Malaffi, NABIDH and Riayati: Understanding the Differences
Last reviewed for factual currency: 17 October 2026. Please verify current regulatory requirements and platform features with the relevant UAE health authority before relying on them operationally.
Table of Contents
- Introduction to UAE Health Information Exchanges (HIE)
- What is Malaffi? (Abu Dhabi / DoH)
- What is Nabidh? (Dubai / DHA)
- What is Riayati & NUMR? (Federal / MOHAP)
- Head-to-Head Comparison: Malaffi vs. Nabidh vs. Riayati
- Impact on Clinical Workflow and Cross-Emirate Interoperability
- Data Sovereignty, Patient Consent, and Emergency Access
- Frequently Asked Questions (FAQ)
- Official Regulatory References and Portals
Introduction
Imagine a patient who receives treatment in Abu Dhabi, visits a specialist in Dubai, and later needs follow-up care in Sharjah. Each healthcare facility may use a different electronic medical record (EMR) system, but the patient's history—including medications, allergies, laboratory results, diagnoses, and previous investigations—may be relevant to every clinician involved in their care.
The UAE has developed three important health information exchange (HIE) platforms to support the sharing of clinical information: Malaffi in Abu Dhabi, NABIDH in Dubai, and Riayati, which supports the Northern Emirates and delivers the federal National Unified Medical Record (NUMR) function. In January 2023, the UAE health authorities announced the integration of these platforms.
However, integration does not mean that every record is necessarily complete, instantly available, or accessible to every healthcare professional. Facility participation, technical implementation, data quality, and authorized access remain important considerations.
This guide explains the Malaffi vs NABIDH vs Riayati distinction, the difference between these platforms, the role of the federal NUMR initiative, and the practical implications for healthcare professionals, clinic managers, EMR administrators, and patients. It also outlines relevant legal considerations and identifies details that should be verified with the responsible health authority.
Quick Comparison: Malaffi vs NABIDH vs Riayati
| Feature | Malaffi | NABIDH | Riayati / NUMR |
|---|---|---|---|
| Primary role | Health information exchange for Abu Dhabi | Health information exchange for Dubai | Northern Emirates HIE and federal National Unified Medical Record function |
| Main authority context | Department of Health – Abu Dhabi (DoH) | Dubai Health Authority (DHA) | Ministry of Health and Prevention (MOHAP), working with participating health authorities |
| Geographic focus | Abu Dhabi | Dubai | Northern Emirates and national record exchange |
| Information exchanged | Available clinical information from participating facilities | Available clinical information from participating facilities | Information from connected facilities and integrated exchanges |
| Federal integration | Connected within the UAE's integrated HIE environment | Connected within the UAE's integrated HIE environment | Provides the federal NUMR function and links participating systems |
| Key implementation consideration | Facility onboarding, submitted data, and user permissions | DHA requirements, facility onboarding, and technical standards | Connected systems, record matching, data quality, and authorized access |
| Where to verify requirements | DoH and Malaffi | DHA and NABIDH | MOHAP and Riayati |
Important: This table describes the general roles of the platforms. It does not guarantee that every record or data field is available in every clinical encounter. Availability depends on connected facilities, submitted information, system implementation, and access permissions.
What Are the Three UAE Health Information Exchanges?
1. Malaffi: Abu Dhabi's Health Information Exchange
Malaffi is Abu Dhabi's HIE, supporting the exchange of clinical information from participating healthcare facilities. It provides authorized healthcare professionals with a consolidated view of available patient information, helping them review relevant medical history during consultations and other care encounters.
The Malaffi Abu Dhabi provider portal is not a replacement for every hospital's internal EMR. Instead, it provides access to information exchanged through the platform. What a clinician sees depends on submitted records, supported data categories, user permissions, and the relevant workflow.
Important Malaffi features and concepts include:
- Patient Risk Profile: Malaffi offers risk-related information and AI-supported clinical tools. These outputs should be treated as decision support, not as a diagnosis or a substitute for clinical judgment.
