In the implementation of the present Law, the following words and expressions shall have the meanings corresponding thereto, unless the context otherwise requires:

State: The United Arab Emirates.

Ministry: The Ministry of Health and Prevention.

Minister: The Minister of Health and Prevention.

Health Authority: Any Federal or local governmental health authority in the State.

Competent Entity: Any entity in the State providing medical services, health insurance or national health insurance services, brokerage services, claims management services or electronic services in the medical field or any entity related, whether directly or indirectly, to the implementation of the provisions hereof.

Person: The natural or legal person.

Central System: The operations of health information and data electronic exchange, including the set of electronic parts or elements linked and working together for the achievement of a specific goal.

Data: Anything that may be stored, processed, generated and transferred through Information and Communication Technology (ICT), such as numbers, letters, codes, photos and the like.

Health Information: The health information that were processed and were given a visual, audible or readable indication, and that may be attributed to the health sector, whether related to the health or insurance facilities or entities or to the health services beneficiaries.

Processing: The electronic creation, entry, amendment, update or deletion of the information.

Health Information Circulation: The act of examining, exchanging, copying, photocopying, transferring, storing, disseminating, disclosing or sending health data and information.

Professional Guides: The description of the methods, actions and procedures to be observed.

Information and Communication Technology (ICT): The technical or electronic tools or systems or other media allowing all kinds of processing of information and data, including the storage, retrieval, dissemination and exchange thereof.

This Law shall apply to all Information and Communication Technology (ICT) methods and uses in the health fields in the State, including the Free Zones.

This Law shall aim at the following:

1- To ensure the optimal use of the ICT in health fields.

2- To ensure compatibility of the adopted principles, standards and practices with their internationally recognised counterparts.

3- To enable the Ministry to collect, analyse and keep the health information at the State level.

4- To ensure the safety and security of health data and information.

The following conditions shall be adhered to when using ICT in health fields:

1- To keep all health data and information confidential and to allow the circulation thereof only in authorised cases.

2- To ensure the validity and credibility of the health data and information, by protecting the integrity thereof from destruction or unauthorised amendment, alteration, deletion or addition.

3- To ensure the availability of the health data and information to the authorised parties and to facilitate access thereto when needed.

The Ministry shall establish a Central System in coordination with the Health Authority and Competent Entities to keep, exchange and collect all health information and data.

The Health Authority shall define the necessary principles, standards and controls required for its health information and data electronic systems, such as the methods of operation thereof, the method of information and data exchange, protection, access and copying, the changes made thereto, the safe and sound uses and the health information and data risk management.

The Health Authority and the Competent Entity shall undertake to accede to the Central System, according to the controls and procedures defined under the Implementing Regulation of this Law.

1- The entities authorised to use the Central System shall abide by the following:

a- To determine the persons authorised to access and circulate the health information and data systems and rules and to designate their powers.

b- To take all necessary procedures to protect and ensure the safety and confidentiality of the health information and data.

2- The Implementing Regulation of this Law shall define the controls and procedures for the implementation of the provisions of this Article.

The entity authorised to publish and distribute the Professional Guides through the Central System shall be determined by virtue of a decision issued by the Minister in coordination with the Health Authority.

The Ministry shall, in coordination with the Health Authority or Competent Entity:

1- Develop and implement a national strategic plan for the use of ICT in the health fields.

2- Develop mandatory mechanisms and procedures for the use of ICT in the health fields, according to the present Law and other laws in force in the State.

3- Implement and evaluate the initiatives and programs defined in the strategy as well as the technical standards.

4- Develop the controls, standards and procedures of the electronic operational programs used for establishing a connection with the diagnosis and treatment devices and equipment of the facilities providing health services.

5- Develop the mechanisms and procedures for the circulation of health information and data.

The Health Authority and Competent Entity shall, each within the scope of its competencies, ensure the validity and credibility of the health information and data and shall provide them in such a manner to ensure compatibility of the used Information Systems and their interoperability to exchange and collect health information and data.

The health information and data storage conditions and controls in the State shall be defined by virtue of a decision issued by the Minister in coordination with the Health Authorities.

The health information and data related to the health services provided in the State may not be stored, processed, generated or transferred outside the State, unless in the cases defined by virtue of a decision issued by the Health Authority in coordination with the Ministry.

No person may use the Central System unless authorised to this effect by the Health Authority or Competent Entity, according to the provisions of the Implementing Regulation of this Law.

