Malaffi: how Abu Dhabi's health information exchange works for providers

Malaffi is the Abu Dhabi health information exchange, the platform that collects patient records from the emirate’s licensed healthcare facilities and lets authorised clinicians see them in one place. For operators the issue is not whether to join: Department of Health Abu Dhabi (DoH) rules make connection a condition of renewing a facility licence and of billing Daman. This guide explains who runs the exchange, which facilities must connect, how onboarding works, what it costs, what the data rules say and what the platform means for providers and health IT vendors, as of November 2026.

What Malaffi is and who operates it

Malaffi describes itself as “the region’s first Health Information Exchange platform”. According to its About page, it is operated by Abu Dhabi Health Data Services Sole Proprietorship LLC (ADHDS), “a M42 company”, and was “established as a Public-Private Partnership (PPP) with the Department of Health”. M42 is also the company behind the pilot covered in our report on M42 starting a 10,000-patient wearable pilot.

Malaffi was officially launched in January 2019. Gulf News reported on 23 January 2019 that DoH chairman Abdullah Al Hamed spoke at an event held to officially launch Malaffi, that Malaffi was “being developed in collaboration with Injazat Data Systems”, a Mubadala subsidiary, and that it would be operated by “a new project company, Abu Dhabi Health Data Services”. At launch “18 hospitals and 65 medical centres and clinics” were connected. The participants named included SEHA, Cleveland Clinic Abu Dhabi, Healthpoint and Oasis Hospital in Al Ain.

Orion Health announced on 29 January 2019 a commercial agreement with ADHDS “to deliver a Health Information Exchange (HIE) platform”, named Malaffi, and said the exchange had been “officially launched last week on 23 January”, according to the Orion Health media release. Healthcare IT News described Orion Health as a New Zealand technology solutions supplier. Cleveland Clinic Abu Dhabi, one of the first participants, has a profile in our Listed 100.

The regulatory basis is the DoH Policy on the Abu Dhabi Health Information Exchange, reference DOH/POL/STR/HIE/1.1/2020, effective from 16 April 2020 and replacing a November 2018 version. The policy calls the exchange the ADHIE and its operator the ADHIE Operator. It gives DoH the roles of setting policy, monitoring compliance, auditing facilities and enforcing the rules, and gives the operator the job to “Establish and maintain ADHIE IT infrastructure, systems and processes”.

Which facilities must connect to Malaffi

The policy requires that “all licensed Healthcare Facilities in the Emirate of Abu Dhabi participate” and that each signs a participant agreement with the operator. The exchange’s page on facilities required to connect puts it plainly: “the DOH’s strategic priority is universal participation of all Healthcare Facilities and all patients.” It continues: “It is therefore a requirement that all licensed DOH healthcare facilities, except for those exempt, connect to Malaffi.”

The page lists the facility types that must connect and those that need not. DoH may change the list at any time, so operators should check it before planning a new site.

Category	Facility types listed by Malaffi
Required to connect	Dental, medical, one day surgery and primary health care centres; general, specialised, dental, medical and school clinics; imaging and laboratory diagnostic centres; dialysis and fertilisation (IVF) centres; general, nursing home, rehabilitation and specialised hospitals; dental, medical and imaging mobile units; inpatient and outpatient pharmacies; home care services; all telemedicine providers
Not required	Ambulance services, drug stores, medical transportation, scientific offices, traditional complementary and alternative medicine, rehabilitation sub-types, non-home-care health services, first aid posts and blood bank mobile units
Exempt	Military, police, aviation and university facilities, and any facility Malaffi identifies as sensitive or exceptional; sports club centres without physicians, and aviation and university clinics, can request exclusion

Two sanctions give the requirement force. Non-exempt facilities with an active DoH licence that have not connected cannot renew that licence, the page says, and “facilities with agreements with Daman will not be able to submit claims until they complete their connection to Malaffi.” Daman also manages the Thiqa programme for UAE nationals, according to the Thiqa website, so the claims sanction reaches Thiqa claims as well as Daman’s other plans.

The deadline for facilities with an active DoH licence to be connected “has now closed”. New facilities holding a preliminary licence “are expected to connect to Malaffi as part of the pre-requisites of obtaining the active license”. Malaffi recommends contacting its onboarding team at least two months before the planned application for an active licence.

How to connect: the four onboarding steps

The operator lists four requirements for a facility to go live on the exchange. In order:

1. Agreement. “Complete an Accession Agreement and Facility Declaration (to be requested from onboarding@malaffi.ae)”.
2. Security. “Pass the Malaffi Security Assessment (an excerpt of the DOH ADHICS survey)”, which tests the facility against the Abu Dhabi Healthcare Information and Cyber Security Standard.
3. Systems. “Have a HL7 capable EMR in place”.
4. Network. “Obtain an SDWAN connection (from Etisalat; NOC to be given by Malaffi)”.

