Nabidh EHR integration for Dubai healthcare facilities

NABIDH (Network & Analysis Backbone for Integrated Dubai Health) is the health information exchange run by Dubai's health regulator. Connected facilities send patient data from their EMR to NABIDH in near real time, and each patient gets a unified medical record. Data flows one way, from the EMR to NABIDH. Clinicians who are treating the patient view the unified record in the NABIDH Clinical Portal, which they open from their EMR. The record can include encounters, diagnoses, allergies, medications, vaccinations, vitals, lab results, radiology reports (not images) and clinical documents from other connected facilities.

On 1 October 2026 the NABIDH website listed 12.68 million unified medical records, 60,093 connected clinicians, 2,342 connected facilities and 114 connected EMRs. The last figures the regulator published in a press release were for the end of June 2025: 10.41 million records, 53,659 healthcare professionals, 1,888 licensed facilities and 91 EMR systems.

NABIDH accepts HL7 V2.x, HL7 V3, HL7 CDA R2 and HL7 FHIR R4, plus IHE profiles. The regulator's Standards for Interoperability and Data Exchange (Version 2, effective July 2025) name HL7v2 as the recommended standard and say systems should also support FHIR and IHE. The NABIDH HL7 API documentation specifies HL7 v2.5 messages (ADT, ORM, ORU, RDE, MDM and VXU) and C-CDA v2.1 documents. Your EMR must build these messages with the segments, fields and code tables the regulator specifies.

Who must connect: the regulator publishes a list of facility categories that must integrate with NABIDH. The list covers hospitals; outpatient facilities such as general, specialty and dental clinics, polyclinics, day surgery, fertility, dialysis, oncology, endoscopy, psychiatric, telehealth and occupational health centers; diagnostic centers; specialized units such as first aid units and home healthcare agencies; clinical support centers such as physiotherapy, occupational therapy, speech and hearing, and psychology; and long-term residential care facilities. A separate October 2023 circular required all medical laboratories to integrate by 31 December 2023.

NABIDH is also linked to the other UAE exchanges. In January 2023 the three health regulators announced that Riayati, the National Unified Medical Record run by the federal health regulator, had been integrated with Malaffi in Abu Dhabi and NABIDH in Dubai, so that clinicians across the UAE can reach patient information held on the other platforms.

NABIDH onboarding is a license condition. A January 2021 circular from Dubai's health regulator made onboarding a prerequisite for a new or renewed healthcare facility license, effective 31 December 2021. An August 2022 circular repeated the rule for outpatient clinics, effective 30 June 2023: onboarding is a prerequisite for applying for a new clinic license or renewing one in Sheryan. The New Facility License service on Sheryan lists an EMR that complies with the NABIDH Minimum Data Set and NABIDH standards as a prerequisite.

The EMR rules have three parts. First, the EMR must meet the NABIDH Minimum Data Set and the NABIDH policies and standards. Second, it must support single sign-on (SSO), so clinicians open NABIDH from the EMR without a second login. A May 2025 circular required facilities in the compulsory categories to complete SSO integration by the end of 2025 and said the regulator would then enforce penalties for violations. Third, the January 2021 circular requires the EMR implementation to reach at least stage 2 of the HIMSS EMR Adoption Model (EMRAM), with stage 4 preferred.

The regulator publishes a list of EMRs that have been tested for connectivity with NABIDH. A facility may still choose another EMR, provided it meets the NABIDH requirements. Under the 2022 outpatient circular, if a clinic bought its EMR from a vendor on the regulator's list, the vendor is responsible for immediate connectivity to NABIDH.

Onboarding is done per facility. Even with a listed EMR, each facility completes the readiness assessment, signs its own onboarding agreement and passes testing before it goes live. The vendor does the technical work, but the license obligation stays with the facility.

Clinician and facility identifiers are part of every message. The NABIDH HL7 API documentation requires the facility's Sheryan unique ID in the sending facility and encounter fields, and the treating clinician's Sheryan unique ID in the attending doctor field. Sheryan is also linked to NABIDH sign-in, so only professionals with a valid license can open the Clinical Portal. Check every clinician's Sheryan ID in your EMR before testing starts.

Start with the list of EMRs tested for connectivity with NABIDH, published on the NABIDH website. A listed EMR is the shorter path, but the list is not a closed register: the regulator's circulars let a facility choose any EMR that meets the NABIDH requirements. An unlisted EMR still has to pass NABIDH connectivity testing before your facility can go live. Ask any vendor that claims NABIDH readiness to name Dubai facilities it already has live on NABIDH.

Ask who builds and maintains the NABIDH messages. Some products generate the required HL7 messages inside the EMR; others rely on an interface engine that your team must configure. For a clinic without its own IT team, a vendor that runs the NABIDH interface is easier to sustain.

Ask about testing history: how many Dubai facilities the vendor has taken live on NABIDH, and how long testing took for the most recent ones.

Ask how specification changes are handled. The NABIDH HL7 documentation warns that the regulator's policies, HL7 versions and message formats change, and that keeping up is the responsibility of the sending facility. Put the vendor's turnaround for specification updates in the contract. The regulator's EMR Transition Guideline also recommends making the vendor contractually responsible for code set updates such as CPT, ICD, SNOMED CT and NABIDH data standards.

Check single sign-on. The EMR must let clinicians open NABIDH through SSO.

