DHA & DOH Compliance Services for UAE Health Software

MOHAP is the federal Ministry of Health and Prevention and regulates the Northern Emirates — Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah and Fujairah — where DHA and DOH have no jurisdiction. It also operates Riayati, the national unified medical record. A vendor selling nationally is therefore building against three regimes, not one, and should decide early whether Northern Emirates coverage is in scope or a later phase.

Federal Decree-Law No. 45 of 2021 is the baseline and applies UAE-wide. On top of it, DHA and DOH each add health-specific requirements covering data localization, role-based access control and audit logging. The practical consequence is architectural: where patient data physically resides and which cloud region serves it has to be settled before build, because reversing it once a system is in assessment is expensive.

Plan it in phases rather than as a single number. Registration and documentation is largely administrative. The build and conformance mapping is the longest phase and scales with how far your data model sits from the published implementation guide and how many local code sets need mapping. Assessment itself then depends partly on a review queue outside your control. For a vendor with a working product and a contained scope, a few months per Emirate is realistic; a multi-facility group with legacy systems should plan for longer. The biggest variable is how many assessment cycles you need, which is why we validate continuously during the build.

Almost always a compliance layer rather than a rebuild, and that is the more common engagement. We read your existing data model, map local codes to the required standards, reconcile patient identity to Emirates ID, and emit conformant FHIR to NABIDH or Malaffi alongside the system your clinicians already use. This also avoids depending on your EMR vendor to extend their product, which matters when the vendor is unwilling or the version is old.

Cost tracks the integration surface rather than a per-facility price. The drivers are how far your current data model is from the published FHIR implementation guides, how many Emirates are in scope, how many downstream systems connect, and whether you need support after approval. We scope in two steps: a paid discovery producing an integration inventory and conformance plan, then a fixed or phased build against that plan. We do not publish a headline price because a number given before seeing your system would be a guess, and the discovery output is useful to you even if you build elsewhere.

If the facility is DHA-licensed, NABIDH connectivity is mandatory; if DOH-licensed, Malaffi connectivity is mandatory. The rollouts are phased by facility type, and new licence applicants are expected to demonstrate connectivity capability as part of licensing. In practice this means the integration determines whether the facility can operate, not just whether it is compliant.

Yes. Licensure is Emirate-scoped: a clinician licensed by DHA is not thereby licensed by DOH. Prescription authority, order signing and telehealth eligibility all depend on verification against the registry of the Emirate where care is actually delivered. That makes the registry check a runtime call in the clinical workflow rather than a one-time onboarding step.

Yes, as a defined scope rather than an informal understanding. NABIDH, Malaffi and the claims platforms are live systems: implementation guides are versioned, payer behaviour changes and code systems get revised, so a connection that passed assessment can begin failing quietly. Post-approval scope covers submission and rejection monitoring by category, alerting when error rates shift, handling implementation guide revisions as published, and named response expectations.