DHA Compliance Checker for Dubai Clinics

1. Is patient data stored on UAE-hosted infrastructure?

AWS Middle East, Azure UAE North, or licensed on-prem inside a UAE facility. Not us-east-1.

2. Are you integrated with Nabidh (Dubai) or Riayati (federal)?

Mandatory HIE integration for licensed facilities in the relevant emirate.

3. Are diagnoses coded in SNOMED CT (not free-text)?

SNOMED-coded diagnoses map cleanly to insurance and Nabidh. Free-text kills interop.

4. Does your system generate eClaim XML for insurance submission at point-of-care?

Batch export at end-of-week isn't compliant — claims should submit same-day.

5. Is patient consent captured with timestamp, source, and amendment history?

Consent isn't a checkbox — DHA audits look for the amendment trail.

6. Is your patient portal available in Arabic with medical-grade terminology?

Not Google Translate. Consent language and medical terms need specialist translation.

7. Do all clinical users have MFA (multi-factor authentication)?

Password alone doesn't meet DHA access control expectations for clinical roles.

8. Do you have a documented breach notification process (within 72h to DHA)?

Named responsible party, escalation tree, drafted comms template.

9. Are audit logs retained per DHA requirement (typically 7 years)?

Log everything: reads, writes, exports, deletions. Retention on cheap cold storage is fine.

10. Can patients export their own data on request (patient-rights)?

Machine-readable format, delivered within the statutory response window.