Does DHA require electronic records?

DHA strongly mandates electronic health records as part of its digital health strategy and NABIDH integration requirements. NABIDH connectivity - which is mandatory for all DHA-licensed facilities - requires electronic clinical data in HL7 FHIR R4 format. Paper-only records cannot fulfil the NABIDH transmission requirement, effectively making electronic records a functional regulatory necessity for all DHA-licensed providers in Dubai.

DHA Digital Health Records Requirements UAE | Clinic Compliance Guide

Q: What are DHA medical record requirements?

DHA requires patient records in Dubai to contain patient demographics including Emirates ID, chief complaint, history of presenting illness, past medical and surgical history, family and social history, physical examination findings, ICD-10 coded diagnosis, treatment plan, medications with generic name and dose, referral letters if applicable, follow-up instructions, and patient consent documentation. Records must have a full audit trail of who accessed or modified each entry.

Q: How long must patient records be kept in Dubai?

DHA requires patient medical records to be retained for a minimum of 10 years for adult patients. For minor patients, records must be retained until the patient reaches age 25, or for 10 years from the last visit, whichever is longer. Destruction of records before the retention period expires without DHA authorisation is a regulatory violation.

What Is the DHA and Which Facilities Does It Regulate?

The Dubai Health Authority (DHA) is the governing body responsible for regulating and overseeing all healthcare providers operating in the Emirate of Dubai. This is a critical geographic distinction: DHA's jurisdiction is Dubai only. It does not regulate healthcare in Abu Dhabi (regulated by the Department of Health, DOH), nor in Sharjah, Ajman, Ras Al Khaimah, Fujairah, or Umm Al Quwain (regulated by the Ministry of Health and Prevention, MOHAP).

Every healthcare professional and healthcare facility operating within Dubai's borders — regardless of whether they are in Downtown Dubai, Dubai Healthcare City (DHCC is a special jurisdiction but DHA-affiliated), Jumeirah, Deira, Dubai Marina, or any other area of the emirate — requires a DHA license and is subject to DHA regulations.

DHA's digital health regulations cover two inter-related areas: the content and format of clinical patient records, and the sharing of those records via NABIDH, DHA's Health Information Exchange platform. A clinic can have excellent record content but fail compliance if it is not transmitting that data to NABIDH in real time — and vice versa.

Emirate Clarity: If your facility is licensed by DHA, this guide applies to you. If your facility is licensed by DOH in Abu Dhabi, the relevant HIE is Malaffi, not NABIDH, and record requirements are set by DOH — not DHA. Never assume DHA regulations apply to non-Dubai facilities.

What Must Be in a DHA-Compliant Patient Record?

DHA's Health Record Regulations define the minimum content that must be documented for every patient encounter at a DHA-licensed facility. The following elements are mandatory for every patient record.

Patient Demographics: Full legal name (as per Emirates ID), date of birth, gender, nationality, Emirates ID number (mandatory — no exceptions for international tourists or patients who claim not to have an Emirates ID; passport number is an alternative identifier where Emirates ID is genuinely unavailable), contact telephone number, and emergency contact details.
Chief Complaint: The patient's primary reason for the visit, recorded in the patient's own words or a close clinical paraphrase. "Follow-up" or "refill" alone is not an acceptable chief complaint — the specific symptom or condition must be noted.
History of Presenting Illness (HPI): A narrative description of the onset, character, severity, duration, associated symptoms, aggravating and relieving factors of the presenting complaint. The HPI must be documented by the clinician — not a copied template.
Past Medical History: All known chronic conditions, prior hospitalisations, and significant past illnesses. This must be reviewed and updated at each visit, not simply copied from the previous encounter.
Past Surgical History: All previous surgical procedures with approximate dates.
Family History: First-degree relatives' relevant medical conditions — particularly hereditary conditions relevant to the current complaint (diabetes, cardiac disease, cancer, hypertension).
Social History: Smoking status (current, ex-smoker, never), alcohol use (noting that not all patients will volunteer this but it must be asked), occupation if clinically relevant, and living situation for elderly patients.
Review of Systems: A systematic inquiry of relevant body systems beyond the chief complaint — particularly important for chronic disease management visits.
Physical Examination Findings: System-specific examination findings relevant to the presenting complaint. General observations alone ("patient looks well") are insufficient. Vital signs (blood pressure, heart rate, temperature, respiratory rate, SpO2, BMI) must be recorded at each visit.
Diagnosis with ICD-10 Code: Every encounter must have a documented diagnosis coded to ICD-10-CM. Free-text diagnosis without a corresponding ICD-10 code does not meet DHA's coding requirement. The diagnosis must be consistent with the clinical documentation — a diagnosis not supported by the history and examination findings creates a medico-legal risk and a NABIDH data quality issue.
Treatment Plan: What is being done for the patient — medications prescribed, investigations ordered, procedures performed, lifestyle advice given, and referrals made. The plan must be specific and actionable.
Medications: Generic drug name (mandatory — brand names may be noted additionally but generic name is required), dose, frequency, route of administration, and duration. The prescribing clinician's DHA license number must be recorded for every prescription.
Referral Letters (Where Applicable): If the patient is referred to another provider or facility, a referral letter summarising the clinical reason, relevant history, examination findings, and specific referral request must be generated and filed in the record.
Follow-Up Instructions: The next appointment date or follow-up interval, and any specific instructions to the patient regarding warning symptoms that should prompt earlier return.
Patient Consent: Documented consent for procedures, treatments, and data sharing. For NABIDH specifically, patients must be informed that their clinical data is shared with DHA's HIE platform as part of the facility's regulatory obligations.

