The new Dubai Day Surgery Centre fit-out was completed in August. The owner submitted all the documents through Sheryan, DHA’s licensing portal, and received an inactive licence. The team is set to receive the final inspection and will open in October.
It is not possible to activate for two reasons. While the EMR vendor has stated that connectivity with NABIDH is possible, they failed to send an email with an approved connection as per the licensing manual. The overseas developer of the patient booking app has data located in a cloud region outside the UAE, the company said.
Neither of these problems requires a doctor, a bed or a scalpel. This is perfectly legal under the licence.
The above text is the abbreviated version. The dubai health authority regulations apply to healthcare professionals in the emirate of Dubai, including those operating in special development zones, free zones and DIFC. Federal law renders all three null and void, dictating that health data remain in the UAE and be kept for 25 years. But the licence now includes expanded digital responsibilities: operators must have a NABIDH-compliant EMR before activating it, must apply security standards before going live, and must report any breach to DHA within 24 to 48 hours.
This combination catches teams off guard, as the emphasis is on the clinical paperwork, and the IT conditions sneak up behind the deadline.
In this guide, we will discover more about DHA, facility licensing, the requirements of the hospital standards, the health information policies, the federal health data law, the security standards of NABIDH, application security testing, reporting a breach and a road map to tie it all together. This guide is for owners, medical directors, compliance leads and CISOs at Dubai facilities and for health-tech vendors who are creating for them.
Who DHA Regulates and Where Its Authority Comes From
Begin with jurisdiction, as the UAE is home to three healthcare regulators, with a lot of published advice muddling them.
In Dubai, the Dubai Health Authority (DHA) regulates all healthcare facilities and healthcare professionals in the emirate of Dubai, even those in special development zones, free zones and DIFC. The Department of Health in Abu Dhabi governs the facilities in Abu Dhabi, while the Federal Ministry of Health and Prevention (MOHAP) governs federal facilities and the northern emirates.
DHA’s Legal Authority and Regulatory Scope Across Dubai Healthcare Facilities
The existing mandate of the DHA was determined through Executive Council Resolution No. 49 of 2024 dated 9th of September, 2024. It supersedes Resolution No. 32 of 2012 and did four things that are relevant here:
It extended DHA’s coverage to all establishments in Dubai, including free zones and DIFC.
It applied to all healthcare professionals, except those working for federal government entities.
The DHA did not allow any facility or professional to provide any service without a permit; the DHA awards licences for one year and renews them.
Enforcement has bite. The DHA processes complaints, carries out clinical audits, issues referrals to the Medical Practice Committee and can close a health care facility or suspend a practitioner for up to three months while investigations are underway. At least a fine is more economical for a clinic than three months of shutdown.
Dubai is constantly developing more tools for the solution. The DHA’s laws page includes law No. 5 of 2025 on Public Health in Dubai and federal laws such as the decree establishing standards of national service for emergency services, endoscopy and sleep labs.
Warning for Abu Dhabi. It is not the DoH’s standard but rather the standard of ADHICS. Pairs of running hospitals, in both emirates, are subject to the rule of the DHA in Dubai and the ADHICS in Abu Dhabi. “Tips” that attempt to merge the two are typically incorrect.
You must abide by the DHA rules regardless of where your company is registered if you treat patients in Dubai.
Dubai Health Authority Requirements for Licensing a Facility
All obligations in this guide go to licensing, so it is important to have the sequence in mind.
The clear answer: a facility applies through Sheryan, acquires an inactive licence, completes a final inspection that includes health IT assessments, activates it, and then renews it every one to three years. The Manual for Licensing Health Facility (DHA/HRS/HLD/MA-1, version 1.2, effective 30 September 2026) outlines the complete framework.
Step-by-Step DHA Facility Licensing, Inspection, and Activation Process
The stages run like this:
Apply on Sheryan. DHA does not accept manual or email applications (sections 5.12 and 6.6.1). All documents, fees and approvals are made via the portal.
Get an inactive licence. It remains valid for one year, and until DHA activates it, the facility cannot see patients, provide services or advertise (6.7.8, 6.7.9).
Final inspection passed. The following items are contained in the EMR that satisfy the Minimum Data Set for NABIDH (7.2.1-7.2.6), as well as the approval email for tested NABIDH connectivity (7.2.6.10). The centre we introduced in our introduction did not meet this condition.
Turn on. When DHA activates the facility licence (7.2.5.b), it automatically activates the linked professional licences.
