NABIDH, Malaffi and Riayati: Health Information Exchange in the UAE

Health information exchange in the UAE works the same way on all three platforms. Your clinic’s electronic medical record (EMR) sends structured messages about each patient visit, such as registrations, diagnoses, lab results, medications and clinical documents, and the platform builds one shared record that other licensed providers can view when they treat the same patient. The difference is who runs each platform and which facilities it covers.

In January 2023 MOHAP, DHA and DOH announced that the three platforms had been integrated, so health information exchange in the UAE now crosses emirate lines and a doctor in one emirate can see relevant records created in another. For a clinic owner, the practical point is simple: you connect to the platform of the regulator that licenses you, and the national link takes care of the rest.

Malaffi’s provider pages say all DOH licensed facilities must connect unless they are exempt. The required list includes medical, dental, one day surgery and primary care centres, general, specialised, dental and school clinics, diagnostic, dialysis and IVF centres, hospitals, mobile health units, inpatient and outpatient pharmacies, home care services and telemedicine providers. Ambulance services, drug stores, scientific offices and traditional complementary medicine are among the categories that are not required. Military, police, aviation and university facilities are currently exempt.

The joining steps Malaffi publishes are:

1. Sign the agreements. Request the Accession Agreement and Facility Declaration from the Malaffi onboarding team.
2. Pass the security assessment. It is an excerpt of the DOH Abu Dhabi Healthcare Information and Cyber Security (ADHICS) survey.
3. Have an HL7-capable EMR. Malaffi also publishes a list of connected EMR systems you can check.
4. Arrange the network link. An SDWAN connection from Etisalat, using a no objection certificate issued by Malaffi.

The licensing link is direct. Malaffi states that connected status is expected before a preliminary licence becomes active, that non-exempt facilities with an active licence that are not connected cannot renew, and that facilities with Daman agreements cannot submit claims until they connect. It recommends contacting the onboarding team at least two months before your planned application date.

Connection is not a one-off task either. DOH Circular 144 of 2026 told all facilities to submit referral transactions to Malaffi using the HL7 REF message, with priority and SNOMED coded specialty, and set full compliance by 31 August 2026. DOH monitors compliance through Malaffi data reports.

DHA’s Guideline for Electronic Medical Record Transition, effective September 2024, is the clearest official checklist we have seen for EMR decisions, and most of it is sound practice in any emirate. Its main points:

• The vendor must store health information inside the UAE, as Federal Law No. 2 of 2019 on ICT in the health field requires, and cloud hosting must use providers approved by the Dubai Electronic Security Center.
• The vendor needs a locally registered representative for installation and support.
• The new EMR should support SSO to connect to NABIDH, and the contract should make the vendor responsible for code set updates such as ICD, CPT, SNOMED CT and NABIDH data standards.
• Tell the NABIDH team at least one month before the transition, tell them again when the old system closes, and re-integrate as early as possible.
• Keep all records for their full retention period, and keep a written record that migrated data was not changed, because inspectors can ask for it.

From our side, the biggest cost of getting health information exchange in the UAE wrong is time. A clinic that buys an EMR first and checks exchange readiness later can lose weeks at licensing or renewal. Ask every vendor, in writing, which platform it is live on today and for a reference facility of your type.