If you run or administer a clinic anywhere in the UAE, you already know these three names. What’s less obvious — even to teams who’ve been submitting to eClaimLink for years — is how NABIDH, Malaffi, and Riayati relate to each other, which one your facility actually needs to connect to, and what’s changed as the country’s health data infrastructure has matured through 2025 and into 2026. This guide walks through each platform in detail, how they fit together at the national level, and what the connections mean in practice for your compliance checklist. 

What a health information exchange actually does

Before getting into the specifics of each platform, it’s worth being clear on what a health information exchange (HIE) is and isn’t. An HIE is not an EMR. Your clinic’s electronic medical record system is where you document a visit — the diagnosis, the treatment plan, the prescription. An HIE is the layer that sits above all the individual EMRs in a region and lets authorised providers pull a consolidated view of a patient’s history, regardless of which facility originally created each piece of that record.

That distinction matters operationally. Your EMR vendor is responsible for how your clinic captures and stores data day to day. The HIE is responsible for how that data is shared, standardised, and made available to other providers once a patient consents. Compliance touches both: your EMR has to be certified as capable of talking to the HIE, and your staff have to follow the HIE’s rules for consent, coding, and data submission.

The UAE’s decision to build this layer emirate-by-emirate, rather than as a single national system from day one, reflects how healthcare regulation is structured in the country. Each emirate’s regulator — DHA in Dubai, DoH in Abu Dhabi, MoHAP for the rest — owns licensing and oversight for facilities in its jurisdiction, so each built (or commissioned) its own exchange first. The national linking came later, and it’s arguably the more interesting part of the story for anyone trying to understand where UAE health data is headed.

NABIDH — Dubai’s health information exchange

NABIDH is operated by the DHA and was introduced in phases beginning November 29, 2020, when the DHA’s then Director General, His Excellency Awadh Seghayer Al Ketbi, launched the first phase connecting public and private facilities across the emirate. The goal, as stated at launch, was to reduce duplicate testing, improve care coordination, and give clinicians real-time access to a complete patient history regardless of where that patient had previously been treated.

By early 2026, NABIDH connected more than 11 million unified medical records, close to 60,000 clinicians, and over 2,000 healthcare facilities — a marked jump from the roughly 9.5 million records and 1,500 facilities reported in earlier reporting cycles, and a sign of how quickly the network has scaled as onboarding has become tied to licensing.

Legal and regulatory basis

• Dubai Health Data Law No. 11 of 2018 — the primary emirate-level law governing health data collection, use, and protection in Dubai.
• Federal Law No. 2 of 2019 — the UAE’s federal law on the use of information and communication technology in health fields, which underpins data exchange nationally.
• Cabinet Decision No. 32 of 2020 — supporting regulation tied to the federal ICT health law.
• DHA policies on Health Data Protection, Information Sharing, Consent and Access Control, and Data Classification, which govern the day-to-day rules facilities must follow.

Data standards and what gets shared

NABIDH runs on HL7 messaging — specifically HL7 V2.x, V3, and CDA R2 — alongside FHIR R4 and IHE interoperability profiles for newer integrations. The categories of data exchanged include patient demographics, allergies, medical conditions, lab results, clinical documents, radiology reports, encounters, immunizations, medications, and insurance information. Security is layered through a Patient Privacy Intelligence (PPI) system designed to monitor and flag unusual access patterns across the network.

Patient consent and opt-out

Patients are automatically enrolled in NABIDH the first time they’re treated at a connected facility — there’s no separate sign-up step. They retain the right to opt out, using an opt-out form obtained through their provider, but opting out has a real consequence: it blocks access to their record even in an emergency, which is a conversation clinic staff should be prepared to have clearly and without pressure.

Billing and admin teams

NABIDH sits alongside eClaimLink rather than replacing it. eClaimLink handles the insurance claim and prior-authorisation lifecycle; NABIDH handles the clinical record. Both draw on the same underlying EMR data, which is why clean, coded documentation at the point of care pays off twice — once for claims and once for HIE compliance.

Connectivity isn’t optional for Dubai facilities. A NABIDH-compliant EMR meeting the platform’s Minimum Data Set is a listed prerequisite on both new facility licensing and license renewal through the DHA’s Sheryan portal — meaning a facility without active NABIDH connectivity simply cannot complete either process.