On cost, the connected EMR systems page says: “Please note that connecting an EMR system to Malaffi and utilising the platform is a free service.” It adds: “However, healthcare providers are responsible for bearing the cost of a secure connection.” The policy says the same in its own terms, requiring each facility to build and maintain an electronic interface between its system and the platform at its own cost. The operator does not publish the cost of the SDWAN link or of EMR interface work.

The same page lists 71 EMR and related systems that have at least one client connected and “have met Malaffi’s interoperability requirements for those clients”. They range from Cerner, Epic, Dedalus, Orchestra and TrakCare to SAP, Microsoft Dynamics 365 and smaller regional products. Malaffi warns that listing “does not mean that these vendors are certified for meeting all other regulatory requirements”.

Once a facility is live, people need access. The end-user FAQ says access “is governed by role-based permissions and organisational security protocols”, that first-time users must accept an end-user licence agreement, and that “all authorised users are required to complete training and refresher courses annually.” Clinicians usually reach a patient’s file through “a link embedded in the EMR system”.

What data Malaffi holds and who can see it

The About page lists the categories the Malaffi platform collates from connected facilities: demographics, encounters, allergies, laboratory and radiology results and images, medications and immunisations, diagnoses, speciality diagnostic tests, family and social history, procedures, clinical documents, vital signs and appointments.

Access is tiered. The end-user FAQ describes four levels, “Primary Provider, Secondary Provider, Tertiary and Front Desk (Level 1, 2, 3 and 4 respectively)”. “Only Level 1 users have the authority to ‘Break the Privacy Seal'”, which is required to view sensitive information, and radiology images are restricted to Level 1 users. The FAQ says “all user access is continuously monitored and logged.”

On consent, the 2020 policy requires facilities to obtain patient consent for sharing data through the exchange, but it also authorises sharing “To the extent patient consent for the sharing of Patient Data via the ADHIE is unavailable for any reason”. Facilities must “Inform patients appropriately that sharing relevant patient Health Information with the ADHIE is part of their treatment.” The policy does not describe an opt-out mechanism.

Its examples of permitted uses for facilities include patient identification and “Patient diagnosis, treatment, payment, and related Healthcare Operations”. Its examples of non-permitted uses include “use for commercial gain or marketing purposes”, storing patient data in a cloud environment and making it available outside the United Arab Emirates.

The Malaffi privacy notice lists the laws it operates under, including “the DOH Standard on Patient Healthcare Data Privacy”, “UAE Federal Law No. (2) of 2019 (Health Data Law)” and “UAE Federal Law (45) of 2021 (Data Protection Law)”. It says: “We will not store, develop, or transfer your Protected Health Information outside the United Arab Emirates”, unless “an exception to do so is issued by the DOH in coordination with the Ministry of Health and Prevention”. Non-marketing data is kept “for a period of 25 years or as required by Applicable Law”.

ADHICS, audits and sanctions

Security sits on two standards. Malaffi’s policies page links to the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard and the DoH Standard on Patient Healthcare Data Privacy, whose file is dated 15 September 2020. Its data security page says: “Our teams perform a security assessment of the participants before they connect to Malaffi”, and that “Malaffi and all Participants are required to comply with all Emirate-wide and federal health privacy laws.” It says Malaffi itself holds “the ISO 27001:2022 Certification”.

Enforcement belongs to DoH. The policy says DoH will “Escalate and take all appropriate actions where it determines that noncompliance has occurred”. Listed measures include to “Issue a reprimand, notice or warning”, a notice of suspension and “Withdrawal of licensure”. The operator can suspend or end a participant’s access in specified cases, including where a participant “persists in such breach after 30 days of having been required in writing to remedy or desist”.

For compliance teams, that means a data breach or misuse of the exchange is a licence matter as well as a privacy one. The FAQ notes that when a Level 1 user breaks the privacy seal to see sensitive information, “this action is audited and logged”, so access policies inside each facility need to match the level each user is granted.

Malaffi in numbers, 2019 to 2026

Official counts have grown in step with the connection mandate. Definitions vary between announcements, with some counting facilities and others healthcare organisations, so the figures below are given as each source stated them.

Date	Facilities	Records and users	Source
23 January 2019	18 hospitals and 65 centres and clinics	Records of more than three million patients expected	Gulf News
14 October 2021	All 59 hospitals; 1,100 clinics and centres; 1,539 facilities	559 million unique clinical records; over 39,000 staff with access	DoH
11 August 2022	2,000 public and private facilities	900 million records for more than 7 million patients; over 45,000 users	Abu Dhabi Media Office
6 September 2022	2,347 facilities	1 billion clinical records; 47,000 users	Gulf News
31 January 2023	2,500 healthcare organisations	Over 1.4 billion health records	Abu Dhabi Media Office
14 August 2025	3,072 facilities	3.5 billion clinical records; 12.7 million patient profiles; 53,476 users	M42
November 2026	3,147 signed; 3,144 connected; 100 per cent of hospitals	99.9 per cent of episodes; 56,192 end-users	Malaffi website

The DoH announcement of October 2021 marked the point at which all hospitals in the emirate were connected. The M42 release of 14 August 2025 also reported “over 160,000 M42 Pharmacogenomics Reports” on the platform and radiology images from over 60 facilities. The live counters on the Malaffi home page were the most recent figures available when this guide was prepared.

