The UAE's health information exchanges are now linked into one national record, and 2026 brought firm deadlines. Being connected is the starting point. Here is what it takes for your data to be useful once it arrives.
Few countries have connected their health system as thoroughly as the UAE. Abu Dhabi, Dubai and the Northern Emirates each built their own health information exchange, and in 2026 those exchanges were linked into a single national record. A clinician in Al Ain can now, in principle, see what happened to a patient in Dubai or Fujairah.
For clinics, hospital groups and laboratories, this has turned data exchange from a project into a licensing and operational requirement. Most providers have already done the hard technical work of connecting. The question this year has quietly changed from "are we connected?" to "is what we send actually useful to the next clinician?"
This article sets out seven things to get right. It is written for UAE clinics, hospital groups and laboratories, and for the EMR (electronic medical record) and clinic management system vendors who support them. It ends with a practical checklist.
The UAE has a layered system, and each layer has its own regulator, onboarding process and rules.
In Abu Dhabi, the Department of Health (DoH) mandates Malaffi. Launched in 2019, it is operated by Abu Dhabi Health Data Services, a public private partnership with DoH that is part of M42. Malaffi now gives providers access to more than 3.5 billion clinical records from over 3,000 healthcare facilities (August 2025).
In Dubai, the Dubai Health Authority (DHA) runs NABIDH, which connects public and private facilities across the emirate and holds a unified medical file for each patient.
At national level, the Ministry of Health and Prevention (MoHAP) operates Riayati. Emirates Health Services uses its Wareed system across its hospitals and facilities in the Northern Emirates, and Wareed is integrated with Riayati. Riayati shares health information across more than 3,000 facilities and is now integrated with both NABIDH and Malaffi.
Figure 1. The UAE's exchanges at a glance. Each emirate-level platform keeps its own rules, while Riayati links them nationally.
The national link is good news for patients, but it does not replace local obligations. A hospital group with facilities in Abu Dhabi and Dubai still answers to two regulators, two onboarding processes and two sets of technical specifications. Map each facility to its exchange, and name an owner for each connection.
Both emirates have made participation compulsory. In January 2026, DoH required every Abu Dhabi facility to have its minimum datasets connected and successfully transmitting to Malaffi within six months. In Dubai, a May 2025 DHA circular required facilities to implement an EMR system compliant with NABIDH integration requirements, together with single sign-on, and listed the facilities compulsory to integrate.
Figure 2. Recent exchange mandates. Each one raises the bar on what the data must be able to do, not only whether it is sent.
Passing an onboarding test proves that messages flow. It does not prove that the data inside them is complete, current or correct. A facility can be fully connected and still send results with missing units, diagnoses recorded only as free text, or a patient split across two records.
The exchanges define how data travels. NABIDH recognises HL7 (Health Level Seven) standards including version 2 messaging, the Clinical Document Architecture and FHIR (Fast Healthcare Interoperability Resources) Release 4. Abu Dhabi publishes its own data dictionary and expects healthcare entities to keep their systems up to date with it. These standards are the envelope. What matters just as much is what sits inside.
Dubai's own experience shows why. A published review of the NABIDH rollout describes how facilities were using a variety of coding standards that were not technically compatible with integration, and found poor data quality to be a significant challenge, including multiple medical record numbers for the same patient within one facility.
In practice, this is the everyday work of making records mean the same thing everywhere. A fasting glucose may be recorded under several different local names, in different units, with different reference ranges. Medications may be recorded by brand in one system and by generic name in another. Some institutions also maintain their own local code sets for good reasons, and those need to be mapped carefully rather than overwritten. Diagnoses, laboratory results, medications, allergies and procedures all need to be mapped to medical coding standards before they can be compared or trended across providers.
A large share of the clinical information a provider holds never started life as structured data. Reference laboratory results arrive as PDFs. Referral letters and discharge summaries from other hospitals are scanned. Imaging reports, device readings and clinical notes sit in documents attached to the record rather than in fields within it.
An exchange can carry a document, and a clinician can open it. But a document cannot be trended, cannot trigger an alert, and cannot tell the next clinician that a test was done last week without someone reading it line by line. If a clinician cannot find the result quickly, the likely outcome is that the test is repeated.