Renew. All fines will need to be settled before renewals (which can be 1, 2 or 3 years) and are available 3 months before the date of renewal (7.6, 8.3, 8.4, 8.9.2). Miss expiry date (6 months) Manual points to penalty and cancellation (8.6)
If the data is closed, the rule of data is also closed. The 25-year retention period exceeds the business’s lifespan, and cancelling the licence requires clearance from health informatics in accordance with the Standards for Health Information Assets Management During Healthcare Facility Closure (18.7).
Highlight the change(s) in this manual. The Dubai Health Authority requirements are not a hindrance to the health IT licence but rather a future project. If it’s not an easygoing EMR in month one, it could be a blocker for activation in month nine.
Therefore, before signing any contract with any EMR or app vendor, be sure to read the health authority’s requirements for your type of facility and include the NABIDH connectivity evidence in the contract.
Secure Your Business with a Expert-Led Security Assessment
Partner with certified security specialists to identify, prioritize, and remediate real-world risks across your systems.
DHA Guidelines for Hospitals: Service Standards and What They Ask of IT
A service standard sets the requirement for each type of facility, although the heavy lift bar is set low for hospitals.
In short, the DHA guidelines for hospitals define scope of service, staffing, governance and quality responsibilities by hospital type. They now include data security in the hospital’s liabilities. The latest of these are the Standards for Speciality Hospitals (DHA/HRS/HPSD/ST-70) issued on 31st December 2025, which will come into force on 30th June 2026.
DHA Hospital Service Standards: Key IT, Data Security, and NABIDH Compliance Requirements
For ST-70, these documents get pretty specific and outline the headline rules:
A speciality hospital may have at most a maximum of two core specialities and a minimum of ten inpatient beds and operates on a 24-hour basis to provide inpatient services;
Accredited by an ISQua-approved institution within 2 years of being licensed (5.8);
Maintain an annual report to DHA on KPIs (16.2);
Has a mandatory list of written policies (5.10).
Care should be taken with the IT clauses. The hospital must register with NABIDH and maintain the integration (15.1). I should implement electronic health systems that are compatible with NABIDH (15.2). The hospital shall have data backed up (16.3.4). There is no doubt. Clause 15.3 says, “Hospital shall be responsible for ensuring the integrity and security of patient data at all times.” Clause 15.6.7 includes compliance with federal law on health data, cybercrime and offshore storage.
In 15.3, I finally got one that puts an end to an argument I’ve heard in many vendor negotiations. The DHA requirements for hospitals are to be responsible for the data security, NOT the EMR vendor, the cloud provider or the integrator. No organisation can outsource a system and avoid responsibility for it.
In addition, ST-70 mentions the standards that are read concurrently at the hospital: the UAE Standards for General Hospitals (Ministerial Decree No. 174 of 2024), the DHA Standards for Telehealth Services, Sentinel Events Notification and Management, Diagnostic Imaging, Clinical Laboratory, the Outpatient Standard and the Health Facility Guidelines.
Map each of the services onto its normal level and then give the IT clauses to your system owner.
DHA Policies and Procedures for Health Information
Policymakers, rather than operational managers, set the service standards, which cover health information itself and apply to many more organisations than most people realise.
What is the one-word answer? The DHA policies and procedures for health data are anchored in the Policy for Health Data and Information Sharing (DHA/HISHD/PP-13) issued 10 August 2024 and which will be active from 10 November 2024. (3.1–3.3) DHA applies this policy to all entities it regulates and all users of protected health information (PHI), including vendors and insurers.
PP-13 makes privacy principles into duties that are quantifiable and provable:
Requirement
PP-13 section
Register every data sharing agreement (DSA) with Information Governance and record it in the Information Asset Register
4.5.1, 4.5.2
Share only the minimum necessary PHI
4.5.5
Run a data protection impact assessment (DPIA) before any DSA
4.21.5
Include 13 defined elements in each DSA, security controls and incident response among them
4.21.3
Obtain consent before collection and before any sharing outside care, under the Consent and Access Control Policy
4.3.1, 4.3.2
Enforce role-based access with monitoring and audits
4.5.3
Encrypt PHI in transit; send it by encrypted or portal-based email only
4.19.6, 4.10.1
Use processors that give “sufficient guarantees” of security
4.19.1 to 4.19.3
Keep live PHI out of system testing
4.18.1
Keep PHI-sharing logs for six years after the DSA ends
4.23.7
Report breaches to the UAE Information Office and DHA within 24 to 48 hours
4.23.4(d)
Transfer PHI across borders only under Cabinet Decision No. 51 of 2021 exemptions, with DHA approval
4.20
Three submissions are changing how vendors are treated. With the DSA register, the DHA can reference each piece of data that goes to an EMR host, analytics company or insurer. The “sufficient guarantees” test demands a facility to check a processor’s security and not to presume it. And the Six Year Log Rule extends the life of the evidence beyond the contract.
