ADHICS Awareness Training

Asks how you would care for patients if every computer stopped, and who else could see one patient record. Recounts the Health Service Executive attack in Ireland: a phishing e-mail with a malicious Excel file in March 2021, about eight weeks unseen, Conti ransomware on 14 May 2021 and 80% of IT encrypted. Then the Synnovis attack on 3 June 2024, which led to 10,152 outpatient appointments and 1,710 planned procedures being postponed at two NHS hospital groups. Draws three lessons: people, suppliers and plans for when systems stop. Introduces the Abu Dhabi Healthcare Information and Cyber Security Standard from the Department of Health, Version 2, published May 2024 and in effect from August 2024, and who it applies to. Meets UVW Specialty Hospital, a worked example of a 150-bed private hospital in Abu Dhabi, then explains the course and the 30-question exam.

What you will be able to do

• Explain why the Department of Health treats information security as part of patient safety
• Identify which Abu Dhabi entities and staff the ADHICS standard applies to
• Describe the three lessons from the Irish HSE and Synnovis attacks

Why it matters

Shows every clinician, administrator and IT worker why ADHICS applies to them and how one click or one supplier can stop patient care.

Practice: Practice: Why ADHICS matters · 3 questions

Starts with a new nurse manager, moved from a twelve-bed clinic, asking UVW Hospital's CISO which ADHICS controls apply. Places the standard inside the Department of Health's healthcare information security programme, its Abu Dhabi Healthcare CERT and the 2021 sector strategy. Shows that Version 2 supersedes the 2019 ADHICS Standard, the 2020 Internet of Medical Things Security Standard and the 2020 patient data privacy standard. Walks through Section A and Section B, the eleven domains and control references such as HR 3.2. Gives the Appendix 1 counts: 131 controls and 577 sub-controls across Basic, Transitional and Advanced. Explains which entities fall into each category and the Service Provider category for technology providers. Covers the six-month timeline, road maps, justified exclusions, annual independent audits, Department audits, sanctions and the link to licensing and Malaffi. Ends on treating the control list as exhaustive.

What you will be able to do

• Distinguish the Basic, Transitional, Advanced and Service Provider control categories
• Recognise the eleven ADHICS control domains and what each covers in daily work
• Explain how ADHICS compliance is reported, audited and linked to licensing and Malaffi

Why it matters

Helps staff and managers see which ADHICS controls apply to their entity, and why compliance is tied to licensing and Malaffi access.

Practice: Practice: ADHICS Version 2 and how it works · 3 questions

Begins at UVW Hospital's quarterly information security committee, where only half the members attend and the CISO's compliance report waits. Explains the three-tier ADHICS governance pyramid: the Information Security Governance Committee, the Health Information Infrastructure Protection workgroup led by the CISO, and the implementation stakeholders. Lists the committee's roles, including approving policy, risk acceptance criteria and quarterly reports, and its 60% quorum. Sets out the CISO's duties, from awareness programmes to medical device security. Covers controlled documents and security metrics. Walks through risk assessment, rating confidentiality, integrity and availability from one to five, with an ICU infusion pump as the example, and the four treatment options: reduce, accept, avoid or transfer. Explains the statement of applicability. Ends with the four classification levels, public, restricted, confidential and secret, and the mistake of seeing security as IT's job.

What you will be able to do

• Describe the three tiers of the ADHICS governance pyramid and the role of the CISO
• Explain how information security risks are rated by asset and then treated
• Apply the public, restricted, confidential and secret levels to everyday information

Why it matters

Helps staff understand who owns security decisions, why patient information is confidential, and what auditors expect to see first.

