Compliance & Regulation
Articles on compliance & regulation for clinic owners, clinicians and practice managers in the GCC.
All Compliance & Regulation articles
Saudi PDPL for clinics: patient data, consent and where data must live
Health data is sensitive data under Saudi Arabia's PDPL. What the law and SDAIA's regulations ask of a clinic: consent, patient rights, breach reports, records, a DPO, registration and rules for data sent abroad.
How to license a private clinic in Egypt: the Free Treatment Department step by step
Who issues the license, a private clinic versus a specialized clinic, the Ministry's online licensing system, the documents commonly asked for, and the mistakes that can cost a clinic its license.
Egypt's Personal Data Protection Law (Law 151 of 2020): what it means for clinics
Health data is sensitive data under Law 151. What the law and its Executive Regulations ask of a clinic: consent, a license or permit, a data protection officer, breach reports and rules for data stored abroad.
HIPAA, GDPR and GCC clinics: which rules actually apply to you?
Vendor websites in the Gulf are full of HIPAA and GDPR badges. Here is what those frameworks really cover, when they apply to a GCC clinic, and how to read the difference between 'compliant' and 'certified'.
UAE health data law for clinics: the ICT Health Law, data localization and consent
What Federal Law No. 2 of 2019 means for a clinic's software, hosting, retention and consent, how it relates to the UAE's general data protection law, and the questions to ask every vendor.
Riayati explained: MOHAP's unified medical record for Northern Emirates clinics
A plain-language guide to Riayati, the National Unified Medical Record, for clinics in Sharjah, Ajman, Ras Al Khaimah, Fujairah and Umm Al Quwain.
Shafafiya: Abu Dhabi's e-claims framework for DOH-licensed providers
What Shafafiya covers, how it differs from Malaffi and from Dubai's eClaimLink, and how finance teams keep Abu Dhabi claims clean from prior request to remittance.
NPHIES for providers: eligibility, pre-authorization and claims in Saudi Arabia
How Saudi Arabia's national health insurance platform works for clinics and hospitals, the transactions you will use every day, and what to check before you trust a vendor's NPHIES claim.
eClaimLink and DHPO: how e-claims, eRx and prior auth work in Dubai
A finance and front-office guide to Dubai's e-claims rail: what eClaimLink and DHPO are, the transaction cycle from eligibility to remittance, and how to build claims that pass the first time.
ZATCA Phase 2 e-invoicing for Saudi clinics: a step-by-step guide
Clearance, reporting, CSIDs, invoice hashes and credit notes, explained for clinic finance teams, plus the clinic-specific traps that general ZATCA guides skip.
Malaffi integration for Abu Dhabi clinics: what connecting really involves
Malaffi is a licensing condition for most DOH facilities, not a nice-to-have. Here is what the connection involves: agreements, the security assessment, HL7, network access and clean patient matching.
NABIDH integration: a practical guide for Dubai clinics
What NABIDH is, what your clinic has to do, what your EMR vendor has to do, and the data problems that quietly break the connection after go-live.
DHA, DOH or MOHAP? The UAE clinic IT compliance map, emirate by emirate
Your emirate decides your regulator, and your regulator decides which health information exchange and which e-claims platform your clinic software must work with. Here is the whole map on one page.