Malaffi, Abu Dhabi's health information exchange: what facilities and vendors need to know

The short answer

Malaffi is Abu Dhabi’s health information exchange, connecting public and private healthcare providers across the emirate. It’s operated by Abu Dhabi Health Data Services (ADHDS), an M42 company set up as a public-private partnership with the Department of Health - Abu Dhabi.¹ All licensed DOH healthcare facilities, except exempt categories, must connect; a facility that hasn’t can’t renew its DOH licence, and facilities with Daman agreements can’t submit claims until connected.² Joining needs an HL7-capable EMR and passing a security assessment based on the ADHICS standard.² This post summarises Malaffi’s public pages; check with Malaffi and the DOH before you plan a connection.

What Malaffi is

Malaffi, Arabic for “my file”, describes itself as the region’s first health information exchange platform.¹ Its aim is one longitudinal record per patient, built from every facility the patient visits: consultations, emergency care, laboratory tests and radiology.

Its homepage gives a sense of scale. On 27 October 2026 it showed all hospitals connected, 3,144 connected facilities, 4.2 million unique clinical records and 56,192 end users with access.¹ Those are Malaffi’s own figures as displayed that day.

Who must connect

The rule is tied to licensing. Malaffi’s page says it’s a requirement that all licensed DOH healthcare facilities, except those exempt, connect, and that the deadline for facilities with an active licence has closed.²

The page also has a table by licence type and sub-type showing which facilities must connect; check it for your category.

What onboarding needs

Malaffi lists four requirements to start connecting:²

1. An accession agreement and facility declaration.
2. Passing the Malaffi Security Assessment, an excerpt of the DOH’s ADHICS survey.
3. An HL7-capable EMR.
4. An SDWAN connection.

For a software vendor, item 3 is the one you own. “HL7-capable” in practice usually means HL7 v2 messaging for admissions, results and documents, the same pattern most exchanges use. Our v2-to-FHIR pipeline post covers how such interfaces are built.

Item 2 means your customer will be assessed against ADHICS controls. If your product hosts data or connects to the EMR, expect questions; our vendor security questionnaire post has the AI-specific ones.

Security, logs and the privacy seal

Malaffi’s security page says Malaffi and every participating facility must follow emirate-wide and federal health privacy laws and the Abu Dhabi Healthcare Information and Cyber Security Standard (ADHICS); data is encrypted in transit and at rest.³

Two access controls stand out:

• Activity logs. Malaffi keeps activity logs of the authorised users who view patient files and access information, and gets notified of misuse.³
• The privacy seal. Only the highest level of authorised users can “Break the Privacy Seal” to see sensitive information, such as certain infectious diseases, substance abuse, IVF and mental health conditions, and those actions are monitored and audited.³

The privacy seal is a useful model: sensitive categories are hidden by default, opening them is a deliberate, logged act by a specific role, and the opening is reviewed afterwards.

It’s worth borrowing even outside Abu Dhabi. Many hospital systems treat sensitive data as either visible or not, with nothing in between. A seal adds a middle state: the data exists, the user can see that it exists, and opening it leaves a trace someone will look at. For vendors, that means supporting categories of data, roles that can open them, and a log entry for every opening that’s easy to report on. Those are small design choices early and expensive retrofits later.

Malaffi and NABIDH side by side

Dubai’s exchange, NABIDH, is run differently and documented through DHA standards. Both rest on the same ideas: v2-first interfaces, controlled access to sensitive data, and logs of who looked.

Our NABIDH post covers Dubai in detail.

What this means for AI tools

Malaffi’s pages don’t discuss AI agents. The general rules still apply to any software reading or writing through a connected facility’s systems:

• Give each tool its own identity, so activity logs show the tool, not a clinician’s login it borrowed.
• Keep tools away from the privacy seal. It’s designed for the highest level of human users.³ An automated tool shouldn’t open sealed categories.
• Record what the tool wrote to the EMR, because the exchange will spread it to every other facility that views the record. A wrong value written once is seen everywhere.
• Expect ADHICS questions about any AI vendor that hosts or processes data.

Our audit record fields post lists what to capture when the actor is software.

Questions people ask

Is it mandatory to connect to Malaffi?

For licensed DOH facilities that aren’t exempt, yes: Malaffi says connection is required, with licence renewal and Daman claims tied to it.²

Who operates Malaffi?

Abu Dhabi Health Data Services, an M42 company, in a public-private partnership with the DOH.¹

What does an EMR need to connect?

Malaffi lists an HL7-capable EMR, plus the agreement, security assessment and network connection.²

Health systems in the region can see how agent actions get recorded and checked on our healthcare page, and in the provenance spec. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.