Practice: Practice: Governance, risk and classification · 3 questions

Returns to the Irish Health Service Executive attack, where one opened spreadsheet gave attackers their foothold, to show why the standard treats people as the first line of defence. Covers the human resources security policy, background verification for candidates, contractors and third-party users, and security terms, non-disclosure agreements and briefings in the employment contract. Shows a new nurse at UVW Hospital signing terms before getting a medical record account. Explains the acceptable usage policy, segregation of duties, periodic awareness campaigns, tracking participation and completing Department of Health mandatory courses. Describes formal onboarding and role-based training for Transitional and Advanced entities, contrasting untracked training at a Singapore clinic with completion tracking by department. Covers the disciplinary procedure, exit clearance, asset return and access removal within 24 hours, and changes of role. Ends on treating awareness as a single yearly course.

What you will be able to do

• Explain the ADHICS controls that apply before, during and after employment
• Describe how awareness campaigns and role-based training are run and tracked
• Apply the 24-hour rule for removing access when someone leaves or changes role

Why it matters

Helps HR, managers and staff run hiring, training and exits so people strengthen security and leavers keep no access to health data.

Practice: Practice: People and awareness · 3 questions

Starts with a patient monitor taken away for repair from a UVW Hospital ward while its memory still holds patient readings. Defines information assets widely, from information and medical devices to data centres and people. Explains the asset inventory, asset owners and the medical device controls: an inventory linked to patients, authorised roles, a risk log, decommissioning and user authentication. Covers encrypting data in devices and preferring wired connections. Sets out acceptable use and bring your own device rules, including no patient wound photos on personal phones. Applies classification and labelling, removable media limits, authorised movement of assets and disposal beyond recovery with records. Moves to physical and environmental security: secure areas, visible identification, escorts, CCTV, fire and power protection, and chain of custody for equipment off-site. Ends with the clear desk and clear screen policy and the mistake of treating devices as just hardware.

What you will be able to do

• Explain why medical devices, printers and laptops are treated as information assets
• Apply the rules on personal devices, removable media and moving assets off-site
• Follow the clear desk and clear screen policy so health information is never left unattended

Why it matters

Helps clinical, biomedical and support staff keep devices and papers under control, so patient data does not leave with hardware.

Practice: Practice: Assets, medical devices and physical security · 3 questions

Opens on a ward at three in the morning, where a colleague offers a locum doctor their own sign-in. Covers the access control policy, based on need and role, and the formal process for registering and removing users, with shared accounts only on explicit approval. Explains why a unique identifier makes your sign-in your signature. Sets out privileged account rules, including multi-factor authentication for privileged and remote access. Gives the password minimums: twelve characters with a mix of types, lockout after at least five failures and no reuse of the last three. Covers default passwords, hashed storage and sending credentials through two channels, with a Paris dental group's sticky note as the warning. Explains log-on banners, automatic locking, teleworking, telehealth under the Department's telemedicine standard, network access and supplier remote troubleshooting. Ends with yearly access reviews and a Bengaluru EMR vendor sharing an administrator account.

What you will be able to do

• Explain why every user needs a unique account and why sharing a sign-in is not allowed
• Apply the ADHICS password rules and lock your screen whenever you step away
• Describe how privileged access, remote support and yearly access reviews are controlled

Why it matters

Builds the account and password habits that keep every action traceable, protecting patients and the honest staff behind each record.

Practice: Practice: Access control and passwords · 3 questions

Returns to the Synnovis ransomware attack of 3 June 2024, which postponed 10,152 outpatient appointments and 1,710 elective procedures at two NHS trusts. Covers anti-malware, scanning removable media and blocking malicious sites. Explains backups kept apart from production and tested for restoration, timely patching of systems and medical devices, and yearly vulnerability assessments and penetration tests. Sets out information exchange rules: no public e-mail, official addresses on UAE domains, encrypted transfers and controlled physical media. Explains Malaffi access only with authorisation and a care need. Covers cloud security: hosting, backup and disaster recovery in the UAE, encryption with keys held by the entity, and a shared responsibility model, contrasted with a Singapore clinic's offshore backups. Sets out supplier due diligence, right-to-audit and exit terms, and prompt notice to the Department of Health of supplier incidents. Gives four daily habits and the rule: outsource the work, not the accountability.

