Governance and Policy ManagementADHICS v2.0: The Gaps Healthcare Facilities Keep Getting Wrong
ADHICS V2 has changed what cybersecurity compliance looks like for healthcare organizations in Abu Dhabi. The standard brings information security, patient data protection and medical technology security into a single regulatory structure, which means hospitals, clinics, laboratories, insurers and health technology providers need more than a completed checklist.
Most Abu Dhabi healthcare organizations can describe ADHICS v2.0 accurately. Far fewer can produce a complete inventory of every EMR server, PACS system, and medical IoT device connected to their network, or prove a backup has genuinely been restored rather than just completed. Complyan’s healthcare compliance work treats this gap between knowing the standard and operationalizing it as the real challenge behind ADHICS compliance, not the framework’s text itself.
What Makes ADHICS Different From a Generic Security Standard
ADHICS v2.0 is the Department of Health Abu Dhabi’s mandatory cybersecurity and privacy standard, applying to every hospital, clinic, laboratory, pharmacy, health insurer, and telehealth provider it regulates, along with any vendor processing healthcare data on their behalf. Unlike a general-purpose framework adapted for healthcare, ADHICS was built around the specific systems that make hospitals function: electronic medical records, picture archiving systems, laboratory information systems, connected medical devices, and the cloud platforms increasingly hosting all of them.
This specificity matters because a compliance program built from a generic ISO 27001 or NIST template misses exactly the asset categories ADHICS assessors expect to see documented and protected.
The First Problem Is Applicability
Not every ADHICS requirement should be approached as an isolated technical task.
The organization first needs to determine how the standard applies to its services, information assets, infrastructure and healthcare operations. That means identifying systems that process health information, clinical applications, connected medical equipment, outsourced services and third parties with access to regulated data.
From there, the control set should be mapped against what already exists.
A healthcare organization may already operate ISO 27001 controls, UAE PDPL processes, NIST-based security practices or internal cybersecurity policies. Rebuilding the same control separately for ADHICS wastes time and often creates inconsistent evidence.
Complyan Control Mapping allows a common control to be mapped across ADHICS, ISO 27001, UAE PDPL and other applicable frameworks. One working access-control process, for example, can support several regulatory obligations without being managed as separate activities.
Where Healthcare Facilities Fall Short
Assessment patterns across the sector point to the same handful of gaps appearing again and again, regardless of facility size.
Incomplete asset inventories: organizations can usually list their servers and workstations, but struggle to produce a complete inventory covering EMR servers, PACS systems, laboratory systems, cloud workloads, medical IoT devices, and privileged administrative accounts specifically. An asset nobody has documented is an asset nobody is actively protecting.
Missing backup restoration testing: a backup job completing successfully is not the same as a verified, working restore. Many facilities discover this distinction only when disaster recovery gets tested for real, at exactly the moment a real incident makes the gap most costly.
Delayed vulnerability remediation: identifying a vulnerability satisfies half the requirement. Facilities frequently fall behind on the remediation timeline itself, leaving known, documented weaknesses open for months after they were first flagged.
Inadequate third-party risk assessments: vendors and outsourced service providers handling healthcare information carry the same risk as internal systems, yet vendor oversight often stops at a signed contract rather than an ongoing assessment of how that vendor protects the data it holds.
Weak privileged access management: administrative accounts across EMR, PACS, and cloud environments frequently carry broader access than their function requires, with reviews happening infrequently enough that privilege creep goes unnoticed for extended periods.
Incomplete cloud security governance: as more healthcare workloads move to AWS, Azure, and similar platforms, governance frequently lags behind adoption, leaving cloud-hosted patient data under weaker oversight than equivalent on-premise systems.
Why These Gaps Keep Recurring, and Why They Matter More Here
The pattern behind all six gaps is structural, not a matter of individual facilities being careless. Biomedical equipment is frequently procured and maintained by a vendor or clinical engineering team operating separately from IT, which is why a PACS server or an infusion pump can go undocumented in a central asset register nobody outside IT ever reviews. Smaller clinics and diagnostic labs often run compliance as a part-time responsibility layered onto an already stretched administrator, leaving continuous tasks like backup testing and access review to slip whenever a clinical priority takes precedence.
