NABIDH, Malaffi or Riayati: which health information exchange applies to your UAE clinic?
It depends on who licensed the branch. A Dubai Health Authority (DHA) licence means NABIDH, with claims through eClaimLink. A Department of Health – Abu Dhabi (DoH) licence means Malaffi, with claims through Shafafiya. A MOHAP licence in the northern emirates means Riayati and its e-Claims Post Office. Sharjah has its own regulator, so check with it.
The UAE has three health information exchanges, not one. Each belongs to a different regulator, and each regulator also runs its own route for insurance claims. The emirate where you practise doesn’t settle it. The licence does. A group with branches in two emirates carries two sets of obligations.
This page puts the three side by side, with the claims platform for each. Everything on it comes from the regulators’ own documents and the exchanges’ own pages, read on 6 November 2026. The sources and their dates are listed at the end.
The three exchanges, side by side
| Emirate | Regulator | Health information exchange | Claims platform | Who has to connect |
|---|---|---|---|---|
| Dubai | Dubai Health Authority (DHA) | NABIDH | eClaimLink | DHA applies the NABIDH standards to every DHA-licensed facility, public and private. A facility applies to DHA to start onboarding. |
| Abu Dhabi | Department of Health – Abu Dhabi (DoH) | Malaffi | Shafafiya | Every DoH-licensed facility, apart from the exempt groups and the licence types Malaffi lists as not required. Connection is a condition of licence renewal. |
| Ajman, Umm Al Quwain, Ras Al Khaimah, Fujairah | Ministry of Health and Prevention (MOHAP) | Riayati (the National Unified Medical Record) | Riayati e-Claims Post Office | MOHAP describes Riayati as connecting public and private providers. Confirm the onboarding steps for a private facility with MOHAP. |
| Sharjah | Sharjah Health Authority (SHA) for private facilities | Verify with SHA | Verify with SHA | Sharjah regulates its own private facilities. Federal government facilities in Sharjah are outside that regime. Confirm the route with SHA. |
A health information exchange shares clinical records between providers. A claims platform carries insurance transactions between providers, insurers and third-party administrators (TPAs). In Dubai and Abu Dhabi these are separate systems run by the same regulator, and most clinics need both.
Dubai: NABIDH, under the Dubai Health Authority
NABIDH is DHA’s health information exchange. DHA describes it as the platform connecting public and private facilities in Dubai so that they can exchange health information securely. Its Technical and Operational Standards apply to every DHA-licensed facility, public and private, and require every facility to comply with the published NABIDH standards.
What starts onboarding. DHA’s coding standard says a licensed facility that decides to integrate applies to the Health Informatics and Smart Health Department at [email protected] for permission to begin onboarding. We could not find a DHA document that sets a deadline or makes NABIDH a condition of licence renewal. Ask DHA where that applies to you.
What the system has to send. DHA’s Standards for Interoperability and Data Exchange (Version 2, effective 2 July 2025) name HL7 v2 as the recommended standard for submitting data. They also expect systems to support FHIR R4 and IHE profiles. The NABIDH technical standards list the HL7 messages:
- ADT patient events: register, admit, transfer, discharge, update, merge and cancel.
- ORU^R01 for observations and results.
- MDM for clinical documents: new documents, status changes and cancellations.
- ORM^O01 and RDE^O11 for medication and pharmacy orders.
- VXU^V04 for vaccination records.
Which codes. DHA’s Standards for Clinical Data Coding and Terminology (Version 2, effective 3 November 2023) require these code sets:
- ICD-10-CM for diagnoses
- CPT-4 for procedures
- HCPCS Level II for supplies
- CDT and the Universal Numbering System for dental work
- the Dubai Drug Code for medicines
- LOINC for laboratory and clinical observations
- CVX for vaccines
SNOMED CT, RxNorm, CDA and IR-DRG are optional.
Abu Dhabi: Malaffi, under the Department of Health
Malaffi is Abu Dhabi’s health information exchange. DoH’s Policy on the Abu Dhabi Health Information Exchange (effective 16 April 2020) sets out the aim that every licensed facility in the emirate takes part. Under it, each facility signs a participant agreement and supplies its patient data to the platform. It pays for its own connection and keeps the systems that use exchange data compliant with the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS). A group company also declares every facility it is responsible for.