1- The persons authorised to use the Central System shall undertake to:

a- Circulate the information required for the accomplishment of the required job or defined objective.

b- To limit the circulation of the information to the authorised persons only.

c- Not to amend the health information and data, by way of deletion or addition, unless according to the defined controls.

d- Not to disseminate the health information and data, in addition to the statistics related to the health field, unless according to the defined controls.

2- The Implementing Regulation of this Law shall define the controls and procedures for the implementation of the provisions of this Article.

Without prejudice to any legislation in force, whoever circulates information related to patients shall keep them confidential and shall abstain from using them for non-health purposes without obtaining the written approval of the patient and except in the following cases:

1- The health information or data required by the health insurance companies or any health services funding entity with regard to the health services received by the patient, for the purposes of auditing, approving or verifying the financial benefits related to those services.

2- Scientific and clinical research purposes, provided that the identity of patients is not disclosed and that the ethics and rules of scientific research are respected.

3- Taking preventive and curative measures related to the public health or protecting the health and safety of the patient or any other person related to him.

4- Upon request of the competent judicial entities.

5- Upon request of the Health Authority for the purposes of control, inspection and protection of public health.

The Central System may not be used to publish any health advertisement without obtaining a licence from the Ministry.

The Ministry may request the Competent Entity, according to its adopted procedures, to prohibit or block websites whether inside the State or abroad, which violate the controls and standards laid down in the State regarding health advertisements or provide health advertisements and information without an authorisation or licence from the Ministry.

The Health Authority shall undertake to train and qualify the cadres and to provide the necessary resources and environment in order to ensure the safety and security of health information and data according to the best international practices.

1- The following conditions shall be met when keeping health information and data through ICT:

a- The period during which health information and data are kept shall be commensurate with the need thereof, provided that it is no less than (25) twenty-five years as of the date of the last health procedures provided to the person concerned with such health information and data.

b- The health information and data confidentiality, validity and credibility standards shall be observed.

2- The Implementing Regulation of this Law shall determine the controls and procedures for the implementation of the provisions of this Article.

The Health Authority and Competent Entity shall undertake to include the Identity Number in all health transactions, registers and files and to use it for the purposes of organisation and storage thereof, except in the emergency cases and other cases defined by virtue of a decision issued by the Ministry in coordination with the Health Authority.

The penalties provided for under this Law shall be applied without prejudice to any severer penalty provided for under any other law.

Whoever publishes a health advertisement through the Central System without authorisation shall be punished by a fine of not less than AED (100.000) one hundred thousand and not more than AED (200.000) two hundred thousand.

Whoever violates the provisions of Article (13) of this Law shall be punished by a fine of not less than AED (500.000) five hundred thousand and not more than AED (700.000) seven hundred thousand.

Without prejudice to the criminal penalties established under this law or under any other law, the Health Authority shall have the right within the scope of its competence to punish the institutions that provide health services or work in the field of health research or the facilities authorised to use the Central System and which violate the provisions of this Law, its Implementing Regulation, or the decisions issued thereunder, by any of the following disciplinary sanctions:

a- Oral warning.

b- Written warning.

c- Fine of not less than AED (1000) one thousand and not more than AED (1.000.000) one million.

d- Temporary suspension of the authorisation to use the Central System for not more than 6 months.

e- Cancellation of the authorisation to use the Central System.

1- A committee shall be formed at the Health Authority to examine all grievances filed against disciplinary sanctions. This committee shall be formed by virtue of a decision issued by the Health Authority and defining the competences thereof and the way of filing grievances.

2- A person against whom a disciplinary sanction was issued according to Article (25) hereof may submit a grievance against the decision before the Grievances Committee formed at the Health Authority, within (15) fifteen days from the date the grievant receives notification of the decision.

3- The grievance shall be determined within (30) thirty days as of the date of submittal thereof. If no reply is received during this period, the grievance shall be deemed as rejected.

4- The decision issued regarding the grievance shall be deemed final.

5- A person whom challenge has been rejected may appeal before the competent courts in the State within thirty days as of the date of his notification of the rejection of the challenge or the expiry of the thirty-day period referred to under Clause (2) hereof.

The employees appointed by virtue of a decision issued by the Minister of Justice, in agreement with the Minister or the Health Authority shall have the capacity of judicial officers to prove the violation of the provisions of this Law and the decisions issued pursuant thereto, within the scope of their competencies.

The Competent Entity shall adjust its situation according to the provisions of this Law, within the period determined in a Cabinet decision.

The Cabinet shall issue, based on the proposal of the Minister, the implementing regulation of this Law within six months as of the date of its publication.

All provisions in violation of or in contradiction with the provisions of this Law shall be abrogated.

This Law shall be published in the Official Gazette and shall come into force three months after the publication thereof.