Malaffi integration for Abu Dhabi clinics: what connecting really involves

Short answer: Malaffi integration connects your EMR to Abu Dhabi's health information exchange so patient records can be shared across DOH-licensed facilities. Malaffi requires an accession agreement and facility declaration, a security assessment based on ADHICS, an HL7-capable EMR and a secure network link. Helix is connected to Malaffi for Abu Dhabi clinics.

For Abu Dhabi clinics, Malaffi is a condition of doing business. This guide walks through what Malaffi itself publishes about who must connect, what the onboarding involves, and where the practical effort lands for a clinic team.

This article is general guidance, not legal advice. Regulators update their standards, circulars and deadlines often, so always confirm the current requirement with the relevant authority or a qualified advisor before you act on it.

What Malaffi is

Malaffi (Arabic for 'my file') is the health information exchange of the Emirate of Abu Dhabi. It is a strategic initiative of the Department of Health (DOH), launched in 2019 and run by Abu Dhabi Health Data Services under a public-private partnership with the DOH. It lets a clinician see a patient's relevant history from other Abu Dhabi providers, including results and imaging reports, at the point of care.

Malaffi is connected with Dubai's NABIDH and MOHAP's Riayati. Each emirate still has its own exchange and its own onboarding, so a group with branches in Dubai and Abu Dhabi connects each branch to its own exchange. See our UAE compliance map by emirate.

Who must connect, according to Malaffi

• All DOH-licensed facilities, except exempt categories: military, police, aviation, universities and any facility Malaffi identifies as sensitive or exceptional.
• Existing facilities that are not exempt and have not connected cannot renew their DOH licence.
• Facilities with Daman agreements cannot submit claims to Daman until they complete their Malaffi connection.
• New facilities with a preliminary DOH licence are expected to connect as part of getting the active licence. Malaffi asks them to contact its onboarding team at least two months before the licence application date.

The last point matters for new clinics. If you are opening in Abu Dhabi, the EMR decision and the Malaffi timeline belong in the same project plan as the fit-out and staffing.

The four prerequisites

The security assessment is where time goes

Many clinics plan for the interface and underestimate the security work. ADHICS covers governance, access control, asset management, incident handling and more. A small clinic may not have written policies for any of it. Start early and involve your EMR vendor, because many ADHICS controls are about the software: role-based access, audit logs, encryption and where data is hosted.

When you assess an EMR for this, ask where the data is stored, how access is controlled at role level, whether every view and change is logged, and whether the vendor can provide documentation for your assessment. Our security overview explains how Helix answers each of those.

Patient matching: the unglamorous part that matters most

An exchange is only useful if it finds the right patient, and in the UAE the Emirates ID is central to that matching. Every time a front-desk user types an ID by hand, there is a chance of a digit error, and a record that should have merged will not.

• Read the Emirates ID from the card at registration instead of typing it.
• Make the ID mandatory for residents, and define a clear process for visitors and newborns.
• Merge duplicate files before go-live, keeping an audit trail of the merge.
• Re-check demographics (name spelling, date of birth, gender) against the ID card at every visit, not just the first.

Malaffi is not your claims system

This is the most common confusion we hear. Malaffi is clinical: records, results, reports. Insurance claims in Abu Dhabi go through Shafafiya, the DOH's e-claims framework. The link between them is indirect but real: Daman requires a Malaffi connection before you can claim, and coded, complete clinical data helps claims pass. Read our Shafafiya guide for the claims side.

What clinicians gain from Malaffi

Compliance is the reason most clinics connect, but the clinical value is real. A doctor seeing a new patient can check recent hospital discharges, lab results and imaging reports instead of relying on what the patient remembers. That matters most for chronic disease, polypharmacy and patients referred between providers. The benefit depends on two things your clinic controls: correct patient matching, so the right history appears, and good data going back in, so the next doctor benefits from your notes too.

It also helps to make the shared record easy to reach. If a doctor has to leave the EMR, open another site and log in again, they will do it rarely. If the record opens from the patient file with one click, they will use it.

A realistic Malaffi project plan

1. Contact Malaffi onboarding and request the agreement and declaration (for new facilities, well before your licence application).
2. Confirm your EMR vendor is live on Malaffi and ask for its list of supported message types.
3. Order the network link from the telecom provider early, as lead times vary.
4. Run the security assessment with your vendor's documentation to hand.
5. Configure facility identifiers, clinician licences and specialty mappings in the EMR.
6. Clean patient data: Emirates IDs, duplicates, coded diagnoses.
7. Test, fix, go live, and assign an owner for failed messages.

How Helix handles Malaffi

Helix is connected to Malaffi through its gateway, and clinicians can open the Malaffi record from the patient file with single sign-on, so there is no second login. An Emirates ID card reader fills registration directly from the card. Data is hosted with full GCC data residency, access is controlled by roughly 700 role-based permissions, and every action is written to an audit log, which gives your security assessment something concrete to point at. The same record then feeds the invoice and the Shafafiya claim through our integrations.