E-Prescription Requirements in Dubai

DHA has implemented an e-prescription system as part of its digital health strategy. All DHA-licensed prescribers must use DHA-approved e-prescription formats. The following elements are mandatory in every DHA-compliant prescription.

Mandatory Prescription Fields

Prescribing clinician's DHA license number
Prescribing clinician's full name and specialty
Facility name and DHA facility license number
Date of prescription
Patient's full name
Patient's Emirates ID number
Patient's date of birth
Generic drug name (INN - International Nonproprietary Name)
Dosage strength (e.g., 500mg)
Dosage form (tablet, capsule, syrup, inhaler)
Frequency (once daily, twice daily, etc.)
Route of administration
Total quantity prescribed
Duration of treatment
Diagnosis reference (ICD-10 code)

Prescription Validity Periods

Under DHA and MOHAP regulations applicable in Dubai:

Regular medications: Valid for 3 months from the date of prescribing. Pharmacies may not dispense against an expired prescription.
Controlled substances (Schedule I-IV): Validity varies by schedule — typically 30 days for Schedule I-II controlled medications, following MOHAP Ministerial Resolution No. 58/2009 and subsequent amendments. Always verify current controlled substance prescription rules with MOHAP as these are updated periodically.
Chronic disease repeat prescriptions: For stable chronic conditions (hypertension, diabetes, thyroid), DHA regulations permit clinicians to issue repeat prescriptions for up to 3 months supply at a single visit with appropriate clinical documentation of the stable condition.

Generic Name Requirement

DHA mandates the use of the International Nonproprietary Name (generic name) on all prescriptions. A clinician may additionally note the preferred brand, but the generic name must appear as the primary drug identifier. This requirement supports pharmaceutical substitution at the pharmacy level and ensures NABIDH medication records are drug-specific rather than brand-specific, enabling cross-facility drug interaction checking.

Compliance Note: Prescriptions that list only a brand name without the generic INN name are non-compliant with DHA regulations. Pharmacies are required to check prescriptions for DHA compliance before dispensing. A non-compliant prescription may be rejected at the pharmacy, creating patient inconvenience and a record of non-compliance for the prescribing clinician.

Record Retention Requirements in Dubai

DHA's Health Record Regulations specify minimum retention periods for patient medical records. These are not optional guidelines — non-compliant destruction of records is a regulatory violation.

Adult Patient Records

Patient medical records for adult patients (18 years and above at the time of the last visit) must be retained for a minimum of 10 years from the date of the last clinical encounter. This applies to all formats — electronic records in the HMS and any associated paper records. After the 10-year period, records may be destroyed only in accordance with a documented records management policy and with appropriate data security for any electronic records (secure deletion, not simple file deletion).

Minor Patient Records

Records for patients who were minors (under 18 years) at the time of treatment must be retained until the patient reaches age 25, or for 10 years from the last visit, whichever period is longer. This extended retention recognises the potential for medico-legal claims related to childhood conditions to arise after the patient reaches adulthood.

