Clinic Compliance in the UAE: Digital, Data and Patient Safety Guide
Short answer: Clinic compliance in the UAE, beyond the licence itself, comes down to three ongoing duties: protecting patient data under Federal Law No. 2 of 2019, connecting your EMR to your regulator’s health information exchange (NABIDH in Dubai, Malaffi in Abu Dhabi, Riayati for MOHAP), and running a complaints and incident system that reports serious events to the regulator on time. This page explains how the three fit together and links every guide in this section.
Last verified: October 2026 against Federal Law No. 2 of 2019 and its Executive Regulation, Ministerial Decision No. 51 of 2021, the Malaffi provider pages, DHA External Circular 0954 and the DHA Standards for Sentinel Events (version 1.1).
Key Takeaways
- Patient data about care given in the UAE must be stored and processed inside the UAE, apart from ten cases listed in Ministerial Decision No. 51 of 2021, and records are kept for at least 25 years after the last procedure.
- Your EMR choice is a compliance decision: it has to keep data in the UAE and connect to your regulator’s exchange platform.
- In Abu Dhabi, a facility that is not exempt and not connected to Malaffi cannot renew its DOH licence, and new facilities are expected to connect before the licence becomes active.
- DHA licensed facilities notify DHA of a sentinel event within 48 hours of confirming it, send a preliminary report within 72 hours and a final root cause analysis within 45 calendar days.
- Most failures we see are not technical. They come from a contract signed before anyone checked hosting, consent or exchange readiness.
Clinic Compliance in the UAE at a Glance
Licensing gets a clinic open. The rules in this section decide whether it stays open without trouble at renewal, inspection or the first patient complaint. Each one belongs to a different part of the business, which is why they slip.
| Area | The Core Rule | Where To Read More |
|---|---|---|
| Patient Data | Confidential, used for health purposes unless the patient consents in writing, stored inside the UAE, kept at least 25 years | Health Data Protection Rules |
| Health Information Exchange | Connect through an approved EMR to NABIDH (DHA), Malaffi (DOH) or Riayati (MOHAP) if your facility type is on the list | NABIDH, Malaffi and Riayati |
| Complaints and Incidents | A written complaints process, an internal incident log, and regulator reporting for sentinel events within the set deadlines | Patient Complaints and Incident Reporting |
Patient Data: Where It Lives and Who Sees It
Federal Law No. 2 of 2019 on the use of ICT in health fields applies across the UAE, free zones included. Article 16 limits patient data to health purposes unless the patient approves in writing, with five exceptions such as an insurer checking a claim or a request from the health authority. Article 13 bars storing, processing or transferring health data abroad except in the cases a decision sets, and Ministerial Decision No. 51 of 2021 lists ten of them, from treatment abroad to telehealth with written consent.
The fines are large. Article 24 sets AED 500,000 to 700,000 for keeping or moving data outside the UAE in breach of Article 13, and Article 25 lets the authority warn, fine, suspend or cancel a facility’s access to the central system. Dubai adds its own policies, PP-11 on confidentiality and PP-12 on records, and Abu Dhabi facilities follow the DOH ADHICS cyber security standard. Our health data protection guide sets out the consent rules, the ten transfer cases and the record retention detail.
Connecting to NABIDH, Malaffi or Riayati
Each regulator runs its own exchange. Your EMR sends structured messages about every visit, and the platform builds one shared record that other licensed providers can see. MOHAP, DHA and DOH announced in January 2023 that Riayati, Malaffi and NABIDH had been integrated, so the record now crosses emirate lines.
- Dubai. DHA External Circular 0954 (May 2025) covers using an EMR that meets NABIDH integration requirements and supports Single Sign-On, with an attachment listing the facilities that must integrate.
- Abu Dhabi. Malaffi states that facilities with an active DOH licence that are not exempt and not yet connected will not be able to renew. Military, police, aviation and university facilities are currently exempt.
- Northern Emirates. MOHAP said in December 2021 that facilities it licenses must join Riayati within a year of a November 2021 decision. Sharjah facilities should confirm their route with the Sharjah Health Authority.
The health information exchange guide covers the Malaffi joining steps, the DHA rules for changing EMR and what to ask a vendor before you sign.
Complaints, Incidents and Sentinel Events
A complaint and a patient safety incident are separate files, and one event can open both. Every clinic needs a written complaints process and an internal log for incidents and near misses, graded even when nothing has to be reported. The regulator only hears about the serious ones, but inspectors ask to see the log.
