UAE Healthcare / Pharma LawFederal Law No. (2) of 2019, Concerning the Use of the Information and Communications Technology in Health Fields

Article (1) Definitions In application of the provisions of this Law, the following words and expressions shall have the meanings ascribed thereto unless the context requires otherwise: State : The United Arab Emirates. The Ministry : Ministry of Health and Prevention. The Minister : Minister of Health and Prevention. Health Authority : Any federal or local governmental Health Authority in the State. Health Authority : Every authority in the State providing health services, medical insurance services, or health insurance, mediating therein, managing its requirements, or electronic services in the area of health or any authority associated directly or indirectly to the application of the provisions of this Law. person : Natural or legal person. Central System : A set of operations for the electronic exchange of the health data and information including, the set of parts or electronic elements which are related to each other by some relations working together in order to achieve certain objective. Data : Whichever that may be stored, processed, generated and

-- 3 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 4 transformed through the information and communication technology, such as numbers, letters, codes, images and the like. Health Information : The health data which had been processed and became with a meaning, whether visual, audio or legible, and characterised by the health feature, whether related to the health or insurance establishments or authorities or to the beneficiary from the health services. Process : Information creation, introduction, amendment, update or deletion electronically. Circulation of Health Information : Accessing, exchanging, copying, photocopying, transforming, storing, publishing, disclosing or sending the health data and information. Professional Guidance Manuals : A description for the methods, works and procedures that shall be used as instructions. Information and Communication Technology : Technological and electronic tools or systems or other means allowing the possibility of processing all types of information and data, including the possibility of storing, recovering, publishing and exchanging them.

-- 4 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 5

Article (4) Obligations of using the information and communication technology Upon using the information and communication technology in the areas of health, it shall be committed to the following: 1. To keep the confidentiality of health data and information by not allowing to circulate them in cases other than the permitted. 2. To ensure the validity and credibility of the health data and information by keeping their safety from the non-authorised damage, amendment, alteration, deletion or addition.

-- 5 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 6 3. To ensure the availability of health data and information to the authorised thereof and facilitate the access thereto, if needed.

Article (10) Coordination between the Ministry and the Relevant Entity or the Health Authority In coordination with the Health Authority or the Relevant Entity, the Ministry shall conduct the following: 1. To set and apply a national strategic plan in the area of using the information and communication technology in the areas of health. 2. To set mandatory mechanisms and procedures for using the information and communication technology in the areas of health, according to provisions of this Law and the laws applicable in State. 3. To apply the initiatives and programmes specified in the strategy and the technical standards and assess them. 4. To set the controls, standards and procedures of the electronic operational programmes used in 5. To set the mechanisms and procedures of the circulation of the health data and information.

-- 7 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 8

Article (15) Obligations of using the central system 1. Persons authorised to use the central system shall be committed of the following: A. To handle the information necessary to complete the required work or the specified purpose. B. The information circulation shall be limited with the authorised persons only. C. Not to amend the health data and information by deletion or addition unless according to the specified controls. D. Not to publish the health data and information, as well as the statistics related to the area of health, unless according to the specified controls. 2. The Executive Regulation of this Law shall specify the terms and controls of applying the provision of this Article.

Article (16) Confidentiality of the patient information and exception therefrom Without violation to any applicable legislations, whoever circulates information related to the patients must keep its confidentiality and not to use them except in the health purposes without written approval from the patient, except in any of the following cases: 1. The health data or information requested by the health insurance companies or any authority funding the health services regarding the health services received by the patient, for the review, approval or verification of the financial entitlements related to such services. 2. Purposes of the scientific and clinical research, provided that not to disclose the identity of the patients and to observe the morals and rules of the scientific researches. 3. To take the preventive and curative procedures related to the public health or to keep

-- 9 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 10 the health and safety of the patient or any other person contacting him. 4. Upon a request by the competent judicial authorities. 5. Upon a request by the Health Authority for purposes of monitoring and inspection and keeping the public health.

Article (20) Keeping the health data and information 1. The following shall be required to keep the health data and information through the

-- 10 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 11 information and communication technology: A. The keeping period shall commensurate with the need to the health data and information, provided that the keeping period shall not be less than (25) twenty-five years from the last date of the health procedure of the person concerned with such health data and information. B. To ensure the confidentiality standards and validity and credibility of the data and information. 2. The Executive Regulation of this Law shall specify the controls and procedures of applying the provision of this Article.

Article (25) Disciplinary Sanctions Without violation to the disciplinary punishments prescribed in this Law or any other Laws, the Health Authority, each according to its competence, shall punish the establishments which provide health services or work in the area of the health researches, or the establishments authorised to use the central system, which violated the provisions of this Law, its Executive Regulation or its applying resolutions, by any of the following disciplinary sanctions: A. Written notice. B. Written Warning. C. The penalty which is no less than (1000) one thousand Dirham and no more than (1.000.000) one million Dirham. D. Suspending the license of using the central system temporary for no more than six months. E. Cancelling the license of using the central system.

-- 12 of 15 --

Federal Law No. (2) of 2019 Concerning the Use of the Information and Communications Technology in Health Fields 13

Article (25) of this Law, may complain of the resolution before the complaints committee which is formed in the Health Authority, within (15) fifteen days from date the complainer is notified of the resolution. 3. The complain must be considered within (30) thirty days from the date it is submitted. The non-reply to the complain within such period shall be deemed as rejection thereto. 4. The resolution issued in the complain shall be final. 5. Whoever his complain is rejected may appeal before the competent courts in State within thirty days from the date of being notified of the rejection of the complain or the termination of the thirty days period mentioned in Clause (2) of this Article. Chapter IV Final Provisions