- Radiology information: The provider portal supports access to available radiology information and images for appropriately authorized users.
- Level 1 access: Malaffi documentation identifies Primary Provider users as having specific advanced access rights.
- Break the Privacy Seal: Malaffi's terminology for controlled access to certain sensitive information under specified conditions. Such access is restricted and may be audited.
- Patient access: Patients should consult Malaffi's current guidance and the relevant official patient-access service for information about viewing their available records.
Terms such as Emirati Genome Program Tag should not be treated as universally available Malaffi features without confirmation from current official technical documentation. Genomic information has specific availability and access requirements, and not every patient or clinician will necessarily have access to it.
For Abu Dhabi facilities, Malaffi EMR integration means more than installing software or enabling an icon in the EMR. Facilities should confirm onboarding, technical connectivity, data-submission arrangements, staff training, and access permissions through their organization and DoH/Malaffi channels.
2. NABIDH: Dubai's Health Information Exchange
NABIDH is the Dubai Health Authority's platform for exchanging medical records between healthcare providers in Dubai. Its official website provides information about connecting facility EMR systems to NABIDH and outlines relevant policies and standards for information exchange and privacy.
For a clinic manager researching NABIDH Dubai onboarding, the relevant questions include whether the facility falls within applicable DHA requirements, whether its EMR supports the required integration, and whether the facility has completed the necessary onboarding and testing.
A vendor's statement that an EMR is “NABIDH compatible” is not sufficient proof that a particular facility is fully onboarded or compliant. DHA publishes requirements and circulars that facilities should review directly.
Relevant technical and governance concepts include:
- Minimum Data Set (MDS): The information elements required for a particular data-exchange or reporting purpose. Confirm the current dataset and specifications with DHA.
- Clinical data exchange: The exchange of structured clinical information between connected systems according to applicable standards.
- Consent and access control: Rules governing whether and how patient information can be shared and viewed.
- Clinical completeness: The fields available in an exchange depend on implementation and data submission. The existence of a field in a technical specification does not prove that every facility populates it.
Technical terms such as Clinical Data Exchange API, cancer-staging fields, and dental fields should be described as platform capabilities only when the current DHA documentation confirms their applicability. They should not be presented as universally available in every NABIDH-connected facility.
Which HIE System Is Mandatory in Dubai?
NABIDH is the relevant DHA HIE for facilities subject to Dubai's applicable requirements. The exact onboarding obligations and technical standards depend on the facility's regulatory status and current DHA instructions.
Facilities should consult DHA's latest circulars and official NABIDH documentation rather than relying on generalized claims about mandatory participation, exemptions, deadlines, or technical requirements.
3. Riayati: The Northern Emirates HIE and Federal NUMR
Riayati has a dual role. It supports health information exchange in the Northern Emirates and delivers the federal National Unified Medical Record (NUMR) function, intended to make relevant medical information available across connected healthcare settings.
MOHAP describes NUMR as a platform integrated with NABIDH and Malaffi. Its published information says that connected healthcare providers can access patient records that include diagnoses, laboratory results, radiology reports, medications, and vaccinations. MOHAP also publishes information about Riayati's connected healthcare environment.
This makes Riayati different from a purely regional exchange. The MOHAP NUMR platform supports a broader national record-exchange function, while Riayati also serves providers in the Northern Emirates.
For a facility considering Riayati Northern Emirates EMR integration, practical requirements include verifying whether its EMR or other clinical system meets the platform's integration criteria, confirming applicable onboarding steps, and checking data quality and security requirements. Facilities should consult MOHAP and Riayati for current technical guidance.
The phrase “Federal HIE Bridge” may be used descriptively for the connecting role of the federal exchange, but it should not be presented as an official product name unless MOHAP confirms that terminology. Similarly, “Cross-Emirate Record Synchronization” describes an intended outcome rather than a guarantee that every record is synchronized instantly.