Reporting deadlines depend on your licence. In Dubai, DHA’s sentinel event standard sets 48 hours to notify, 72 hours for a preliminary report and 45 calendar days for the final root cause analysis. Operators in Dubai Healthcare City report sentinel events within 24 hours, while medical complaints in the free zone are handled by DHA. MOHAP handles complaints about private facilities in Ajman, Umm Al Quwain, Ras Al Khaimah and Fujairah and lists 45 days to complete one. The complaints and incident reporting guide compares the DHA, DOH, MOHAP and DHCC rules side by side.
Where Clinic Compliance in the UAE Usually Goes Wrong
From our work with clinics, the same few gaps come up again and again:
- The EMR was bought first. Hosting outside the UAE, no live exchange connection or no Single Sign-On can cost weeks at licensing or renewal. Ask the vendor in writing where data is hosted and which platform it is live on today.
- Marketing uses patient lists. Sending offers to patient contact details is not a health purpose, so it needs written consent, and in Dubai PP-11 treats it as a secondary use that needs DHA approval.
- Leavers keep access. The Executive Regulation requires system access to end when a staff member leaves. Make it part of your exit checklist.
- Nobody owns the incident log. Name one person, usually the medical director or a quality lead, and review the log at a monthly meeting so reportable events are caught inside the deadline.
None of this needs a large team. A short annual review of hosting, consent forms, access lists and the incident log covers most of what an inspector will ask.
Every Guide in This Section
- NABIDH, Malaffi and Riayati: Health Information Exchange in the UAE: who must connect, how to join and the link to your licence.
- Health Data Protection Rules in the UAE: consent, keeping data in the UAE, the ten transfer cases, 25 year retention and fines.
- Patient Complaints and Incident Reporting in UAE Clinics: complaints handling, sentinel events and the deadlines for each regulator.
- Healthcare Data Privacy Management and Healthcare Cybersecurity Management: our executive guides for leadership teams.
We add new guides here as they are published, so this page is the best place to start on any clinic data, systems or patient safety question.
Frequently Asked Questions.
What compliance rules apply to a clinic in the UAE after licensing?
Three main ones: Federal Law No. 2 of 2019 on patient data, your regulator’s health information exchange (NABIDH, Malaffi or Riayati), and complaints and incident reporting under your regulator’s standards. Tax, payroll and Emiratisation rules apply as well and are covered in our other sections.
Can a UAE clinic store patient records on a cloud server abroad?
No, outside the cases listed in Ministerial Decision No. 51 of 2021. Article 13 of Federal Law No. 2 of 2019 requires health data about care given in the UAE to be stored and processed inside the UAE, and breaches carry a fine of AED 500,000 to 700,000.
Is Malaffi mandatory for clinics in Abu Dhabi?
Yes, unless the facility is exempt. Malaffi states that non-exempt facilities with an active DOH licence that are not connected cannot renew, and preliminary licensed facilities are expected to connect before the licence becomes active.
How fast must a Dubai clinic report a sentinel event?
Within 48 hours of confirming the event, with a preliminary report within 72 hours and a final root cause analysis within 45 calendar days, under DHA’s Standards for Sentinel Events version 1.1.
Where This Comes From.
- Federal Law No. 2 of 2019 on the Use of ICT in Health Fields (MOHAP, English)
- Cabinet Resolution No. 32 of 2020, Executive Regulation of Federal Law No. 2 of 2019 (MOHAP)
- Ministerial Decision No. 51 of 2021 on Storing and Transferring Medical Data Outside the State (MOHAP, Arabic)
- DHA Policy for Data and Health Information Protection and Confidentiality (PP-11)
- DHA External Circular 0954 (CIR-2025-00000101): EMR Compliant with NABIDH Integration and SSO
- Malaffi: Facilities Required to Connect
- DOH: Successful Integration Between Riayati, Malaffi and NABIDH
- MOHAP: Local Health Authorities Consolidate Medical Data in Riayati
- DHA: Standards for Sentinel Events Notification and Management in Health Facilities, version 1.1
- DHCC: Sentinel Event Policy PP/HCO/003/04
- MOHAP: Complaints About Private Health and Pharmaceutical Facilities
How OzaniX Partners Can Help.
Our Technology and IT Support service checks where your EMR and backups are hosted, compares systems on exchange connections and Single Sign-On, and sets up role based access and leaver steps. We do not resell any EMR or cloud vendor. Our Licensing and Regulatory team builds the complaints process and incident log your regulator expects and keeps clinic compliance in the UAE on track at renewal and inspection.
Book a Discovery Call