Clinic management software for UAE healthcare facilities

The UAE has three health information exchanges (HIEs). Which one your clinic connects to depends on which regulator issued your facility license.

Facilities licensed by Dubai's health regulator connect to NABIDH. A January 2021 circular made NABIDH onboarding a prerequisite for a new or renewed facility license from 31 December 2021, and an August 2022 circular applied the same rule to outpatient clinics from 30 June 2023. On 1 October 2026 the NABIDH website listed 2,342 connected facilities and 114 connected EMRs.

Facilities licensed by Abu Dhabi's health regulator connect to Malaffi, which launched in January 2019. Malaffi states that all licensed facilities, except exempt types, must connect, and that the deadline for facilities with an active license has closed. A facility that has not connected cannot renew its license, and a facility with a Daman agreement cannot submit claims until it connects. A facility with a preliminary license is expected to connect as a prerequisite for its active license. On 29 October 2026 the Malaffi website listed 3,144 connected facilities.

Facilities licensed by the federal health regulator connect to Riayati, the National Unified Medical Record. A ministerial decision of 16 November 2021 gave facilities licensed by the federal health regulator one year to join the unified record. Riayati, Malaffi and NABIDH were integrated in January 2023.

A clinic group with branches licensed in Dubai and in Abu Dhabi needs a separate onboarding for each: NABIDH for the Dubai branches and Malaffi for the Abu Dhabi branches. An EMR that is live on NABIDH is not automatically connected to Malaffi. Check each exchange separately for each emirate where you hold a license.

The data reaches each exchange from your EMR, and your vendor builds the HL7 interface. The onboarding itself belongs to the facility: for NABIDH the facility signs an onboarding agreement with Dubai's health regulator, and for Malaffi it signs an accession agreement and facility declaration and passes the Malaffi security assessment. Put the vendor's obligations for HIE connectivity and for specification updates in the contract.

NABIDH receives HL7 messages from the facility's EMR. The NABIDH Minimum Data Set fixes the patient fields (MRN, name, gender, date of birth, Emirates ID, mobile number, nationality and address) and the code sets: ICD-10-CM for diagnoses, CPT-4 for procedures, CDT for dental procedures, Dubai Drug Code for medications, LOINC for lab and clinical observations, and SNOMED CT for problems and allergies. Each message also carries the facility's and the treating clinician's Sheryan IDs.

The regulator publishes a list of EMRs tested for connectivity with NABIDH. Its circulars let a facility choose any EMR that meets the NABIDH requirements, but that EMR must still pass connectivity testing. The EMR must also support single sign-on to NABIDH; a May 2025 circular set the end of 2025 as the deadline for SSO integration. Under the 2022 outpatient circular, if a clinic bought its EMR from a vendor on the regulator's list, that vendor is responsible for immediate connectivity to NABIDH.

Data residency is a legal requirement. The regulator's EMR Transition Guideline (effective September 2024) tells facilities to make sure the EMR vendor stores health information inside the UAE, as Federal Law No. 2 of 2019 on the use of information and communication technology in health fields requires. It adds that a cloud EMR must not store or process health data with a cloud provider outside the UAE and must use a cloud provider approved by the Dubai Electronic Security Center. Get the hosting location in writing.

The regulator does not publish a standard timeline for a first NABIDH onboarding. Data quality decides much of it: each patient needs an Emirates ID (or a passport or GCC ID when there is no Emirates ID), and diagnoses and procedures need valid codes before NABIDH accepts the messages. Clinics moving from paper records or an older system should clean this data before testing starts.

eClaimLink, the insurance claims platform, is a separate system from NABIDH. An EMR can be live on NABIDH and still have no eClaimLink connection, so check both for every vendor you evaluate.

Malaffi lists four requirements for starting a connection: a signed accession agreement and facility declaration, a pass in the Malaffi security assessment (an excerpt of the ADHICS survey), an HL7-capable EMR, and an SDWAN connection from Etisalat with a no-objection certificate from Malaffi. Malaffi recommends that a facility with a preliminary license contact its onboarding team at least two months before it plans to apply for an active license.

The Malaffi website lists the EMR systems and vendors that have at least one client connected to Malaffi. The list includes global systems such as Epic, Cerner and InterSystems TrakCare as well as regional products. Ask any vendor to name its live Malaffi clients in Abu Dhabi.

Malaffi's published pages do not list an access fee for facilities. The regulator's Policy on the Abu Dhabi Health Information Exchange (April 2020) says each participating facility implements and supports the infrastructure needed to connect, including hardware and software interfaces, at its own cost. Ask vendors to price the interface work and the SDWAN connection separately from the software license.

Abu Dhabi puts weight on clinical coding at the source. Malaffi reports that its SNOMED CT implementation, built on coding-standards guidance that Abu Dhabi's health regulator issued in November 2021, covers diagnoses, allergies, chronic diseases, family and social history and diagnostic procedures, and improves data quality at the source EMRs. In October 2026 Malaffi reported nearly 90% LOINC adoption for laboratory data, with lab test catalogues mapped to LOINC inside providers' laboratory systems. Ask vendors where in the clinical workflow SNOMED CT and LOINC codes are applied.

