Hospital management systems in the UAE: what to scope, and how NABIDH, Malaffi and Riayati fit in

Three exchanges, split by region

The UAE does not have one hospital data exchange. It has three, and the official pages describe them by region.

NABIDH is defined by the Dubai Health Authority as a health information exchange platform that connects public and private healthcare facilities in Dubai to share health information securely. Malaffi calls itself the region's first health information exchange platform and says it is commissioned with connecting healthcare facilities in the Emirate of Abu Dhabi, working in collaboration with the Department of Health. Malaffi's own FAQ describes Riayati as the HIE for the Northern Emirates and as the National Unified Health Record.

The exchanges also talk to each other in places. Malaffi's FAQ says it is linked to Riayati and that integration with NABIDH is a future plan. DHA's Policy for Health Data and Information Sharing lists all three as the exchanges for sharing records between organisations in the UAE, with patient consent.

This article does not cover Riayati's own connection rules, because I could not confirm them on a MOHAP or Emirates Health Services page. Ask MOHAP or EHS for the current requirements.

Who has to connect, according to the official pages

Abu Dhabi is the clearest. Malaffi's page on facilities required to connect says all licensed DOH healthcare facilities, except those exempt, must connect. Non-exempt facilities that have not connected will not be able to renew their DOH licence, and facilities with Daman agreements cannot submit claims until they connect. Military, police, aviation and university facilities are among the exemptions. A facility with a preliminary licence is expected to connect as a prerequisite for its active licence.

For Dubai, DHA's Standards for Interoperability and Data Exchange apply to all DHA licensed health facilities. They name HL7 v2 as the recommended standard for submitting and accessing data, and say systems should also support FHIR and IHE profiles. DHA's consent standard adds a detail that lands in your registration forms: consent is not required for a facility to upload records to NABIDH, but the facility's general consent must include a clause on sharing with NABIDH, and patient opt-out is handled by DHA.

None of this is legal or regulatory advice. Rules change, and the authority's current documents win over this article.

Which emirate's exchange applies to you

My rule is simple. Ask which authority licenses each branch, then plan for that authority's exchange. A clinic licensed by DHA plans for NABIDH. A hospital licensed by DOH plans for Malaffi.

Groups are where it gets harder. A group with a hospital in Abu Dhabi and clinics in Dubai may face two exchanges, two onboarding processes and two sets of documents. I list every branch and its licensing authority in the scoping document before I estimate anything, because that list decides how many integrations sit in the quote.

The departments I would build first

HealthOS, the hospital platform I architected, covers outpatients (OPD), inpatients (IPD), emergency, operation theatre, pharmacy and inventory, laboratory, radiology, patient billing, Saudi e-invoicing, insurance workflows, procurement and warehouse, HR and payroll, accounting and operational reporting. A full list like that is the destination, not the first release.

I would not start with emergency or theatre. They lean on everything else: patient records, orders, pharmacy stock and billing. Start where every patient passes. Registration and OPD create the record. Pharmacy and billing turn visits into stock movements and invoices. Once those four are stable, the rest plugs into a working spine instead of a half-built one.

A phased rollout I would propose

Each phase goes live before the next one starts, so staff learn one set of screens at a time. The exchange integration runs as its own track, because its timing depends on the authority as well as on me.

Why the exchange integration is its own line item

Part of the work is not mine to control. Malaffi lists an accession agreement, a facility declaration, a security assessment drawn from DOH's ADHICS survey and a network connection before a facility goes live. Those steps involve your team and the authority, not only code.

The code part is real too. The HMS has to produce messages in the standard the exchange expects, keep patient identifiers clean, record consent where the authority asks for it, and pass testing on the exchange's side. I scope this with its own acceptance criteria, so a delay in onboarding never holds the hospital modules hostage.

To be clear about HealthOS: it was designed with Saudi requirements in mind, including e-invoicing and insurance workflows. It is not connected to NABIDH, Malaffi or Riayati. A UAE hospital would get that integration scoped as new work for its own emirate.

• Which authority licenses each branch
• Which exchange each branch connects to, and whether it is already connected through another system
• Who at the hospital owns the onboarding paperwork
• Which messages and data sets the exchange expects first
• Where consent is captured, and the wording the authority requires
• Who signs off the integration, separate from the hospital modules

A custom HMS gets a fixed quote after scoping

Hospital systems do not have a published price on my site, and they should not. The number depends on how many departments, branches, insurers and exchanges you need. So I scope first: departments by phase, branches by emirate, the integration track, and Arabic and English if both are needed. Then you get a fixed quote for the agreed scope.

The build follows the HealthOS stack: Next.js and React on the front end, NestJS with Prisma on PostgreSQL, Redis, MinIO for files and Docker for deployment. My role is the same as on HealthOS: software architecture, product design and technical leadership. Third-party fees, hosting and maintenance sit outside the build price.