ADHICS v2.0’s own tiered model, sorting requirements into Basic, Transitional, and Advanced controls by organizational size, was built with this reality in mind. A smaller facility is not expected to run the same continuous monitoring program as a large hospital network on day one, but it is still expected to close the Basic-tier gaps above before claiming compliance at any tier.
These gaps also carry more weight in healthcare than they would anywhere else. A vulnerability in a retail inventory system is a business risk. The same gap in a laboratory information system or a connected infusion pump is a patient safety risk, which is why ADHICS pushes so hard on asset visibility and access control specifically: an attacker who reaches a medical device or an EMR system is not just risking data. They are risking a clinical outcome.
Building a Program That Closes These Gaps
Start with a real gap assessment, not a documentation review: A gap assessment that only checks whether a policy exists misses the operational gaps assessors keep finding: incomplete inventories, untested backups, stale vulnerability remediation.
Build the asset inventory around ADHICS-specific categories: A generic IT asset list is not sufficient. The inventory needs to explicitly capture EMR servers, PACS, laboratory systems, cloud workloads, and every medical IoT device with network connectivity.
Test backup restoration on a real schedule, not a trust basis: A backup strategy is only as strong as the last restore an organization has verified against a non-production environment.
Treat third-party risk as continuous, not contractual: Complyan’s third-party risk management tools replace the static vendor questionnaire with ongoing visibility into vendor posture, closing the gap ADHICS assessors flag most often around outsourced healthcare data handling.
Map ADHICS controls against whatever else the organization already carries. Many UAE healthcare facilities also work toward ISO 27001 or HIPAA-aligned practices. A control satisfied under one framework should count toward ADHICS directly, which is the efficiency Complyan’s cross-framework mapping is built to deliver.
Run a maturity assessment before the next DoH audit, not after. Complyan’s cybersecurity maturity assessment gives healthcare organizations a structured baseline against ADHICS’s tiered control model, surfacing which gaps above need attention before an examiner finds them first.
Where Complyan fits
Most of this work is coordination: tracking which control is met, who owns the gap, and where the proof lives. Complyan is a GRC platform built for that. Its cybersecurity compliance module keeps framework content current and flags gaps against each requirement. As described in our earlier ADHICS v2.0 overview, it also tags foundational requirements as high priority by default, which matches the Basic-tier approach.
Other parts of the platform map to the failure points above:
- Policies: Governance and policy management offers templates for the 15-plus policy requirement, with dashboards showing what is still missing.
- Vendors: Third-party risk management tracks the vendor risk that assessors probe. Our guide on running a vendor security questionnaire shows how to cut the back-and-forth.
- Risk: Cyber risk management ties findings to owners and deadlines, so remediation does not stall.
- Audit readiness: Audit and compliance management supports both internal audit and external audit preparation, and our piece on automated evidence collection covers keeping proof current.
- Overlapping frameworks: Many healthcare groups also answer to UAE data-protection law or ISO 27001. A common control framework lets one implemented control count toward several standards.
- Ransomware: Ransomware readiness addresses the attack that hits clinical uptime hardest.
See how Complyan supports healthcare organisations, or book a demo to run a gap assessment against ADHICS V2.
Conclusion
ADHICS v2.0 compliance rarely fails because an organization misunderstands the standard. It fails at the operational layer: an incomplete inventory, an untested backup, a vendor nobody reassessed since onboarding, an access review that quietly stopped happening after the person who ran it changed roles. These are the same handful of gaps recurring across facilities of every size, because they sit at the boundary between IT, clinical operations, and procurement, where accountability is easiest to lose track of.
Healthcare facilities that close these specific, recurring gaps, rather than treating ADHICS as a documentation exercise, are the ones that turn compliance into what it was built to protect: continuity of patient care.