The two supporting documents are the Health Data Classification Policy (2022) that rates the sensitivity of the data and the Consent and Access Control Policy that PP-13 is based on. Your service standard is in addition to the required policy list.
View the DHA policies and procedures as a records regime. You can expect an inspector to call out for the following documents specifically: DSA, DPIA, consent forms and logs.
Federal Health Data Law: Localisation and 25-Year Retention
There is a federal law covering all DHA publications, and numerous cloud contracts are in breach of it.
However, Federal Law No. 2 of 2019 on the use of ICT in health fields is applicable across the entire UAE, even in free zones (MOJ text; Al Tamimi analysis). There are three rules for the design of the system:
The law prohibits anyone from storing, processing, or transferring any health data pertaining to healthcare services provided in the UAE outside the country, unless the law authorises it (Article 13);
Health records have a 25-year retention period;
All who handle the information are responsible for confidentiality and security.
The law was put into operation from November 2020 by Cabinet Resolution No. 32 of 2020. Health data could then be exported from the UAE, subject to Cabinet Decision No. 51 of 2021, which lists out the exceptions for the export. On top of them is PP-13 with DHA approval (4.20).
UAE Healthcare Data Residency Requirements for Cloud Storage and Cross-Border Transfers
The cloud and SaaS vendors have stark questions to answer in practice. What is the source of the main data? Where are backed-up copies created? And from which country does the support team open sessions in the system?
The last one always shocks people. Whether it is an architecture diagram or the data, a support engineer pulling records from overseas is a transfer, as is a log pipeline shipping PHI to an overseas monitoring tool. Add the region, replication map and support access route to the contract schedule and get the vendor to warrant all three.
Here our booking app from the introduction failed. The product worked. The clinic was very fond of it. The information was not in the correct country.
When drafting your policy, there is one important caution to note: the retention rule is in different article numbers for law firms, and so it would be wise to use the phrasing of the law and not the law firm’s summary. In addition, the personal data law at the federal level (Decree-Law No. 45 of 2021) entrusts to the sector rules like this one the regulation of data relating to the health sector.” It is a question of counsel, not IT.
In fact, Dubai healthcare data residency is not about infrastructure but about the legal requirement.
NABIDH Information Security Standards and Where DESC ISR Fits
NABIDH is DHA’s health information exchange, and it has its own rulebook, and is the most concrete of all security writing that a Dubai provider will ever encounter.
The answer is simple: There are 17 control domains in the NABIDH Information Security Standards (v1.0, September 2020) with 3 maturity levels. To be eligible to join NABIDH (section 5), all organizations have to be at least at the “Essential” tier. The standards apply to providers integrated with NABIDH, but not necessarily to them (3.2). Risk management is required in HISS (3.1). The standards apply to PHI in all locations (2.1). They also consider health information to be at least “Shared-Sensitive” in accordance with Dubai Law No. 26 of 2015 (2.3).
The 17 domains (6.1) sound like a complete security program:
The three levels are a ladder. The condition to enter is required when enrolling. Intermediary provides depth, e.g., vulnerability assessments as part of Incident Management (6.1.10). It is assessed in Enhanced, which requires “penetration tests and vulnerability assessments” (6.1.8). The small clinic mounts itself on the same steps as the tertiary hospital, but from different floors.
The testing language punishes any excuse and prefers exact quotation. Audit and Compliance (6.1) includes the requirements “penetration (vulnerability) testing and disaster recovery testing” (6.1.12) at the Essential tier. Organizations must subject new systems to security requirements during acceptance testing (6.1.9), allow suppliers to conduct audits (6.1.6, 6.1.14), and report significant incidents to NABIDH (6.1.10).
Read from a chair in a little clinic. Pen testing seems to be the easiest step to take before hiring someone. There’s no size too small in this document. The standards were never intended to specify a frequency. They state “ regular”, and the facility records its own interval.
At times, a separate Dubai regime involves this. DESC’s Information Security Regulation (ISR) covers the Dubai government entities, including DHA-owned facilities, and private providers fall under the ISR regime, predominantly through contracts. Our DESC ISR penetration testing guide is devoted to that regime alone.
Each participant’s floor is the NABIDH’s essential tier, and testing is already on the floor.