How Do Malaffi, NABIDH, and Riayati Compare in Practice?
Is Malaffi Connected to NABIDH and Riayati?
Yes. The UAE health authorities announced the integration of Riayati, Malaffi, and NABIDH in January 2023. MOHAP's NUMR information also describes Riayati's integration with the other two platforms.
The important distinction is between platform integration and universal access to every record. Integration provides a basis for exchange, but record availability may still depend on the connected facility, the information submitted, patient matching, user authorization, and the particular system workflow.
If a doctor in Abu Dhabi cannot find a record from a Dubai visit, the doctor should not assume that the patient has no relevant history or that the national integration has failed. The appropriate response is to check the approved clinical view, follow the facility's escalation procedure, and obtain the necessary records through authorized channels if required.
Advanced Clinical Features: Risk Profiles, Radiology, and National Aggregation
Malaffi emphasizes consolidated clinical information, radiology access, and certain AI-supported tools. NABIDH provides an HIE for Dubai under DHA governance and technical standards. Riayati/NUMR provides the federal record-exchange function across connected systems. These roles overlap in purpose, but they are not interchangeable descriptions of one software product.
The Break the Privacy Seal procedure is specifically associated with Malaffi's terminology. It should not be described as a shared universal function across all three platforms. Each platform has its own access-control and privacy requirements.
Clinical Workflow and Legal Obligations for Healthcare Practitioners
UAE Health Data Law Compliance for Doctors
Federal Law No. 2 of 2019 concerns the use of information and communication technology in health fields. Cabinet Resolution No. 32 of 2020 provides its executive regulation. These instruments address the use, confidentiality, security, and integrity of health information.
Dubai also has DHA policies and standards addressing health information exchange, patient rights, consent, access control, and interoperability. Legal references should be checked against the official UAE legislation portal and current DHA publications before being relied upon for a specific compliance decision.
For practitioners, practical safeguards include:
- Accessing patient information only for authorized professional purposes.
- Using individual credentials and approved authentication methods.
- Following the applicable privacy, consent, and sensitive-record access procedures.
- Maintaining appropriate records and audit trails where required.
- Escalating suspected data errors, inappropriate access, or security incidents through the facility's approved process.
This article provides general information, not legal advice for an individual case. Facilities should confirm current requirements with their regulator and qualified compliance advisers.
NABIDH Opt-Out Rules and Emergency Access
Opt-out rules should not be assumed to be identical across Malaffi, NABIDH, and Riayati. DHA publishes standards addressing health information consent and access control, including a NABIDH opt-out process. The applicable rules and consequences should be checked in the latest official documentation.
This is a platform-specific matter, not proof of a uniform UAE-wide opt-out mechanism. Patients and providers should consult the current rules for the relevant platform before drawing conclusions about what information can be shared or accessed in an emergency.
An emergency does not automatically authorize unrestricted access to every category of sensitive information. Healthcare professionals must follow the applicable access policy and their facility's procedures.
EMR Certification and Interoperability
EMR integration is both a technical and a governance responsibility. Before choosing or upgrading a clinic management system, administrators should:
- Confirm the facility's regulator and applicable HIE requirements.
- Check the software's supported interfaces and required technical standards.
- Verify current data fields, coding, validation, and submission specifications.
- Confirm onboarding, testing, approval, and production-readiness steps.
- Review authentication, role-based access, audit logs, and incident-response processes.
- Establish procedures for data-quality problems, interface failures, and ongoing updates.
HL7 and FHIR are relevant interoperability standards, but their names alone do not prove that an EMR is compliant. Facilities must follow the current specifications of the relevant HIE and regulator.
Frequently Asked Questions
Can a Doctor in Abu Dhabi View Patient Medical Records Created in Dubai?
The UAE has announced integration between Malaffi, NABIDH, and Riayati/NUMR. However, clinicians should verify that the particular record is available in their authorized clinical system. Access can depend on participating facilities, the information submitted, permissions, and system implementation. If a record is missing, follow the facility's approved process to obtain it.
