Choose your country edition
New Zealand United States Canada Singapore United Arab Emirates All countriesConsent, privacy and communication
Patient confidentiality course for the UAE: health data law, information exchanges, WhatsApp, sponsors and breach response
Licensed doctors, dentists, nurses, midwives, pharmacists and allied health professionals in Dubai, Abu Dhabi, Sharjah and the Northern Emirates, including those responding to a breach, an access audit or a complaint about disclosure.
Structured learning and a written reflection to show insight after a complaint, an investigation or a licensing authority inquiry.
Focused learning on a core standard of practice, with a certificate and reflection for your portfolio.
Every working day in the UAE brings requests for patient information that are hard to judge on the spot: a sponsor asking why an employee was off work, a spouse wanting test results, an insurer chasing a claim, a police officer at the front desk, a colleague in a group chat asking for a quick photo of a scan. This course gives you a clear method for those moments. It sets out the confidentiality duty in Federal Law No. (2) of 2019 on the use of ICT in health fields, which includes keeping health data inside the State and retaining it for at least 25 years, and the limited cases in which Federal Decree-Law No. (4) of 2016 on Medical Liability allows a patient's secrets to be disclosed.
The emirate layer comes next. You will see what the DHA Standards for Code of Ethics and Professional Conduct expect of Dubai licensees, how the DOH information security standard ADHICS shapes everyday behaviour in Abu Dhabi, and how access to NABIDH, Malaffi and Riayati is logged and audited. The course is written for physicians, dentists, nurses, midwives, pharmacists and allied health professionals licensed by the DHA, DOH, MOHAP or SHA, or working in Dubai Healthcare City, and it suits clinicians who have just arrived in the UAE as well as those who have practised here for years.
It is also built for the professional whose handling of information has already been questioned, whether through a patient complaint, an access audit that flagged a record you opened, a facility investigation or a letter from your licensing authority. The final section walks through containing and reporting a breach, how authorities and committees treat confidentiality failures, and how to write a reflection that shows you understand what went wrong and what you now do differently. Completing it can help you show targeted learning on the exact standard in question; it does not decide the outcome of any case.
Confidentiality concerns in the UAE often come with hard evidence: an audit trail of record look-ups, a forwarded message from a group chat, a report sent to the wrong email. Because the facts are rarely in dispute, what a committee or employer focuses on is your response. This course helps you show that you understand the health data law, the disclosure gateways and your authority's information security standards, that you acted promptly once the breach was found and that you have changed the habits behind it.
The certificate shows when you completed two hours on confidentiality and health data. The reflective account follows four questions, what happened, what you learned, what you will do differently and how you will show it, which gives a panel a clear line from the event to your remediation. A personal confidentiality checklist adds evidence your manager can see in use. For routine CPD, your licensing authority decides how any learning counts towards your CPD or a requirement it has set.
What you will have at the end
A scan in the group chat and a look-up out of curiosity
Consider, for illustration, a radiographer in a government hospital in Abu Dhabi. A well-known local figure is admitted after a road accident. A colleague in the department's WhatsApp group asks whether anyone has seen the scan, and the radiographer posts a cropped image with no name. Later that evening, out of curiosity, she opens the patient's history through Malaffi from a workstation she was not using for his care.
A relative sees the image forwarded on social media and recognises the injury from news reports. The hospital's audit trail shows the radiographer's look-up with no clinical reason. She says the image had no name on it and she was only checking on the patient. The investigation treats both acts as breaches: indirect identification through a messaging app, and access to a record without a need to know.
The course addresses both. Section 3 explains role-based access, the rules of Malaffi, NABIDH and Riayati, and why every look-up is logged. Section 6 covers why personal messaging apps are restricted and how patients can be identified without a name. Section 7 sets out the immediate steps after a breach, how licensing authorities respond and how to show insight through targeted change.
Illustrative example, not a real case.
10 sections · 23 lessons · 2 hours (estimated) · 20-question final assessment
Final assessment
20scenario-based questions
Certificate of completion
A certificate of completion for your learning portfolio.
Completed12 Oct 2026The course includes a structured reflective account template: guided prompts to record what you learned, how you will apply it and how the change will show in your practice. It gives you written evidence of insight after a concern, and a ready record for your CPD portfolio.
Write it in your own words and leave out anything that could identify a patient, a colleague or a case. If you have an open complaint or case, talk to your adviser before reflecting on it in writing.
Not without the patient's consent, unless a specific legal gateway applies. A sick-leave certificate can confirm unfitness for work without stating the diagnosis. The course works through sponsor and employer requests, occupational health referrals and what to say when a manager insists, so you can refuse politely and record what was asked.
It makes the confidentiality of health data a legal duty for anyone handling it, requires health data to be stored and processed inside the UAE except where the law allows otherwise, and sets a minimum retention period of 25 years from the last procedure. The course turns these duties into practical habits at the workstation, on your phone and when using cloud or AI tools.
Yes. Health information exchanges keep audit trails of who opened which record and when. Opening the record of a relative, a colleague or a well-known patient without a care reason can surface in an audit and lead to an investigation. Section 3 covers lawful access, and Section 7 covers what to do if an audit has already flagged you.
It can be. Consumer messaging apps sit outside your facility's controlled systems, and photos or identifiers shared there can travel well beyond the team. The course explains what your licensing authority and facility expect, how to use authorised channels, and how to clean up safely if something has already been posted.
It can help you show that you understand the duty you are said to have breached and have changed how you work. The final section covers breach response, how authorities view these cases and how to build a reflective account and a practical plan. Take advice from your facility, insurer or a UAE lawyer about your own case before sending any statement.
It provides 2 hours (estimated) of learning with a certificate showing the title, hours and date. Your licensing authority decides how any learning counts towards your CPD or a requirement it has set. Check your DHA, DOH, MOHAP or SHA requirements before relying on it.
Twenty questions, each built around a realistic request or incident in a UAE clinic, pharmacy or hospital. A score of 16 or more (80%) is a pass. Before that, every section closes with a brief check of your understanding, and you have 12 months' access on phone, tablet or computer.
Every legal and regulatory point comes from primary sources: UAE federal health laws, the licensing authorities' codes, standards and policies, and official government guidance. Anything we cannot confirm is left out.
Lessons, scenarios and assessment questions are written by us for each edition separately, then checked for accuracy, teaching quality and fair assessment before publication.
When a code, standard or law changes, the affected courses are reviewed and updated. Reported errors in legal or regulatory facts are corrected first.
Records that hold up when someone else reads them: what to write, consent and refusal, labelled late entries, template pitfalls, reports, sick notes, retention and keeping the file intact.
Health advertising and online conduct in the UAE: when a post is an ad, approval routes, the Advertiser Permit, banned claims, before-and-after images, consent, reviews and remediation.
Complaint routes in each emirate, the committee process, deadlines, the first 72 hours, building a chronology and writing an honest, structured response.