Abu Dhabi facilities must also meet ADHICS, the Abu Dhabi Healthcare Information and Cyber Security Standard. Version 2 was published in May 2024 and took effect in August 2024. It applies to facilities, payers and technology and service providers that handle health information in Abu Dhabi. Its controls are grouped into 11 domains, including access control, communications and operations management, data privacy and protection, cloud security, third-party security and information security incident management. ADHICS Version 2 also requires that health information and its copies are not stored, processed or transferred outside the UAE unless the regulator approves an exemption. A live Malaffi connection does not by itself make a facility compliant with ADHICS.

Dubai's health insurance system, set up under the Dubai Health Insurance Law (No. 11 of 2013), runs on eClaimLink, the claims platform of Dubai's health regulator. Claim submissions, prior authorization requests and remittance advice follow the eClaimLink minimum dataset and XML schemas published on eclaimlink.ae. Activities are coded from the standard lists published on eClaimLink, such as the CPT list, the Dubai Drug Code list and the Dubai Service List. Ask whether the EMR connects directly to the regulator's DHPO exchange or relies on staff to handle transactions in the eClaimLink portal. At higher claim volumes, direct integration avoids manual work and shows rejections inside the billing workflow.

E-prescriptions in Dubai run through the same system. Under an eClaimLink circular effective 12 July 2018, licensed clinicians must create an eRx request, through the eClaimLink portal or by direct integration with DHPO, for both insured and cash patients. The pharmacy uses the eRx reference number to fill the prior request, and for an insured patient the payer rejects a prior request that has no eRx reference number. Check that the EMR creates eRx requests from the prescription screen.

Abu Dhabi uses Shafafiya, the data standards portal and data exchange system of Abu Dhabi's health regulator. Healthcare entities upload XML files to the Shafafiya Post Office through web services. The regulator provides no web page for uploading files, so the facility needs software that does it, such as its hospital information system, its billing software or an XML upload tool from a third party. Changes to the data exchange standards are announced on the Shafafiya notices page, and all Abu Dhabi healthcare entities must monitor it and keep their systems up to date. Abu Dhabi's claims rules use ICD-10-CM, CPT-4 and HCPCS, but dental codes follow the Canadian USC&LS system rather than CDT. An EMR that works with eClaimLink does not automatically work with Shafafiya, so confirm Shafafiya integration for any Abu Dhabi branch.

Daman (The National Insurance Company – Daman) sells the Abu Dhabi Basic plan and describes itself as the UAE's leading health insurance provider. Malaffi states that facilities with Daman agreements cannot submit claims until they complete their Malaffi connection. For an Abu Dhabi clinic, ask whether the vendor has live clients submitting Daman claims through Shafafiya in production, not only in testing.

Live HIE integration is the first test. Ask for a list of clients that are sending data to NABIDH, Malaffi or Riayati through the vendor's system in your emirate, and ask for reference clients you can call. A vendor with many clinics described as 'in integration' and few live clients carries more implementation risk than one with many live clients.

Clinical templates matter as much as compliance. A GP clinic, a dental practice and a dermatology center document care differently. An EMR that makes you build templates from scratch adds work before go-live and more maintenance when code sets change. Ask which specialty templates come ready to use, and request a demo of the full documentation workflow for your practice type, including how diagnosis codes are selected and linked to billed activities.

Check Arabic support in practice. Ask which screens, printouts and patient messages are available in both Arabic and English, and test the modules that reception and billing staff use every day, not only whether Arabic text can be displayed somewhere in the system.

Maintenance terms decide long-term cost because the standards change. The NABIDH HL7 documentation warns that the regulator's policies, HL7 versions and message formats change often; Abu Dhabi's health regulator replaced ADHICS with Version 2 in 2024; and changes to Shafafiya data standards are announced on its notices page. Ask whether updates required by a regulator are included in the maintenance fee, and get that commitment in writing.

HIE testing is the step vendor proposals most often underestimate. The technical work (HL7 configuration, security assessment, test message exchange) depends on data quality. Patient records without Emirates IDs, diagnoses without valid codes, and paper records all need cleaning before messages pass validation. Clinics moving from paper or an older system should plan a separate data preparation workstream that runs alongside the technical work.

Running the old and new systems in parallel before a full cutover is slower than a hard cutover, but it lowers the risk that a failed go-live leaves the clinic without working patient records. For a busy clinic, even one day without a working system disrupts billing and clinical documentation.

Train reception and billing staff, not only clinicians. They need to know how claims are generated, when they are submitted, and how rejections are reviewed and resubmitted. Schedule billing training before go-live and agree a clear escalation path to vendor support for the first weeks after go-live.

If you are replacing an EMR in Dubai, follow the regulator's EMR Transition Guideline: tell the NABIDH team at least one month before the switch, and re-integrate the new EMR with NABIDH as soon as possible. The guideline says most facilities should complete the transition within 60 days, and large hospitals may take 6 to 9 months.

Get contract clarity on implementation support before signing. Ask what implementation hours are included, what happens if your data needs more preparation than the standard scope, and who pays for re-testing if the HIE connection fails its first round of testing.