Who must connect, and what happens if you don’t. Malaffi says every DoH-licensed facility must connect, except military, police, aviation and university facilities and any other category it designates. It says the deadline for facilities with an active licence has closed. A facility that should have connected and has not can’t renew its DoH licence. And a facility with a Daman agreement can’t submit claims until it connects. A facility holding a preliminary licence connects before it gets its active licence. Malaffi asks it to make contact at least two months before applying.
What the facility needs. Malaffi lists four things:
- an Accession Agreement and Facility Declaration, requested from [email protected]
- a pass in the Malaffi Security Assessment, which is an excerpt of the ADHICS survey
- an HL7-capable EMR
- an SD-WAN connection from Etisalat, for which Malaffi issues the no-objection certificate
Connecting the EMR is free. The secure connection is the provider’s cost.
Which licence types. Malaffi publishes a table by DoH licence type. A summary:
| DoH licence type | Must connect to Malaffi? |
|---|---|
| Clinics (general, specialised, dental, medical) | Yes |
| Centres (dental, medical, one-day surgery, primary health care) | Yes. Sports-club centres without a physician can ask to be excluded |
| Hospitals, including rehabilitation hospitals and nursing homes | Yes |
| Diagnostic centres, laboratories and imaging | Yes |
| Pharmacies (inpatient and outpatient) | Yes |
| Home care services | Yes |
| Telemedicine providers | Yes |
| Standalone rehabilitation licences: physiotherapy, occupational therapy, speech therapy, psychology, dietitian | No |
| Ambulance, medical transport, medical stores, optical shops, traditional and complementary medicine | No |
Malaffi says DoH may change the list at any time. Check the current page before you rely on it.
The northern emirates: Riayati, under MOHAP
Riayati is the digital platform for the UAE’s National Unified Medical Record, run by MOHAP. MOHAP describes it as connecting public and private providers into one national record, built with DoH, Emirates Health Services and DHA. It serves facilities in the northern emirates that MOHAP regulates. In June 2022 MOHAP said Riayati would bring more private providers under its cover.
We could not find a MOHAP document that sets out the onboarding steps, message specifications or deadline for a private clinic, so we don’t list any here. If your licence is from MOHAP, confirm the requirements with MOHAP before you choose or change a system.
Sharjah: check with the Sharjah Health Authority
On 15 July 2025 the Sharjah Executive Council issued a decision regulating health activities and professions in the emirate, including its free zones. The decision covers private health facilities, and the Sharjah Health Authority licenses them. Federal government facilities in Sharjah are outside it. Because Sharjah regulates its own private sector, confirm with the Sharjah Health Authority which exchange and which claims route apply to your facility.
The claims side: eClaimLink, Shafafiya and the Riayati e-Claims Post Office
| Emirate | Platform | What the regulator requires | Recent change |
|---|---|---|---|
| Dubai | eClaimLink (DHA) | Every provider sends insurance claims electronically through eClaimLink, to every insurer and TPA, for every service in Dubai. That has applied since 1 January 2013. Each licensed facility registers on its own facility ID. | A new Claims Management Policy Directive took effect on 16 November 2025. It covers prior authorisation, submission, adjudication and settlement, and it replaced the earlier claims rules. |
| Abu Dhabi | Shafafiya (DoH) | Licensed entities use electronic person-register, claim and remittance transactions only. Shafafiya also defines prior request, prior authorisation and e-prescription transactions. | From 1 July 2026, providers send shadow billing under the Abu Dhabi Outpatient Classification (ADOC) through Shafafiya. ADOC becomes the main way outpatient care is reimbursed from 1 January 2027. |
| Northern emirates | Riayati e-Claims Post Office (MOHAP) | It handles the whole claim workflow between facilities and insurers: eligibility and coverage checks, prior authorisation, claim submission, payment information and denials, on one coding set. | MOHAP first launched the Post Office in October 2020. By October 2022 it reported 40 insurers and more than 1,000 facilities linked. |
Dubai. DHA Circular No. 35 of 2012 made eClaimLink the route for every insurance claim in Dubai from 1 January 2013. Under it, group providers register each licensed facility separately. The Claims Management Policy Directive from the Dubai Health Insurance Corporation took effect on 16 November 2025. According to Al Tamimi & Company’s summary, it sets these limits:
- a prior authorisation request goes in within one hour of the physician’s order
- insurers and TPAs answer within six hours for elective outpatient care, within 24 hours for elective inpatient care, and immediately for emergencies
- payment is due within 45 days for an initial claim and 30 days for a resubmission
- a disputed claim can be resubmitted twice
Read the directive itself before you build a process around those numbers.
