1 Purpose and scope
This policy protects health reports, tests, treatment plans and images received or shared by the Association to support cases. The applicability of health legislation to the Association or service provider is determined before any system or exchange is introduced. Holding a medical report does not authorise the Association to provide healthcare. (1)
2 Receipt and verification
Reports are received from beneficiaries, representatives or healthcare providers on a lawful basis. Their source, date and issuing entity are recorded. Originals are preserved, and inconsistencies referred to a competent source for clarification, without changing diagnoses, doctors’ signatures or combining reports belonging to different people.
3 Access and use
Access is limited to the case officer, medical reviewer and those needing it for the decision. Finance receives only the service cost and information required for payment. Social notes are separated from medical records when access needs differ, and case identifiers are used in discussions and management reports.
Consent to treatment or an assistance request alone does not permit health data to be used for publicity, research or training a technical model. The independent basis, purpose, approvals and feasibility of anonymisation are reviewed. Removing a name alone is not sufficient if the person remains identifiable. (2)
4 Sharing and hosting
Each exchange request records its reason, recipient, data, channel, consent or other basis. The service provider’s authorisation is verified. Full reports must not be sent to donors when an aggregate progress report is sufficient. Sharing is limited to the minimum necessary, with receipt documented.
Before storage, transfer or processing outside the UAE, the applicable prohibition, exception and health authorisation are checked. External hosting or AI services must not be used for health files until legal and technical assessments and specific approvals are complete. A confidentiality agreement is not assumed to be sufficient.
5 Integrity and correction
Viewing, modifying and exporting files are logged. Files are protected through encryption, limited access and backups. Errors are corrected through an attachment or documented version from the source, preserving the audit trail. Misdelivery or disclosure is reported to the incident lead immediately, and sharing is stopped.
6 Retention and closure
Reports are retained for the applicable health-law period and, where related to administrative or financial records, for the longer mandatory period. The specific period is determined after the Association’s scope is resolved and is marked as requiring legal review. Destruction is suspended during disputes or competent-authority requests, and any sharing after closure is documented.
References in the approved document
- Federal Law No. 2 of 2019 on the Use of Information and Communication Technology in Health Fields and its Executive Regulation under Resolution No. 32 of 2020, where applicable. This document sets internal implementation controls without changing a higher-level legal requirement or competence.
- Dubai Health Authority, Health Data and Information Sharing Policy DHA/HISHD/PP-13 of 2024, within its regulatory scope. This document sets internal implementation controls without changing a higher-level legal requirement or competence.