What Happens If a Patient Opts Out of NABIDH or Malaffi?
The consequences depend on the applicable platform rules. DHA's published NABIDH access-control standards describe a particular opt-out process and restrictions on accessing opted-out records. Do not assume that the same mechanism or consequences apply to Malaffi or Riayati; confirm current guidance with the relevant authority.
Is Riayati a Separate System or an Umbrella Network?
It serves both a regional role in the Northern Emirates and a federal role through the National Unified Medical Record (NUMR). MOHAP describes Riayati as integrated with NABIDH and Malaffi, supporting the wider UAE health information exchange environment.
Which HIE System Is Mandatory in Dubai?
NABIDH is DHA's health information exchange for Dubai. Whether a specific facility is required to integrate, and which deadlines and technical requirements apply, should be confirmed through current DHA circulars and official NABIDH documentation.
How Can Patients Access Their Medical Records?
Access depends on the relevant platform and available patient services. Patients should consult the appropriate official patient-access service or contact their healthcare provider for information about accessing records, correcting errors, and making formal access requests.
Conclusion
The key difference in Malaffi vs NABIDH vs Riayati is their jurisdictional and operational role. Malaffi supports Abu Dhabi, NABIDH serves Dubai, and Riayati supports the Northern Emirates while delivering the federal NUMR function. Their integration is an important part of the UAE's digital-health infrastructure, designed to improve continuity of care and the availability of relevant clinical information.
For healthcare professionals, the practical priority is to confirm what information is available through the authorized system and how it may lawfully be accessed. For clinic managers and EMR administrators, the priority is to verify facility-specific onboarding, technical standards, security controls, and current regulator instructions.
Educational, Medical, and Legal Disclaimer
Educational and informational purpose: This article is provided for general educational and informational purposes. It is intended to help healthcare professionals, healthcare administrators, licensing applicants, and members of the public understand the general roles of UAE health information exchange platforms. It does not replace official guidance, professional training, or advice from the relevant health authority.
Not medical advice: This article does not provide diagnosis, treatment recommendations, or patient-specific medical advice. Decisions about an individual's care must be made by qualified healthcare professionals using the relevant clinical information and the patient's circumstances.
Not legal or regulatory advice: The discussion of legislation, privacy, consent, access controls, and EMR integration is a general summary, not a legal opinion or a determination that a particular facility or professional is compliant. Laws, regulations, circulars, technical standards, and platform procedures may change. Confirm the current requirements with DoH, DHA, MOHAP, or a qualified legal or compliance professional.
Accuracy and limitations: Reasonable care has been taken to present the information clearly. However, platform functionality, integration coverage, data availability, and access permissions may vary by facility, user role, technical implementation, and date. Gulf Care Careers (GCC) does not guarantee that every record or feature described here is available in every setting.
Privacy and patient confidentiality: Never share another person's medical information without proper authorization. Healthcare professionals must follow applicable privacy legislation, professional duties, facility policies, and platform access controls.
Non-Affiliation and Non-Endorsement Disclaimer
Gulf Care Careers (GCC) is an independent informational and career-guidance website. Unless expressly stated otherwise, it is not owned, operated, sponsored, endorsed, or officially affiliated with the UAE Ministry of Health and Prevention (MOHAP), Department of Health – Abu Dhabi (DoH), Dubai Health Authority (DHA), Malaffi, NABIDH, Riayati, or any government agency, healthcare regulator, or platform mentioned in this article.
Names of organizations, platforms, laws, and technical standards are used solely to identify the relevant entities and explain their publicly described roles. Mention of a platform or organization does not imply endorsement, partnership, certification, or authorization by that entity.
Readers should consult the relevant official organization for binding requirements, formal instructions, current technical documentation, and individual case enquiries.
Sources and Official Verification
The following official resources are provided for further reading and verification. Readers should check that a linked page remains current and applicable to their circumstances.