Portal, images and risk scores: what has been added

Since 2022 the exchange has added services on top of the shared record. In August 2022 DoH and Malaffi introduced a Patient Risk Profile, which uses “advanced artificial intelligence (AI) technologies and machine learning algorithms” to estimate a patient’s risk of chronic conditions such as diabetes and hypertension and of acute events, according to the Abu Dhabi Media Office. It is available to all doctors authorised to access the platform.

In November 2022 Malaffi began a phased rollout of radiology image exchange, with “two million radiology images from over 60 different healthcare sites” expected. Reem Hospital and nine NMC Healthcare hospitals were sharing images at launch. In February 2024 DoH said Philips had recognised Malaffi as a “global reference site” for its Image Exchange Solution, with 64 imaging facilities connected, all 67 expected by the end of the first quarter of 2024, and coverage of “more than 90 per cent of all radiology images produced in the emirate annually”.

For patients, the Malaffi Health Portal, launched on 12 October 2022, gives patients access to records including doctors’ visits, medications, allergies, conditions and immunisations, with login through a verified UAE Pass account. At launch DoH said Malaffi “connects 100% of hospitals and 99% of all patient episodes in Abu Dhabi”.

How Malaffi compares with NABIDH and Riayati

The UAE’s three health record platforms each sit with a different regulator. On 31 January 2023 the Ministry of Health and Prevention (MoHAP), DoH and the Dubai Health Authority (DHA) signed an agreement at Arab Health to link Riayati, NABIDH and Malaffi electronically, according to the Abu Dhabi Media Office. At that point Riayati held 1.9 billion medical records for 9.5 million patients, accessible to over 90,000 providers in 3,057 facilities.

Exchange	Regulator	Start	Latest official scale found
Malaffi	DoH Abu Dhabi	Launched 23 January 2019	3,144 facilities connected, November 2026
NABIDH	Dubai Health Authority	Introduced by DHA on 29 November 2020	Over 9.47 million patient records and more than 1,300 facilities, 4 November 2024
Riayati	MoHAP	Not stated in sources reviewed	1.9 billion records for 9.5 million patients, 3,057 facilities, 31 January 2023

The consent models differ on paper. Malaffi’s 2020 policy does not describe an opt-out. NABIDH’s subject of care rights policy states that “The Subject of Care may choose to opt out of the NABIDH.” Groups that operate in both emirates therefore face two sets of consent rules, security standards and onboarding processes. DHA said on 4 November 2024 that NABIDH had unified over 9.47 million patient records.

What Malaffi means for providers and vendors

For providers, Malaffi is a licence and revenue condition rather than an optional IT project. A facility that is not connected cannot renew its DoH licence or submit claims to Daman, and a new facility must connect before it receives an active licence. Budget lines follow: the secure connection, interface work on the EMR, the security assessment against ADHICS and annual user training are all borne by the facility, while use of the platform itself is free.

For buyers of healthcare assets, connection status is a due diligence item: under the rules above, a target that is not connected cannot renew its licence. A large hospital group and a single clinic face the same four onboarding steps.

For EMR and health IT vendors, the 71-entry connected systems list works as a market map, and HL7 capability is the entry ticket. Vendors should note Malaffi’s caveat that listing is not certification for other regulatory requirements. Imaging vendors have a route in through the image exchange, as the Philips reference-site agreement shows.

For analytics and AI developers, the risk-profile tool and pharmacogenomics reports show the exchange being used beyond record sharing. The policy’s examples of permitted uses centre on identification, treatment, payment and healthcare operations, and its non-permitted uses include “use for commercial gain or marketing purposes”, distribution to third parties and using patient data to form another health information exchange, so developers need to test any secondary use against those terms. Related Abu Dhabi activity is covered in our report on the USD 105,000 global challenge for AI health tools and across our Digital health section.

What to watch next

• A policy update. The ADHIE policy in force is version 1.1 of April 2020. Any revision could change consent, data submission or sanction terms.
• The last few facilities. The home page shows 3,147 signed facilities and 3,144 connected. The gap is small, but each unconnected facility faces licence renewal and claims consequences.
• Cross-emirate exchange. The January 2023 agreement links Malaffi with NABIDH and Riayati. How far data flows in practice for patients treated in more than one emirate is not set out in the sources reviewed.
• New data products. Risk scores, image exchange and pharmacogenomics reports have been added since 2022. Each new use raises questions about access levels and the permitted-use limits in the policy.
• Vendor list changes. The connected EMR list grows as vendors complete integrations; buyers choosing a new system can check it before signing.

Operators opening new sites should treat the Malaffi onboarding timetable as part of the licence application plan, starting at least two months before the active licence application, as the exchange recommends.