Data residency is a hard requirement. Under the UAE ICT Health Law (Federal Law No. 2 of 2019), health data must be stored inside the UAE. The regulator's EMR Transition Guideline adds that a cloud EMR must not store or process health data outside the UAE and must use a cloud provider approved by the Dubai Electronic Security Center. Get this in writing in the contract.

The regulator does not publish a standard timeline for a first NABIDH onboarding. For a switch from one EMR to another, including reconnection to NABIDH, its EMR Transition Guideline (2024) says most facilities should finish within 60 days and large hospitals may take 6 to 9 months, and that the whole replacement should not exceed three months for small facilities or nine months for large hospitals.

The NABIDH website sets out four onboarding steps. How long each step takes depends on your data, your EMR and the regulator's go-live schedule.

Step one is the readiness assessment. Contact the NABIDH team to start it. The published readiness criteria are an EMR with clinical documentation, a unique identifier for patient records, clinical coding standards and terminology code sets, laboratory, radiology and pathology systems integrated with the EMR, clinical data quality that meets NABIDH requirements, messaging standards that follow NABIDH specifications, buy-in from senior staff, and named clinical and IT change champions. Before you start, assign an internal project owner and check that every active clinician has a valid Sheryan ID.

Step two is the onboarding agreement. Your facility signs an onboarding agreement with Dubai's health regulator.

Step three is connectivity testing. Your vendor tests the EMR's NABIDH messages through the regulator's developer portal, which provides a test environment, an HL7 utility and the API documentation. Test messages should cover registrations and visits (ADT), orders (ORM), results (ORU), pharmacy orders (RDE), clinical documents (MDM) and vaccinations (VXU), as your facility type requires. NABIDH checks each message for structure, completeness, valid codes and duplicates. Rejected messages must be fixed and resent, so plan for more than one round.

Step four is the launch schedule. After testing, your facility takes a place in the regulator's go-live schedule. Facilities have gone live in waves since October 2020.

After go-live, monitor message delivery. NABIDH returns an HL7 acknowledgment for each message: CA when the message is accepted, CE or CR when it is rejected. Repeated rejections after go-live point to a configuration problem. The NABIDH developer portal also has production monitoring dashboards.

NABIDH connectivity continues after go-live.

Data submission is continuous. The EMR sends messages for each patient event in near real time: registrations and visits, diagnoses coded in ICD-10-CM, procedures in CPT-4 (CDT for dental), medications in Dubai Drug Code, lab and clinical observations in LOINC, problems and allergies in SNOMED CT, plus radiology reports and clinical documents. The Minimum Data Set fixes the patient fields: MRN, first and last name, gender, date of birth, Emirates ID, mobile number, nationality and address. Each message also carries the facility's and the treating clinician's Sheryan IDs.

Consent works differently from what many clinics expect. Under NABIDH policy, records for all patients are sent to NABIDH. A clinician can open a patient's record only after a patient-physician relationship exists, which is created automatically when the encounter is registered. That access lasts 12 months; after that, clinicians use the break-the-glass function. A November 2022 circular requires every facility to add a set NABIDH access-consent sentence to its general consent form. Patients can opt out of NABIDH for one facility or for all facilities. After a global opt-out, NABIDH blocks access to the patient's record even in an emergency, although facilities still send the data. Keep opt-out forms at registration and record each patient's status in the EMR. All user access to the Clinical Portal is audited.

Retention: under the UAE ICT Health Law, health data must be kept for at least 25 years from the date of the last health encounter.

Changing your EMR is a regulated process. The regulator's Guideline for Electronic Medical Record Transition in Healthcare Facilities (effective September 2024) says to tell the NABIDH team at least one month before the switch, to tell them when the old EMR is closed so its connections can be shut down, and to re-integrate the new EMR with NABIDH as soon as possible. The guideline also covers data migration, testing of integrations with regulatory systems, go-live and downtime planning.

Security is shared. The EMR Transition Guideline expects user authentication (multi-factor authentication is recommended), role-based access and audit trails in the EMR. At network level, the regulator announced in April 2025 that it had added Imprivata's Patient Privacy Intelligence to NABIDH, which uses AI analytics to detect possible data breaches in real time. Access controls inside your own EMR remain your facility's responsibility.

Unmapped codes. NABIDH validates the codes in each message against the regulator's code sets: ICD-10-CM for diagnoses, CPT-4 for procedures (CDT for dental), HCPCS Level II for supplies, Dubai Drug Code for medications, LOINC for lab and clinical observations, and SNOMED CT for problems, allergies and other clinical terms. Free text or internal codes that are not mapped to these sets will be rejected. Start the mapping before testing begins, not after the first rejections.

Field-level errors. The HL7 API documentation sets rules for specific fields: the facility's Sheryan ID as the sending facility, the patient's Emirates ID in the patient identifier list (passport or GCC ID when there is no Emirates ID), the visit number for each encounter, and the clinician's Sheryan ID as attending doctor. Test with a varied set of records, including patients without an Emirates ID.

Consent gaps. Before go-live, check that your general consent form contains the regulator's NABIDH access-consent sentence and that registration staff can record facility and global opt-outs.

Sheryan ID errors. Before testing, check every active clinician's Sheryan ID in your EMR against Sheryan, especially for clinicians who joined recently or renewed their license.

Missing single sign-on. The end-2025 deadline for SSO integration has passed, and the regulator said it would then enforce penalties. Confirm that SSO works for every clinician account.

Unmonitored rejections. If nobody reads the CE and CR rejection acknowledgments, encounters can be missing from NABIDH for months. Name one person to review rejected messages every week.