Deceased Patient Records

Records of deceased patients must be retained for the same minimum periods as if the patient were alive — 10 years from the last clinical encounter or, if the patient was a minor, until the date they would have reached age 25. Deceased patient records are frequently requested in medico-legal proceedings related to estate claims, insurance disputes, or coronial inquiries.

Practical Implications for Cloud vs On-Premise

The 10-year retention requirement has significant implications for cloud HMS contracts. Before signing any SaaS agreement, confirm: what happens to your records if the contract is terminated? Is data exported to you in a usable format? Is there a secure deletion certificate for any data the vendor destroys? A DHA-compliant records management policy must address these questions explicitly.

NABIDH Sharing Obligation

Every DHA-licensed facility's patient record system must not only store clinical data internally but must also transmit defined clinical events to DHA's NABIDH Health Information Exchange in real time. This is a separate but linked obligation to the record content requirements.

What Must Be Shared via NABIDH

All clinical events generated at a DHA-licensed facility must be transmitted to NABIDH, including: patient demographics with Emirates ID, ICD-10 coded diagnoses, medications prescribed, laboratory results, procedures performed, documented allergies and adverse reactions, vital signs, referrals, and discharge summaries for inpatient episodes. The transmission must occur in real time using the HL7 FHIR R4 API — end-of-day batch uploads do not comply with DHA's real-time requirement.

Patient Consent for NABIDH

NABIDH data sharing is a regulatory requirement — patient consent is required as an informational obligation (patients must be informed that their data is shared with DHA's HIE as a condition of receiving care at a DHA-licensed facility) rather than as an opt-in consent. Patients cannot opt out of NABIDH sharing while receiving care at a DHA-licensed facility. However, patients do have rights to access their own NABIDH records through the DHA patient portal.

Compliance Reminder: A facility may have excellent clinical documentation that fully meets DHA's record content standards but still be non-compliant if that data is not being transmitted to NABIDH. DHA conducts technical audits of NABIDH transmission logs — not just document inspections — during facility inspections. Both dimensions of compliance must be maintained simultaneously.

Audit Trail Requirements

DHA requires that all electronic health records systems maintain a comprehensive, tamper-evident audit trail for every patient record. The audit trail is a fundamental component of DHA digital health record compliance.

What the Audit Trail Must Capture

Every user who accessed the patient record (user ID, date, time)
Every modification made to any field in the record (original value, new value, user who made the change, timestamp)
Every document created or added to the record
Every prescription generated against the record
Every NABIDH transmission event (data sent, timestamp, success or failure)
Every print or export of the patient record or any portion of it

Audit Trail Integrity Requirements

The audit trail must be tamper-evident — no user, including system administrators, should be able to delete or modify audit log entries. The audit trail must be stored separately from the clinical data it logs, using a write-once or append-only mechanism. Audit logs themselves must be retained for the same minimum period as the patient records they document — at least 10 years. DHA inspectors may request to review audit trail reports during facility inspections, including verification that specific record access events were appropriately authorised.

Access Control Linked to Audit

Audit trail integrity requires robust access control: every person who accesses the HMS must use an individual named login — shared logins are non-compliant because they make it impossible to attribute specific access events to a specific individual. System administrators must be assigned administrative access accounts separate from their clinical access accounts. Password policies must enforce minimum complexity and regular rotation.

DHA Inspection Process — What Inspectors Check

DHA conducts routine and targeted inspections of DHA-licensed healthcare facilities. Understanding what inspectors examine allows facilities to maintain inspection-ready compliance at all times.

Document Review

Inspectors typically request a sample of 10-20 patient records from the past 3 months for content review. They check for completeness: Is Emirates ID captured? Is the diagnosis ICD-10 coded? Are vital signs recorded? Is the prescription in the correct format with generic name and clinician license number? Is follow-up documented? Missing elements in a majority of sampled records trigger a compliance finding requiring a formal corrective action plan.

NABIDH Transmission Verification

Inspectors access the DHA NABIDH monitoring dashboard to verify the facility's transmission status. They check: Is the facility actively transmitting to NABIDH? What is the transmission success rate? Are there a backlog of failed transmissions that have not been resolved? A high failure rate or evidence that NABIDH transmission has been interrupted for an extended period is treated as a serious compliance failure.