Healthcare Application Security Testing for DHA-Licensed Providers
All of those documents lead to one operational question: what to test – and when?
The clear answer is: Healthcare application security testing for a Dubai provider goes with the data. Evaluate each application or interface that creates, stores or transmits PHI for the specific behaviours outlined in PP-13 and NABIDH standards. Typically, the scope will encompass:
Patient portals and mobile apps: consent checks, access control, session management;
Authorisation and Minimum Necessary Data (MND) for HL7 and FHIR APIs and NABIDH interface;
Platforms for telehealth encrypt data during transmission and securely store recordings;
Laboratory system integration and EMR;
Error messages, logs and exports with PHI exposure;
The region and the configuration of the cloud, in contravention of Article 13;
NABIDH domain 16, related biomedical devices connected by wires;
Access pathways from third parties and vendors as described under PP-13 4.19.
It’s a licence cycle timing. Test before you sign up to NABIDH and before you activate your licence; test again after some major changes to the licence; and test at a regular interval you set and record – the standards say “regular” but don’t specify a number. At least once a year, after changes, and we consider that to be practice, not a DHA rule.
The only restriction on the method is that live PHI is not allowed in test environments (PP-13 (4.18.1)). Fortunately, healthcare application security testing takes place in a non-production environment using synthetic patients. This approach is exactly the way that the example below functions.
Code example: consent and PHI-leak checks on a patient records API
This simple mock FHIR API uses FLASK to implement two versions of the same API endpoint, one vulnerable and one fixed, for testing purposes. It directly tests three of the above rules: it is one of the behaviours.
If the patient’s consent contains the requesting facility (PP-13 4.3), will the API return a record? Are error responses free of PHI, too? And does the service deny plain HTTP (PP-13 4.19.6)? These 2 files ran on python (3.13) and flask (3).
Real output from both builds:
The vulnerable build lacks a record of consent on file, exposes all the synthetic patients through a single misconfigured 404 message, and allows unencrypted traffic. The fixed build rejects all three. Someone did not write the leak intentionally; a human error message simply revealed useful information.
Know the limits: This is a fake API with fake patients. This is not a comprehensive test for the safety of the application, but rather for behavioural responses on 3 paths. Organizations must obtain written authorisation, develop a comprehensive test plan, and use a non-production environment for real testing.
Test the paths your connectivity tests never touch, because that’s where inspectors and attackers both look.
Breach and Incident Obligations: Who to Tell and When
When something goes wrong, several clocks start at once, and they don’t all run to the same deadline.
Trigger
Report to
Timing
Source
Unauthorised PHI sharing or a breach
UAE Information Office and DHA (datacompliance@dha.gov.ae)
Within 24 to 48 hours
PP-13 4.23.4(d), 4.25.2
Significant security incident at a NABIDH participant
NABIDH
“As quickly as possible”
NABIDH ISS 6.1.10
Sentinel event
DHA
Per the Sentinel Events standard; check its current timeline
DHA Standards for Sentinel Events Notification and Management
The deadline is as crucial as the report itself. PP-13 requires an immediate investigation (4.23.4(a)) and sanctions for staff and vendors who breach the policy. The six-year log rule (4.23.7) requires that you have a lot of evidence beyond the incident closure.
The first hour is a duet between two parties. The 24- to 48-hour clock begins at the discovery stage and never at the root cause; as such, you report what you know and update later. The duty covers not only hacking but also unauthorised sharing.
Know in advance who will write, approve, and send the notice – with a constable for each! If you find the breach on a Friday night, the clock still runs for 24-48 hours.
Create a breach playbook that lists all notification deadlines, assigns a responsible person to send each notice, and includes regular practice exercises.
A Compliance Roadmap for Dubai Providers
The above documents, when combined into one sequence, form a sequence that a facility can actually execute.
Correlate each service offered to the DHA service standard.
Test and confirm your EMR meets the NABIDH Minimum Data Set and that your EMR has the approval email for tested connectivity (Manual 7.2.4, 7.2.6.10).
Take advantage of NABIDH Essential before you join, and follow your way to Intermediary.
Take inventory of your PHI, classify it according to the Health Data Classification Policy and document all flows in the Information Asset Register.
Add a DSA and a DPIA to the end of each external data flow (PP-13 4.21).
Please ensure that UAE is hosting for all health data or document the Cabinet Decision 51 exemption with DHA approval.
Test applications, APIs and devices before and after go-live, and with each big change.
Create the breach plan by using the 24- to 48-hour clock.