Connect EMR Systems: https://nabidh.ae/#/comm/connectedemr

Malaffi — Abu Dhabi’s health information exchange

Malaffi, Arabic for “my file,” is the region’s first HIE platform, launched on January 23, 2019 by the Department of Health – Abu Dhabi. It’s operated by Abu Dhabi Health Data Services (ADHDS), an M42 company, under a public-private partnership with DoH. Malaffi is frequently cited as one of the fastest HIE rollouts globally — within three years of launch, it had connected almost the entire healthcare sector in the emirate, all hospitals, and roughly 99% of patient episodes.

As of 2026, Malaffi connects more than 3,000 healthcare facilities operating across 90-plus different EMR systems, serving roughly 50,000 clinicians. Physician utilisation has climbed steadily too — DoH reported an 11% year-on-year increase in HIE usage between 2022 and 2023, taking adoption to 67% of physicians in the emirate at the time.

What makes Malaffi distinct

• Predictive patient risk profiles — using aggregated data to flag patients at elevated risk of chronic disease progression or acute events.
• Radiology image exchange — not just reports, but the underlying imaging, reducing repeat scans across providers.
• Patients’ Health Portal — a consumer-facing web and mobile app giving patients direct, secure access to their own consolidated record.
• Provider Portal — embedded directly into participating facilities’ EMR systems, so clinicians don’t need to leave their existing workflow to pull a unified record.

Clinical terminology and coding

Malaffi was the first HIE in the Middle East and North Africa region to implement SNOMED CT and LOINC at scale, working directly with SNOMED International rather than relying on retrospective mapping. Coding is applied at the point of entry in the source EMR, covering diagnoses, allergies, chronic diseases, family and social history, and specialised diagnostic domains. LOINC coverage for laboratory results alone climbed from roughly 12% to more than 85% by mid-2025 — a detail that matters if your lab interface still sends results as free text rather than coded values, since that gap is exactly what auditors flag.

DoH backs this with formal governance: an ADHIE policy mandates specific coding standards and units of measurement, and requires a defined minimum data set to be captured and transmitted from source EMRs and reference lab systems to Malaffi. An independent KLAS Research review of Malaffi stakeholders found near-universal satisfaction with the platform, with outcomes reported around reduced repeat testing and faster access to patient data — nearly a quarter of respondents reported seeing benefits immediately, and more than half within six months of go-live.

Connect EMR Systems: https://www.malaffi.ae/connected-emrs/

Riayati — the national layer

Riayati is the Ministry of Health and Prevention’s federal platform, functioning as the UAE’s National Unified Medical Record (NUMR). Where NABIDH and Malaffi operate at the emirate level, Riayati is the layer that stitches Dubai, Abu Dhabi, and the Northern Emirates together, giving a consented provider anywhere in the country access to a fuller picture of a patient’s history than any single emirate-level system could provide on its own.

The pivotal moment for Riayati came at Arab Health 2023, held at Dubai World Trade Centre. MoHAP, DHA, and DoH signed a formal agreement electronically linking Riayati, Malaffi, and NABIDH under the NUMR framework. Officials from all three authorities described the integration as a landmark national achievement — one that would let doctors make better-informed decisions by drawing on records regardless of which emirate originally created them, while also strengthening population-level health planning.

Connect EMR Systems: https://mohap.gov.ae/en/riayati/connected-emrs

At the time of that integration, Riayati held around 1.9 billion medical records for 9.5 million patients, accessible to more than 90,000 providers across over 3,000 medical facilities nationwide, with both NABIDH and Malaffi data flowing into it. The scale of that figure — 1.9 billion records against a national population in the low millions — reflects that it counts individual data points and transactions (lab results, prescriptions, encounters) rather than distinct patient files.

Head’s Up

For a clinic operator, this integration means the compliance obligation isn’t just “connect to the platform in your emirate.” It means your data — coded, structured, and accurate — is now part of a national record that other providers may rely on for clinical decisions. Data quality at entry has downstream consequences well beyond your own claims.

