Healthcare Cybersecurity Regulations in GCC — UAE ADHICS, Qatar & Oman

Why Healthcare Cybersecurity Regulations in the GCC Are Unique

Healthcare cybersecurity regulations in the GCC differ from general data protection laws (such as the UAE PDPL or Qatar's PDPPL) because they impose additional, sector-specific controls on medical devices, electronic health records (EHRs), clinical data sharing, and business continuity in healthcare settings. These regulations are typically enforced by health authorities rather than data protection offices, meaning compliance is tied directly to a facility’s operating license.

Across the GCC, the key healthcare cybersecurity regulations include:

• UAE — ADHICS (Abu Dhabi Healthcare Information and Data Security Standard): Mandatory for all healthcare providers in the Emirate of Abu Dhabi, enforced by the Department of Health – Abu Dhabi (DoH).
• Qatar — National Health Strategy and MoPH Data Governance: The Ministry of Public Health (MoPH) enforces cybersecurity requirements for healthcare data, with increasing alignment to the National Cybersecurity Strategy.
• Oman — Health Data Governance Framework: The Ministry of Health (MoH) and the Oman Data Protection Authority (ODPA) jointly oversee healthcare data protection, with specific requirements under sectorial regulations.
• KSA — NCA ECC and NPHIES: Saudi Arabia’s National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) apply to healthcare, alongside the National Platform for Health Information Exchange (NPHIES) standards.

Deep Dive into UAE ADHICS Healthcare Cybersecurity

What Is ADHICS and Who Must Comply?

ADHICS is the mandatory cybersecurity standard for all healthcare facilities licensed by the Department of Health – Abu Dhabi. It applies to hospitals, clinics, medical laboratories, pharmacies, and any entity that stores, processes, or transmits health information within the emirate. The standard requires compliance with a defined control framework across 15 domains, including access control, cryptography, incident management, and medical device security.

ADHICS is built upon ISO/IEC 27001 and NIST frameworks but adds healthcare-specific controls such as requirements for clinical system availability, medical device patching, and health data breach notification within 72 hours.

Key ADHICS Requirements for 2025

How to Achieve ADHICS Compliance

Achieving ADHICS compliance requires a structured, evidence-based approach. Most healthcare organisations engage a compliance assessor approved by the DoH, who evaluates controls against the standard. The process typically follows four phases:

Qatar Healthcare Cybersecurity Regulations

MoPH Data Governance and NIS Alignment

Qatar does not have a single healthcare cybersecurity standard equivalent to ADHICS. Instead, healthcare cybersecurity is governed by three overlapping instruments: the Ministry of Public Health (MoPH) Data Governance Policy, the Qatar National Cybersecurity Strategy, and the regulatory oversight of the Qatar Financial Centre (QFC) for certain healthcare organisations. The MoPH policy mandates that all healthcare data be stored within Qatar and that healthcare providers implement the National Information Assurance (NIA) controls published by the National Cybersecurity Agency (NCSA).

Key compliance requirements include:

• Data localisation: All health data must be stored and processed within Qatar’s borders.
• NIA compliance: Healthcare providers must meet NIA Baseline or Standard controls, which cover access management, network security, and incident response.
• Breach notification: Notification to the MoPH and NCSA within 24 hours of a confirmed breach involving personal health data.
• Third-party risk management: All vendors with access to health data must be assessed against NIA requirements.

Oman Health Data Protection Requirements

Ministry of Health and ODPA Framework

Oman’s healthcare cybersecurity landscape is governed by two primary authorities: the Ministry of Health (MoH) and the Oman Data Protection Authority (ODPA). The MoH issues sector-specific cybersecurity guidelines for all healthcare facilities, while the ODPA enforces the broader Personal Data Protection Law (PDPL), which has specific provisions for sensitive health data.