- MOHAP: National Unified Medical Record (NUMR)
- MOHAP: Riayati official resources
- MOHAP: Announcement about integration of Riayati, Malaffi, and NABIDH
- Malaffi: General frequently asked questions
- Malaffi: Provider portal information
- NABIDH: Official DHA platform
- UAE Legislation: Federal Law No. 2 of 2019
- UAE Legislation: Cabinet Resolution No. 32 of 2020
Publication verification note: Before relying on any specific claim about AI features, technical fields, consent requirements, data sovereignty, facility onboarding, or cross-emirate access, verify it against the latest official documentation from the relevant authority.
🩺 Editorial Review Board & Medical Reviewers
To ensure uncompromising clinical accuracy, adherence to YMYL standards, and compliance with regional and international healthcare guidelines, our content is rigorously reviewed and verified by practicing medical specialists, registered nurses, certified coders, and academic professors:
Statutory References & Official Regulatory Anchors
To ensure absolute authenticity, originality, and high E-E-A-T standards regarding health information exchanges in the UAE (Malaffi, NABIDH, and Riayati), the administrative and technical frameworks detailed in this article are anchored in official federal laws, emirate decrees, and international governance standards.
| Governing Organization | Law / Ordinance Name | Article & Statutory Anchors | Scope & Subject Matter | Referred Page URL |
|---|---|---|---|---|
| Dubai Health Authority (DHA) | Dubai Health Data Law No. 11 of 2018 | Articles governing mandatory health data exchange and NABIDH integration | Establishes the legal mandate for NABIDH (Network and Analysis Backbone for Integrated Dubai Health), making electronic health record sharing compulsory for all DHA-licensed public and private facilities in Dubai. | https://www.dha.gov.ae |
| UAE Federal Government | Federal Decree-Law No. 2 of 2019 Concerning Health Data Protection | Federal Articles on electronic health data confidentiality, security, and cross-emirate governance | Governs federal-level data privacy, patient confidentiality, and security boundaries for health information systems operating across the United Arab Emirates. | https://uaelegislation.gov.ae |
| Cabinet of the UAE | Cabinet Decision No. 32 of 2020 | Executive Regulations supplementing health data protection and information exchange standards | Provides administrative provisions and regulatory enforcement guidelines for electronic health data management and patient record security. | https://u.ae |
| Department of Health – Abu Dhabi (DoH) | DoH Policy on The Abu Dhabi Health Information Exchange (Malaffi) & ADHICS Standard | DoH Regulatory Mandate & Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard | Mandates Malaffi connectivity for all DoH-regulated healthcare entities in Abu Dhabi, outlining patient data privacy, secure exchange protocols, and clinical interoperability. | https://www.doh.gov.ae |
| Ministry of Health and Prevention (MOHAP) | Federal National Unified Medical Record (Riayati) Regulations | National Health Data Infrastructure Mandate | Governs Riayati as the federal overarching health information exchange program linking emirate-level platforms (Malaffi and NABIDH) across all seven emirates. | https://mohap.gov.ae |
| World Health Organization (WHO) | WHO Global Strategy on Digital Health | International Digital Health Governance & Data Security Frameworks | Establishes global benchmarks for secure health information exchange, patient data stewardship, and ethical digital health transformation. | https://www.who.int |
Editorial Evaluation & Medical Content Guidelines
At Gulf Care Careers, our editorial team evaluates health career guides and clinical standards according to rigorous credibility metrics:
-
Verified Suffixes: Regulatory information is cross-checked against official government portals (
.govor.gov.ae), educational institutions (.edu), and non-profit health organizations (.org). - Practitioner Authorship & Verification: Content is compiled and reviewed by allied healthcare credentialing experts and recruiters with direct field experience across Arabian Gulf licensing portals.
- Elimination of Commercial Bias: Guides are purely educational and objective; we avoid sponsored cure claims, unverified health products, or guaranteed licensing outcomes.
