Healthcare IT AMC in Dubai: an annual maintenance contract written for clinics, medical centres and hospitals.
What should an IT AMC for a Dubai clinic actually include? Two things. Fast fixes for the workstations, network and printers your doctors and front desk use every session. And the obligations that Dubai Health Authority (DHA) policies and standards place on you and on any supplier who can reach patient data: a confidentiality clause, role-based access, audited supplier access, backups that are test-restored, and immediate breach notice. Our healthcare IT AMC, and the IT support for clinics in Dubai that comes with it, is written around both.
- 5 minP1 response
- 10 minP2 response
- 25 yrsMinimum health-record retention in UAE law
- In UAEHealth data stays unless a permitted case applies
Nine things the contract should spell out before anyone touches a clinical workstation.
Clinical workstation and device uptime
Reception, consultation room, nursing station and pharmacy PCs, printers, label printers and scanners. A clinic that cannot register patients or print a prescription is a P1, answered within 5 minutes.
Network and connectivity
Switching, Wi-Fi and internet links kept working, with patient and guest Wi-Fi separated from the network your clinical systems and devices use.
Role-based access, including ours
DHA policy requires access to patient data to be restricted by role for staff, trainees, vendors and third party contractors. We keep joiners, movers and leavers in step, and every engineer uses a named account: DHA treats shared system passwords as a disciplinary offence.
Access audits you can show
DHA requires entities to audit access to patient data, and the NABIDH security standard asks for regular audits of access logs, especially for privileged accounts, plus an audit trail of supplier access. The AMC should hand you those logs, not just keep them.
Backups that are restored, not just taken
The NABIDH standard asks for a backup process that defines type, retention, frequency, protection controls and remote storage, and, at its Intermediary level, for backups to be validated by an isolated recovery. We run restore tests on a schedule written into the contract and report the result.
Where every copy of the data lives
Federal Law No. 2 of 2019 allows health data from services provided in the UAE to be stored, processed or transferred outside the country only in cases set by decision. The contract should list every place a backup, sync or support tool keeps data.
Patching and anti-malware
The NABIDH standard asks for critical security patches to be applied as soon as practical after release, and for anti-malware on all servers and workstations, kept up to date. Patch status is part of the monthly report.
Encrypted media and safe disposal
DHA policy requires portable electronic media carrying patient data to be encrypted, and expects old PCs, laptops and other storage devices to have all data removed before destruction. The AMC covers both, with a record for each device.
Breach notice without delay
Under DHA policy, a processor that identifies a breach of patient data must inform the healthcare entity immediately, and the entity reports to the UAE Information Office and DHA. Our contract commits us to that immediate notice and to the evidence your report needs.
Four rules that change what a Dubai healthcare provider must ask of its IT supplier.
Your IT supplier is a third party under DHA policy
DHA policy PP-11 covers contractors, consultants, suppliers and vendors who access your information. Contracts with third parties must carry a data protection and confidentiality clause, and non-entity staff should sign a confidentiality agreement before doing any work for you. An AMC without those terms leaves the gap with you.
Federal law applies to every ICT system in healthcare
Federal Law No. 2 of 2019 applies to all ICT methods and usages in health fields in the UAE, including free zones. It requires health data to be kept confidential, protected from unauthorised change or deletion, and available to authorised people when needed: confidentiality, integrity and availability, which is the job of an AMC.
NABIDH sets a floor, and suppliers sit inside it
DHA's NABIDH information security standard calls its Essential controls the absolute minimum for organisations being onboarded to NABIDH. Those controls include formal service level agreements with suppliers, with penalty clauses, and regular audits of third party services.
Dubai rules, not Abu Dhabi rules
This page is about DHA requirements in Dubai. Abu Dhabi has its own standard, ADHICS, issued by the Department of Health for entities in the Emirate of Abu Dhabi. If you also run a facility there, see our ADHICS readiness page.
Dubai healthcare providers the contract is written for.
Medical clinics and medical centres
Medical clinic IT services in Dubai: front desk, consultation rooms and the clinic system kept running through every session.
Hospitals
Hospital IT support across wards, departments and shifts, with responsibilities split clearly between us, your software vendors and your biomedical team.
Laboratories and diagnostic centres
Workstations, printers and the network links between instruments, reporting systems and the people who sign results.
Pharmacies
Dispensing workstations, label printers and the connection to your pharmacy system, kept working for every shift.
Telemedicine providers
Clinician devices, identity and secure access for remote consultations, under the same access and audit rules as an in-person clinic.
Groups with Dubai and Abu Dhabi sites
One AMC across your UAE sites, with Dubai sites mapped to DHA policy and Abu Dhabi sites to ADHICS.
Priorities set by clinical impact, not by ticket order.
Resolution target
Target agreed per site in your contract
Example incidents
- No workstation can reach the clinic system
- Network or internet down at a site
- Pharmacy cannot dispense or print labels
- Suspected breach of patient data
Resolution target
Target agreed per site in your contract
Example incidents
- One consultation room or ward without a working PC
- Prescription or label printer down in one area
- Scanner or document capture failing at reception
- Backup job failed
Resolution target
Target agreed per site in your contract
Example incidents
- Single user email or password issue
- New starter account and access
- Software install on one machine
- Routine maintenance request
Cover hours are agreed per site to match your operating hours. Every P1 is written up in the monthly report with its cause.
From site walk-through to the first restore test.
- 1
Site and systems walk-through
We list every workstation, printer, network device, clinic system, specialist vendor and place where patient data is stored or backed up, at each site.
- 2
Responsibility matrix
A written split of who does what: us, your clinic or EMR software vendor, your biomedical engineering team and your internet provider. No grey zones when something breaks.
- 3
Contract with the data terms in it
Confidentiality clause and agreement, named engineer accounts, access logging, data locations, backup and restore schedule, device disposal and breach notice, all written into the AMC.
- 4
Onboarding, first restore test, monthly report
We take over support, run the first restore test, and then report each month on tickets, P1 causes, patch status, backup and restore results and access reviews.
What Dubai clinics and hospitals ask before signing.
Pages that pair with a healthcare AMC.
Get a written healthcare AMC scope for your clinic or hospital.
Tell us about your sites, workstations, clinic systems, specialist vendors and operating hours. We will confirm the scope, the responsibility split and the data terms with you.
Related Services
Explore more solutions that work great with this service
IT AMC Dubai
Annual maintenance contracts for IT infrastructure
Healthcare IT
DHA-aware IT for Dubai clinics, hospitals, and DHCC providers
Healthcare Managed IT
DHA-aware managed IT for clinics and hospitals
ADHICS V2 Compliance
The Abu Dhabi healthcare standard, read from the source
Backup as a Service
M365, endpoint, server backup, immutable
Disaster Recovery & BC
Business continuity and disaster recovery planning
Cybersecurity Audit
Security assessment and compliance audit
Switching AMC Provider
Zero-downtime transition from your incumbent AMC provider