Healthcare providers in Oman must comply with the following requirements:

• Data Protection Officer (DPO) appointment: Mandatory for any healthcare facility processing personal health data.
• Data Protection Impact Assessment (DPIA): Required before deploying new health information systems or introducing significant changes to data processing.
• Minimum security controls: Based on ODPA’s Security Measures Regulation, which mandates access controls, encryption, logging, and incident response for health data.
• Breach notification: Notification to the ODPA within 72 hours of a breach involving personal health data.

Oman’s MoH has also signalled its intention to develop a dedicated healthcare cybersecurity standard, aligned with NIST CSF 2.0 and ISO 27001, by 2026. Healthcare providers should treat the current ODPA and MoH requirements as a transitional baseline and begin preparing for a more comprehensive sector-specific framework.

Comparative GCC Healthcare Cybersecurity Compliance

Common Gaps and Compliance Challenges

Despite differences in regulatory maturity, healthcare organisations across the GCC consistently face three compliance gaps:

• Medical device inventory and security: Few healthcare providers maintain a complete, risk-tagged inventory of connected medical devices. ADHICS explicitly requires this; Qatar and Oman regulations will demand it as standards mature. Without automated inventory discovery, compliance remains paper-based and incomplete.
• SIEM implementation for healthcare: Most GCC healthcare regulations require continuous monitoring, log retention (typically 6–12 months), and anomaly detection. However, many providers still rely on basic log collection without correlation or threat detection. A SIEM solution tailored to healthcare compliance — such as ThreatHawk SIEM — can map logs to specific regulatory controls and automate evidence collection.
• Third-party and supply chain risk: Every GCC healthcare regulator requires oversight of vendors, cloud service providers, and managed service partners. Yet third-party risk assessments remain manual, inconsistent, and difficult to maintain across dozens or hundreds of vendors. Automation through a GRC automation platform can centralise vendor assessments, evidence collection, and reporting.

How to Build a Unified Healthcare Compliance Program

Healthcare providers operating across multiple GCC jurisdictions face a choice: manage compliance separately for each regulator, or adopt a unified controls framework that satisfies all requirements simultaneously. The unified approach is more efficient, reduces audit fatigue, and provides better visibility for CISOs and risk managers.

Step 1: Map Regulations to a Common Control Framework

Map ADHICS, MoPH, NIA, and ODPA requirements to a common baseline such as NIST CSF 2.0 or ISO 27001. This mapping reveals overlapping controls — for example, access control requirements across all four regulations — and identifies genuine gaps where specific local controls are needed. The mapping becomes the single source of truth for compliance activities across all facilities.

Step 2: Implement Continuous Monitoring and Automation

Manual compliance management cannot scale across multiple hospitals, clinics, and jurisdictions. Use a SIEM platform with built-in compliance reporting for healthcare regulations. ThreatHawk SIEM, for example, includes pre-built report templates for ADHICS log requirements, allowing compliance teams to generate evidence packages for audits in minutes rather than weeks. Similarly, automate DPIA workflows, vendor risk assessments, and policy management through a GRC platform.

Step 3: Conduct Cross-Jurisdiction Tabletop Exercises

A breach that affects patients in Abu Dhabi, Doha, and Muscat requires simultaneous notifications to the DoH, MoPH, and ODPA — each with different timelines and formats. Regular tabletop exercises that test multi-jurisdiction incident response are essential. Ensure your incident response plan includes escalation paths for each regulator, and that the plan is tested at least annually with all facilities involved.

Future Outlook: Healthcare Cybersecurity in the GCC

The trajectory across the GCC is clear: healthcare cybersecurity regulations will converge toward a common baseline of mandatory controls, shorter breach notification timelines, and stricter enforcement. Qatar and Oman are actively developing dedicated healthcare cybersecurity standards, and Saudi Arabia's NPHIES platform already imposes technical security requirements for health data exchange. Healthcare providers should treat current compliance baselines as a floor, not a ceiling, and invest in scalable compliance infrastructure that can adapt to regulatory evolution.