NABIDH audit logs

NABIDH audit logs must be retained for three years from the date of log entry.

HISS s 5-6 (Table 2)Control levels and onboarding

Facilities must achieve at least the Essential level in all HISS domains for NABIDH onboarding; high-risk facilities require Enhanced level compliance.

HISS s 6.1.2 (Table 8)Information security policy

Facilities must maintain and annually update an information security policy that meets HISS minimum requirements.

HISS s 6.1.3 (Tables 10-12)Asset management and disposal

Facilities must maintain an inventory of information assets, record authorized recipients, and initiate disposal after the retention period.

HISS s 6.1.5, s 6.1.7Third parties and cloud

Agreements with third parties must allow facility audits, and cloud services require a formal security policy.

HISS s 6.1.6 (Tables 22-24)Operations security: backups and patching

Facilities must back up data as per approved standards, validate backups, apply patches, and manage system changes and logs.

HISS s 6.1.8 (Tables 25-27)Access control and passwords

Facilities must control user access, enforce password policies, lock accounts after failed logins, and maintain audit trails.

HISS s 6.1.10 (Tables 31-33)Security incident management

Facilities must maintain incident procedures, notify affected parties, and report significant security incidents to NABIDH.

HISS s 6.1.11 (Tables 34-36)Business continuity

Facilities must incorporate information security into business continuity and disaster recovery plans and conduct regular testing.