Prescription Compliance Review

Inspectors may review the facility's prescription records — either in the HMS or via the DHA e-prescription audit log — to verify that all prescriptions include the required elements: generic name, clinician DHA license number, patient Emirates ID, and correct validity periods for controlled substances.

Access Control and Audit Trail Review

Inspectors may request to see the audit trail for specific patient records to verify that access was by appropriately authorised individuals. They may also check that the HMS enforces individual named logins and that there are no shared user accounts in use.

DHA Penalty Framework: DHA's regulatory action for non-compliant records management ranges from a formal warning and corrective action plan for minor or first-time documentation gaps, to financial penalties for systematic non-compliance, to suspension or non-renewal of the healthcare facility license for repeated or serious violations including failure to maintain NABIDH connectivity. DHA takes digital health record compliance seriously as a patient safety matter — not merely an administrative one.

How to Ensure Your Software Is DHA-Compliant

Use this checklist to evaluate whether your current HMS — or any HMS you are evaluating — meets DHA's digital health record requirements.

Emirates ID captured as a mandatory field at patient registration — not optional
ICD-10-CM coded diagnosis selection required at every consultation — not free text only
Vital signs (BP, HR, temperature, respiratory rate, SpO2, BMI) recorded at every consultation with fields in the standard consultation template
Prescription module captures generic drug name, dose, frequency, route, quantity, duration, and clinician's DHA license number automatically from the user account
Prescription validity period enforced by the system — warnings for prescriptions approaching expiry
NABIDH connectivity via HL7 FHIR R4 with real-time transmission on record finalisation
NABIDH transmission log dashboard showing success/failure per encounter, accessible to clinic management
Full audit trail capturing every access, modification, and prescription event with user identity and timestamp
Individual named user logins enforced — no shared account capability
Records retention management — no automatic deletion of records within the 10-year or until-age-25 retention window
Data encrypted at rest and in transit to meet DHA information security requirements

What MedicoPlus Provides: Every item on this checklist is a built-in feature of MedicoPlus, configured for DHA's requirements as a default — not optional add-ons. When a clinician finalises a consultation in MedicoPlus, all DHA-required content fields are enforced as mandatory before the record can be saved, and the NABIDH transmission is triggered automatically. The audit trail and access controls are always active, with no configuration required from the facility.

Frequently Asked Questions - DHA Digital Health Records

What are DHA medical record requirements?

DHA requires patient records at all Dubai-licensed facilities to contain: patient demographics including Emirates ID, chief complaint, history of presenting illness, past medical and surgical history, family and social history, review of systems, physical examination findings, ICD-10 coded diagnosis, treatment plan, medications with generic name and dose, referrals if applicable, follow-up instructions, and patient consent documentation. Every record must have a complete audit trail of all access and modifications, and all clinical data must be shared with DHA's NABIDH HIE in real time.

How long must patient records be kept in Dubai?

DHA requires adult patient records to be retained for a minimum of 10 years from the date of the last clinical encounter. For patients who were minors at the time of treatment, records must be retained until the patient reaches age 25 or for 10 years from the last visit, whichever is longer. Destruction of records before the retention period expires without DHA authorisation is a regulatory violation that can result in penalties.

Does DHA require electronic health records?

DHA does not explicitly prohibit paper records by a single stated law, but the NABIDH integration requirement effectively makes electronic records a functional necessity. NABIDH requires real-time transmission of clinical data in HL7 FHIR R4 format — a standard that cannot be fulfilled by paper records. Any DHA-licensed facility that uses paper records cannot comply with NABIDH and is therefore structurally non-compliant with a mandatory DHA requirement. In practice, all DHA-licensed facilities must use an electronic HMS with NABIDH connectivity.

What must a DHA-compliant prescription include?

A DHA-compliant prescription must include: the prescribing clinician's DHA license number, the prescribing clinician's name and specialty, the facility's name and DHA license number, the date of prescription, the patient's full name and Emirates ID, the drug's generic name (INN - mandatory; brand name may be added but cannot replace the generic name), dosage strength, dosage form, frequency, route of administration, total quantity, duration of treatment, and the relevant ICD-10 diagnosis code. Regular medications are valid for 3 months from the prescription date. Controlled substances have shorter validity periods regulated by MOHAP Ministerial Resolution requirements.

DHA Digital Health Records Requirements - UAE Clinic Compliance Guide