Abu Dhabi. DoH’s data standard requires licensed entities to use electronic person-register, claim and remittance transactions only. The Shafafiya data dictionary defines claim submission, remittance advice, prior request, prior authorisation and e-prescription transactions. DoH also publishes Claims and Adjudication Rules on Shafafiya. DoH Circular No. 76 of 2026 started ADOC shadow billing through Shafafiya on 1 July 2026. From 1 January 2027, ADOC becomes the main way outpatient services are reimbursed.
Northern emirates. MOHAP’s e-Claims Post Office sits inside Riayati. MOHAP says it covers the claim workflow from eligibility and coverage checks to prior authorisation, submission, payment information and denials. Authorised users at a facility can follow a claim there without going through the insurer.
A clinic with branches in two emirates
The rules follow each branch’s licence, not the group. A clinic with a Dubai branch and an Abu Dhabi branch has these steps:
- Dubai branch. Apply to DHA to start NABIDH onboarding. Send HL7 v2 messages, and code to DHA’s required sets, including the Dubai Drug Code for medicines. Register on eClaimLink under that branch’s own facility ID.
- Abu Dhabi branch. Sign Malaffi’s Accession Agreement and Facility Declaration, and list every facility in the group declaration. Pass the security assessment, connect an HL7-capable EMR over the SD-WAN link, and claim through Shafafiya. Plan for ADOC on outpatient claims from 1 January 2027.
- One EMR, two interfaces. One system can serve both branches if it supports both exchanges. Malaffi publishes a list of EMRs with at least one connected client. It notes that being listed doesn’t mean a system meets DoH’s other requirements. Ask a vendor which exchanges it is live on today, not which it plans to support.
- Two claim rulebooks. Timelines, prior-authorisation rules and coding differ between eClaimLink and Shafafiya. A claims team that works both needs both rulebooks.
- A third branch in the northern emirates or Sharjah. Add MOHAP’s or the Sharjah Health Authority’s requirements, confirmed with that regulator.
Where Xamun fits
Xamun doesn’t run an exchange or a claims platform, and the exchange connection is your EMR’s job. ClinicOS runs specialty services, such as rehab and therapy, alongside the EMR. Its Malaffi, NABIDH and Riayati document feeds go through the clinic’s existing integration route. InsureOS is the payer side: claims adjudication for insurers, HMOs and TPAs. More on both is in Healthcare at Xamun.
Frequently asked questions
Is connecting to NABIDH mandatory for a Dubai clinic?
DHA says its NABIDH standards apply to every DHA-licensed health facility, public and private, and that every facility must comply with the published NABIDH standards. A facility starts by applying to DHA at [email protected] for permission to begin onboarding. We could not find a DHA document that sets a deadline or ties NABIDH to licence renewal, so ask DHA for your facility.
Does every Abu Dhabi facility have to connect to Malaffi?
Every DoH-licensed facility must connect, except the exempt groups (military, police, aviation, universities and others Malaffi designates) and the licence types Malaffi lists as not required. Malaffi says the deadline has closed, a facility that has not connected cannot renew its DoH licence, and a facility with a Daman agreement cannot submit claims until it connects.
Does a physiotherapy centre in Abu Dhabi need to connect to Malaffi?
It depends on the licence. Malaffi lists the standalone rehabilitation sub-types, physiotherapy, occupational therapy, speech therapy, psychology and dietitian, as not required to connect. Clinics, medical centres and rehabilitation hospitals are required. Check your licence type with [email protected].
What is the difference between Malaffi and Shafafiya?
Malaffi is Abu Dhabi’s health information exchange: it shares clinical records between providers. Shafafiya is DoH’s platform for insurance transactions: claims, remittances, prior authorisations and e-prescriptions. A licensed Abu Dhabi clinic usually needs both.