Figure 3. Connected is not the same as usable. The work in the middle is what turns documents and local terms into data the next clinician can rely on.
Automation, including AI, can do much of this extraction at scale. In healthcare, it needs clinical review and a clear audit trail behind it, because a misread unit or a result attached to the wrong patient becomes everyone's problem once it is shared across a national record.
The UAE's population is unusually international. A large share of patients carry health histories that were created in other countries, in other languages and in other systems. A resident arriving from India, the Philippines, the United Kingdom or South Africa may bring years of laboratory results, medication histories and specialist letters, usually as paper or PDF.
These records rarely fit local systems neatly. Units differ (glucose is commonly reported in milligrams per decilitre in some countries and millimoles per litre in others), test names differ, and medications may be sold under brand names that do not exist locally. When local systems cannot take this history in, patients are often retested, which is exactly the duplication the 2026 Malaffi requirements are designed to reduce.
This is a large enough topic that we will look at it in more depth in a follow-up article on expatriate health records in the UAE.
Federal Law No. 2 of 2019 on the use of information and communications technology in health fields applies across the UAE, including its free zones. By default, health data related to services provided in the UAE may not be stored, processed, generated or transferred outside the country unless an exemption applies. A 2021 Ministerial resolution clarified a set of permitted exemptions, and in most permitted cases, a copy of the data must be kept in the UAE. The law also requires health data to be retained for at least 25 years from the patient's last health procedure.
Figure 4. The default under Federal Law No. 2 of 2019. Check the exemptions with your legal adviser before any data leaves the country.
Abu Dhabi has added a further layer. DoH's Data Sharing, Integration and Interoperability Standard, effective April 2026, governs how data is shared and integrated across the Abu Dhabi healthcare ecosystem, including through data sharing agreements.
This matters most when you bring in outside help. Many of the tools now used to extract and standardise records, including large language models, process data on servers outside the country by default. Before you use any tool or partner to prepare your data, ask where processing happens, where any human reviewers access the data from, whether identifiers are needed at all, and how long anything is kept.
The newest mandates are not about connecting. They are about using the exchange in care. Since February 2026, Abu Dhabi clinicians, including doctors and nurses, must use Malaffi before requesting any laboratory or radiology examination, so that unnecessary tests are not repeated. In July 2026, DoH also required facilities to submit referral data to Malaffi to support the Abu Dhabi Primary Care Model, with a deadline of 31 August 2026.
Both requirements assume that what the clinician sees is trustworthy. If last month's result sits in an unopened PDF, is recorded under an unfamiliar name or is attached to a duplicate record, the clinician will reasonably order the test again. The mandate is followed, but the benefit for the patient is lost. The quality of what each provider sends decides whether these workflows deliver what they were designed to do, for patients and for the provider's own costs.
Malaffi, Arabic for "my file", is Abu Dhabi's health information exchange. It was launched in 2019 as a strategic initiative of the Department of Health and is operated by Abu Dhabi Health Data Services, part of M42.
NABIDH, the National Backbone for Integrated Dubai Health, is the Dubai Health Authority's health information exchange. It connects public and private facilities in Dubai so each patient has a unified medical file, and integration is compulsory for DHA-licensed facilities.
Riayati is the national unified medical record operated by the Ministry of Health and Prevention. It is linked to Wareed, the system Emirates Health Services uses in the Northern Emirates, and is now integrated with both Malaffi and NABIDH to create a national health record.
By default, yes. Under Federal Law No. 2 of 2019, health data related to services provided in the UAE may only be stored, processed or transferred outside the country under defined exemptions, and in most permitted cases a copy must remain in the UAE. This article is general information, so please confirm your own position with a legal adviser.
We write "clinic management system" in full throughout. In US health policy, CMS usually refers to the US Centers for Medicare & Medicaid Services, which is unrelated.
The UAE has built some of the most connected health infrastructure in the world. The next step is making sure the data flowing through it is data clinicians can trust. There are two ways we can support you.
This article is for general information and is not legal advice.
Suhina Singh is a physician, the Founder and CEO of Jonda Health, and a health data strategist working at the intersection of artificial intelligence and clinical information systems.