Train staff not to touch PHI (PP-13 4.24.2).
Review policies on an annual basis (ISS 6.1.2) and prior to each licence renewal.
Steps 2, 3 and 7 decide your opening and renewal dates, so schedule them first, not last.
A note from our test team. One thing I wish these Dubai health apps would do better is get consent, not encryption. The app verifies that the user is logged in and provides him with any record he requests. No one asks if the patient has given consent to that place, to see it. The login only tells you who is requesting, not what they may be seeing.
When compliance is built into the licence process, not around it, it’s less of a scramble during renewal season.
How Qualysec Supports DHA-Licensed Providers
Qualysec is a penetration testing company specializing in this area and we have a consistent percentage of healthcare applications in our engagements.
For Dubai providers, however, we test the systems that this guide continues to point at: patient portals, mobile applications, FHIR and HL7 APIs, telehealth platforms and the cloud beneath them. Your inspector writes the report in the language of the engagement, and aligns the findings with NABIDH Information Security Standards domains and PP-13 responsibilities. We test in non-production systems using synthetic data, according to PP-13. We perform retests and issue an attestation letter following every engagement and after the fixes have been confirmed.
Not one thing we will say: DHA is not an accreditor or certifier of testing vendors and no company should be selling you “DHA certified” testing including us.
Case study: medical device and mobile app, tested to closure
In the late 2024/early 2025 timeframe, vTitan wanted to perform cybersecurity testing on their medical device, Accuflow Uro and the associated mobile application in compliance with FDA cybersecurity guidelines. These are the engagement items and results that Clutch reported, fixed, and retested in their verified review. It is not about DHA, but it’s a simple pattern: A regulated health product, a definite standard, and a closure from a retest, not an email.
That find, fix and verify loop is what a Dubai inspection wants to see on paper.
Prepare for Your Next Cybersecurity Audit with Qualysec
Choose a partner that helps you identify and fix real security risks before attackers do. We are here to help.
It has now linked digital compliance with the licence. A NABIDH-compliant EMR activates you, a breach clock will keep you honest for the next 24-48 hours, and the necessary security level gets you on board. The first ones look at health IT as a licence, the second look at health IT as an add-on, and the third look at dubai health authority regulations IT as an inspection.
The federal layer doesn’t relax either: data stays in the UAE and lives for 25 years, which outlives most vendors you’ll ever sign with.
Your turn is now up. Don’t wait until after your next renewal or go-live to do your application testing. This week, confirm the NABIDH status of your EMR and cloud region.
Primary call. Activation, onboarding and renewal all depend on systems that hold up. Talk to our team about healthcare application testing mapped to NABIDH and DHA policy requirements, with retests before your inspection.
1. What rules does the Dubai Health Authority set for healthcare providers?
A total of 4 layers. Executive Council Resolution No. 49 of 2024 contains all licensing information, and the manual for licensing places the service standards for each type of facility at the top of each section, including outpatient services and specialty hospital services. There are policies about health information (like PP-13, classification and consent). They must comply with the federal health data law that mandates connected providers to adhere to NABIDH policies and standards listed above.
2. Is penetration testing mandatory for DHA-licensed facilities?
NABIDH’s Information Security Standards include “penetration (vulnerability) testing” at the Essential level because connected providers cannot opt out of it. There is no DHA document that sets a requirement as to the frequency of testing. Select an appropriate interval, take note of it and report it.
3. Can a Dubai clinic store patient data on a cloud outside the UAE?
Generally, it cannot. UAE authorities allow organisations to store, process, or transfer health data outside the UAE only when they meet the authorisation requirements under Article 13 of Federal Law No. 2 of 2019. The exemptions are in Cabinet Decision No. 51 of 2021; PP-13 section 4.20. Thus, before entering into any cloud contract, check the region, backup and support access paths.
4. How quickly must a facility report a health data breach in Dubai?
According to PP-13 section 4.23.4(d) a facility shall report the breach of health data to the UAE Information Office and to DHA’s data compliance mailbox within 24 to 48 hours of discovery. The investigation begins right away, there are periodic updates as facts emerge and that NABIDH participants report serious security incidents to NABIDH as soon as they become known.
About Pabitra Kumar Sahoo
Pabitra Kumar Sahoo is the Co-Founder and Chief Operating Officer (COO) at Qualysec. With a deep commitment to elevating global cybersecurity standards, he directs corporate operations and service strategy, helping enterprises mitigate compliance debt and defend their digital infrastructure through elite, human-led penetration testing.