Which platform does a clinic in Ajman, Ras Al Khaimah, Fujairah or Umm Al Quwain use?
Facilities regulated by MOHAP use Riayati, the National Unified Medical Record, and its e-Claims Post Office for insurance claims. MOHAP has not published an onboarding checklist for private facilities that we could find, so confirm the steps with MOHAP.
My clinic has branches in Dubai and Abu Dhabi. Do we need both NABIDH and Malaffi?
Yes. The obligations follow each branch’s licence. The Dubai branch follows DHA’s NABIDH standards and claims through eClaimLink under its own facility ID. The Abu Dhabi branch signs Malaffi’s agreement, passes its security assessment, connects an HL7-capable EMR and claims through Shafafiya.
This page is Xamun’s reading of the regulators’ documents, not advice from DHA, DoH, MOHAP or the Sharjah Health Authority. Confirm with your regulator, a lawyer or your insurer before you rely on it.
Sources
- Dubai Health Authority, “Standards for Interoperability and Data Exchange”, DHA/HISHD/ST-02, Version 2, issued 2 April 2025, effective 2 July 2025: scope (all DHA-licensed facilities), HL7 v2 recommended, FHIR R4 and IHE profiles. Source
- Dubai Health Authority, “NABIDH Policies and Standards, Section 11: Technical and Operational Standards”, v1.0, September 2020 (last updated 1 September 2020): applies to all DHA-licensed facilities; the HL7 ADT, ORU, MDM, ORM, RDE and VXU messages. Source
- Dubai Health Authority, “Standards for Clinical Data Coding and Terminology”, HISHD/ST-01, Version 2, issued 3 August 2023, effective 3 November 2023: the onboarding application and the required and optional code sets. Source
- Dubai Health Authority, Circular No. 35/2012 “E-Claim Program” (CIR-2012-SHN0062), 4 December 2012: electronic claims through eClaimLink from 1 January 2013; each licensed facility registers on its own facility ID. Source
- Al Tamimi & Company (law-firm summary), “Dubai Issues Comprehensive Overhaul Of Health Insurance Claims Management Framework”, 31 October 2025: the DHIC Claims Management Policy Directive, effective 16 November 2025. Source
- Department of Health – Abu Dhabi, “Policy on the Abu Dhabi Health Information Exchange”, DOH/POL/STR/HIE/1.1/2020, effective 16 April 2020, classified Public: universal participation, the participant agreement, ADHICS, connection at the facility’s own cost. Source
- Malaffi (Abu Dhabi Health Data Services), “Facilities required to connect”, read 6 November 2026: exemptions, licence renewal, Daman claims, onboarding requirements and the licence-type table. Source
- Malaffi, “Connected EMR Systems”, read 6 November 2026: a listed EMR is not certified for other DoH requirements; connecting is free, the secure connection is the provider’s cost. Source
- Health Authority – Abu Dhabi (now DoH), “Data Standard”, fourth revision 14 April 2014: electronic PersonRegister, Claims and Remittance transactions only. Source
- Department of Health – Abu Dhabi, Shafafiya data dictionary: Claim Submission, Remittance Advice, Prior Request, Prior Authorization and Electronic Prescription schemas. Source
- Department of Health – Abu Dhabi, Circular No. 76 of 2026, 14 May 2026: ADOC shadow billing through Shafafiya from 1 July 2026, the main outpatient reimbursement method from 1 January 2027. Source
- Ministry of Health and Prevention, “MoHAP launches ‘Post Office’ initiative to improve health insurance claims process”, 10 October 2020. Source
- Ministry of Health and Prevention, “MoHAP launches ‘Riayati Post Office’ service”, 22 June 2022: Riayati as the National Unified Medical Record, built with DoH, EHS and DHA. Source
- Ministry of Health and Prevention, “MoHAP showcases latest developments introduced to E-Claims Post Office”, 11 October 2022: the claim workflow covered, 40 insurers, more than 1,000 facilities. Source
- Sharjah Executive Council, decision regulating health activities and professions, 15 July 2025: applies to private health facilities in Sharjah and its free zones, not to federal government facilities. Source