What you will be able to do

• Explain how backups, patching and anti-malware controls keep care running after an attack
• Identify the ADHICS cloud rules on UAE hosting and entity-held encryption keys
• Describe the security, audit and exit terms that supplier agreements must carry

Why it matters

Helps IT, procurement and staff keep daily operations and suppliers secure, so one supplier's incident does not halt patient care.

Practice: Practice: Operations, cloud and third parties · 3 questions

Starts with a well-known public figure admitted to UVW Hospital and dozens of curious staff opening the record. Defines the personal and health information the domain protects, including Emirates ID, medical record numbers, genetic data and staff pay and passport details. Covers the data privacy policy and informed, withdrawable consent, then the exceptions such as diagnosis and treatment, public health, Malaffi exchange and regulator requests. Explains lawful, fair and limited processing for Transitional entities. Sets out the core rule: access only on established care need. Covers data localisation, including anonymised copies, with a doctor checking results from a hotel abroad and scans sent to a Mumbai laboratory group. Explains printing, masking, the data processing inventory and privacy impact assessments. Sets out breach reporting: the Data Breach Form within 72 hours and information within 30 working days. Covers patient rights and ends on curiosity as a breach.

What you will be able to do

• Identify when ADHICS allows health information to be processed without patient consent
• Explain why opening a record without a care need is a privacy breach
• Apply the rule that health information and access stay within the UAE

Why it matters

Helps every healthcare worker respect patient privacy, avoid curiosity breaches and keep health data in the UAE, as ADHICS requires.

Practice: Practice: Patient data privacy · 3 questions

Opens in UVW Hospital's billing office on a Monday morning, where renamed files and a payment demand appear on the shared drive. Explains the incident management policy and the formal channel for reporting known or suspected incidents at once, with the reporter's anonymity kept. Lists what to report, from suspicious e-mails and odd system behaviour to lost devices and misdirected patient data. Walks through preparation, detection, containment, eradication and recovery. Sets out the four priority levels from the Department's guidelines and the reporting matrix for the Abu Dhabi Health Security Operations Centre: near real time for priority 1, one hour for priorities 2 and 3, and 24 hours for priority 4. Covers incident response teams, evidence and chain of custody, and sector threat sharing. Explains continuity: business impact analysis, recovery time and recovery point objectives, tested plans and downtime forms. Ends on hesitating to report.

What you will be able to do

• Recognise the events that should be reported at once through the formal channel
• Explain the four incident priority levels and the Health SOC notification times
• Describe how business impact analysis and tested plans keep care going in downtime

Why it matters

Prepares staff to report incidents early and keep caring for patients in downtime, limiting the harm an attack can do to the hospital.

Practice: Practice: Incidents and continuity · 3 questions

Opens at UVW Hospital's management meeting, where the CISO announces a Department of Health audit next quarter and the chief executive asks what auditors would find on any ward today. Sets out the responsibilities of the Department, entity management, security stakeholders, external stakeholders and end users. Shows the duties role by role for a ward nurse, front-desk officer, biomedical engineer and billing officer. Gives four habits, lock it, need it, approved only and speak up, and four moments to pause. Recalls key figures: twelve-character passwords, access removed within 24 hours, the Data Breach Form within 72 hours, yearly access reviews and a 60% committee quorum. Follows a remote heart monitoring service from privacy impact assessment to running. Revisits the Irish HSE and Synnovis lessons, where to turn for help, and how compliance is monitored and enforced. Ends on compliance as a performance and the 30-question exam.

What you will be able to do

• Describe what ADHICS expects of management, the security team, suppliers and end users
• Apply the four habits: lock it, need it, approved only and speak up
• Explain why daily practice, not last-minute tidying, prepares an entity for audit

Why it matters

Leaves every staff member ready to show ADHICS in daily practice, so a Department of Health audit finds the controls working.

Practice: Practice: Your role, recap and the exam · 3 questions