A clinic or hospital in the UAE runs on its IT. When the EMR is down, reception cannot register patients and doctors cannot open results. When a backup sits on a server outside the country, the facility may be breaking federal law without knowing it. NOCKO designs, builds and supports IT infrastructure for healthcare providers in Dubai and Abu Dhabi with the local rules built in from day one. We are an IT company, not a regulator or an auditor, and we do not certify anyone. We build systems that make compliance with DoH, DHA and federal health data rules practical for your staff.
The rules that shape healthcare IT in the UAE
Four sets of rules decide how a medical facility in the UAE must store, move and protect patient data. Every project we deliver is planned around them.
DoH ADHICS. The Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health Abu Dhabi (DoH), sets the information security controls that licensed facilities in the emirate are expected to apply.
DHA requirements. The Dubai Health Authority (DHA) sets the licensing and health data protection requirements for facilities in Dubai, including how patient data is handled and shared.
Malaffi and NABIDH. Malaffi is the health information exchange for Abu Dhabi and NABIDH is the one for Dubai; licensed facilities connect to them so patient records can be shared with other providers in the same emirate.
UAE Federal Law No. 2 of 2019 on the Use of ICT in Health Fields. This federal law requires health data to be stored and processed inside the UAE unless one of the permitted exceptions applies.
UAE PDPL. Federal Decree-Law No. 45 of 2021 is the federal personal data protection law and governs how personal data, including patient data, is collected, processed and secured.
NOCKO is not certified or accredited by any of these bodies. We build infrastructure that supports your compliance with them and give your compliance officer the documentation to show it.
- Patient data and its backups stored on servers inside the UAE
- Access to medical records tied to named users and defined roles
- Documented controls that map to ADHICS and DHA checklists
Keeping EMR, PACS and the NABIDH or Malaffi link running
The EMR or EHR is the system the whole facility depends on. Registration, orders, prescriptions, lab results and billing all pass through it. We host it on redundant hardware, put it behind a firewall and monitor it 24/7, with a 99.9% uptime SLA for the systems you mark as critical. PACS gets the same care: radiology images are large and accumulate for years, so we size storage for growth and keep a second copy inside the UAE.
A facility licensed in Dubai is expected to connect to NABIDH, and one licensed in Abu Dhabi to Malaffi. Your EMR vendor and the exchange operator set up the connection, but it only works if the network behind it is stable. We provide an internet link with a backup line, a secure channel for the integration interface, firewall rules limited to the traffic the exchange needs, and monitoring so a dropped connection is noticed within minutes. We also work with your EMR vendor on the HL7 and FHIR interfaces that carry the data.
- Redundant servers, UPS and network paths for EMR, EHR and PACS
- Primary and backup internet links with automatic failover
- Monitoring of the NABIDH or Malaffi interface with alerts when data stops flowing
Segmented networks for medical devices
Imaging machines, lab analysers, patient monitors and infusion pumps often run old operating systems that cannot be patched. If they share a network with front desk PCs and guest Wi-Fi, one infected laptop can reach them.
We split the network into zones: medical devices in their own segment, clinical workstations in another, administration in a third, and guest Wi-Fi fully separated. Traffic between zones passes through the firewall and only the connections a device needs are allowed. This is a control ADHICS and DHA assessors look for, and it keeps a ransomware incident away from equipment you cannot replace quickly.
- Separate VLANs for medical devices, clinical staff, administration and guests
- Inventory of every connected device and its operating system
- Network access control so unknown devices cannot join clinical segments
Encrypted backups that stay in the UAE
A backup only counts if it restores, and in healthcare it only counts if it stays in the country. We encrypt backups at rest and in transit, keep them in UAE data centres and run scheduled test restores, so you know the EMR can come back after a hardware failure or a ransomware attack.
For one UAE medical clinic we replaced manual EMR backups with an automated, verified process that also produced the reports their compliance officer needed. Read how it was done in our case study: How a UAE Medical Clinic Automated EMR Backup and Compliance Reporting.
- Encrypted EMR, EHR and PACS backups stored inside the UAE
- Scheduled restore tests with written results
- Offline or immutable copy to survive a ransomware attack
Access control, audit logs and 24/7 support
Every regulator on this page asks the same two questions: who can see patient data, and can you prove who saw it. We set up role-based access so a receptionist, a nurse and a consultant each see only what their job requires, add multi-factor authentication for remote and admin access, and keep audit logs of every login and every change to a record.
Support runs 24/7 because clinics do not close at six. Our helpdesk responds to remote requests within 15 minutes. When a problem needs hands on site, an engineer reaches you within 2 hours anywhere in Dubai, and same day across Abu Dhabi and the other Emirates.
- Role-based access and multi-factor authentication for EMR, PACS and file shares
- Central audit logs with retention for regulator requests
- 24/7 helpdesk, 15-minute remote response, on-site within 2 hours in Dubai
Frequently Asked Questions
Does patient data have to stay inside the UAE?
Yes, as a rule. UAE Federal Law No. 2 of 2019 requires health data to be stored and processed inside the country unless an exception applies. We keep every copy of patient data, including backups, in a UAE data centre and document where each copy is.
Can NOCKO make our clinic ADHICS or DHA compliant?
We cannot certify you, and we do not claim to. Compliance is confirmed by the regulator or an assessor they recognise. We build and run infrastructure that supports the controls ADHICS and DHA ask for, with documentation your compliance officer can present.
Do you replace our EMR or work with the vendor we already have?
We work with your existing EMR or EHR vendor. We take care of the servers, network, storage, backups and security around the application, and coordinate with the vendor on hosting, upgrades and the NABIDH or Malaffi interface.
How fast do you respond when the EMR goes down?
Our helpdesk is staffed 24/7 and responds to remote requests within 15 minutes. If an engineer is needed on site, we reach you within 2 hours anywhere in Dubai and same day in Abu Dhabi. Systems under our 99.9% uptime SLA are monitored around the clock.
Can you connect our clinic to NABIDH or Malaffi?
The connection is set up between your EMR vendor and the exchange operator. Our part is the network and security behind it: a stable link with failover, a secure path for the interface, firewall rules and monitoring. We join the calls with your vendor so the requirements are met on the first attempt.