How the three platforms compare

Platform	Jurisdiction	Regulator	Launched	Scale (2026)
NABIDH	Dubai	Dubai Health Authority (DHA)	2020	~11M records · ~60,000 clinicians · 2,000+ facilities
Malaffi	Abu Dhabi	Department of Health – Abu Dhabi (DoH)	2019	3,000+ facilities · ~50,000 clinicians
Riayati (NUMR)	Northern Emirates	Ministry of Health and Prevention (MoHAP)	2018	Billions of data points nationally, aggregating NABIDH + Malaffi data

What clinics need to get right

1. EMR certification and the Minimum Data Set

Your EMR or clinic management system must appear on the relevant regulator’s register of certified systems and must be capable of capturing and transmitting each platform’s Minimum Data Set. This is checked both when a new facility applies for a license and again at every renewal cycle — a facility that lets its EMR’s certification lapse can find itself unable to renew, regardless of how well the clinic is otherwise run.

2. Coding discipline

ICD-10 for diagnoses, SNOMED CT for clinical terms, and LOINC for lab results aren’t optional extras — they’re what makes a record usable once it leaves your system and enters the exchange. A diagnosis typed as free text might be perfectly clear to your own clinicians, but it won’t map cleanly into a national record that other providers, and increasingly AI-driven analytics tools, need to interpret consistently.

3. Consent workflows

Patients are auto-enrolled but retain the right to opt out. Front-desk and intake staff need a clear, well-documented consent process, since refusal must be recorded and respected — and, in NABIDH’s case, an opt-out blocks even emergency access to the patient’s record. Staff should be trained not just to present the form, but to explain plainly what sharing enables and what opting out means in practice.

4. Security baseline

Encryption at rest and in transit, access controls tied to authorised roles, and audit logging are standard expectations across all three regulators. DHA’s own interoperability standards documentation, for example, calls out strong cryptography, tokenized API access, and multi-factor authentication as baseline requirements — not aspirational goals.

5. Integration testing before go-live

Each platform provides a sandbox environment for validating data exchange before a facility goes live. Skipping or rushing this step is where most delays happen in practice.
The most frequent cause of failed HIE integration testing isn’t a technical outage — it’s missing or miscoded data fields, particularly around ICD-10, CPT/CDT coding, and ID mismatches between your EMR and the regulator’s facility registry. Build a data-quality review into your pre-go-live checklist, not just your post-launch audit.

NABIDH, Malaffi and Riayati don’t cost patients anything. Participation is built into standard care at connected facilities and doesn’t carry a separate patient fee. The cost of connectivity and compliance sits with the healthcare facility. 

In principle, Abu Dhabi patients can be treated using their Dubai medical history. That’s precisely what the 2023 NUMR integration was designed to enable, subject to the patient’s consent. In practice, how completely a given record surfaces across emirates depends on how thoroughly the origanting facility coded and submitted that data in the first place. 

Non-compliance affects licensing directly. Since a certified, HIE-connected EMR is a prerequisite for both new licenses and renewals across DHA, DoH, and MoHAP frameworks, a facility that falls out of compliance risks disruption to its ability to legally operate, not just a fine.

Important note to know is that NABIDH, Malaffi and Riayati isn’t the same system as DHPO and eClaimLink. DHPO and eClaimLink are claims and prior-authorisation systems used for insurance processing. NABIDH, Malaffi, and Riayati are clinical health information exchanges. They’re related — both rely on well-structured EMR data — but they serve different regulatory purposes and are usually audited separately.

Where this is heading

The direction of travel across all three platforms is toward deeper standardisation and AI-readiness — richer clinical terminology coverage, tighter integration with claims systems like eClaimLink and DHPO, and continued expansion of the NUMR’s cross-emirate reach. DHA leadership has spoken publicly about using NABIDH’s data foundation to support predictive analytics and population health planning as part of Dubai’s broader ambition to rank among the world’s top cities for healthy life expectancy, while Malaffi’s SNOMED CT work is explicitly framed as building an “AI-ready” data infrastructure for Abu Dhabi.

For clinic teams, that means the gap between “clinically documented” and “claims-ready, HIE-ready, AI-ready” data keeps narrowing. That’s good news if your intake and coding processes are already solid — cleaner data now compounds into fewer headaches at every future audit or system upgrade. It’s a growing liability if they aren’t, since the tolerance for free-text shortcuts and inconsistent coding is only shrinking as these systems mature.

Connect with Us

Ready to embark on this exciting journey? Contact us today: 

📍 Dubai, United Arab Emirates – Tel: +971 56 640 9602 

📍 Khartoum, Sudan – Tel: +249 91 273 1048

Explore Balsam Medico and discover a world of efficient clinic management at www.balsammedico.com. Together, let’s reduce fines, elevate efficiency, and embrace a new era of dental healthcare.