On 6 May 2019, Federal Law No. (2) of 2019 Concerning the use of Information and Communications Technology in Health Fields (the Law) will come into force and effect. Although the Law is still reliant on the subsequent issuance of a number of executive regulations anticipated to provide further detail with regard to compliance obligations, there are a number of important aspects of the Law which organisations, individuals and other stakeholders should take note of at this point.
The Law envisages the establishment, by the Ministry of Health and Prevention (the Ministry), of a "Central System" to house and exchange health data and information. It is worth noting that the concept of what constitutes health data and information is very broadly defined, encompassing anything processed by ICT means in any format that may characterise or relate to a "health feature" including information on health and insurance establishments, relevant authorities and so-called health services beneficiaries. Various provisions of the Law then provide for certain obligations to be met in connection with such information, including those in relation to confidentiality, consent, security, access and retention.
It is also worth noting that the scope of the Law applies to "all methods and uses of [ICT] in the areas of health" in the UAE, and is also expressly stated to apply in the free zones. As such, the Law casts a potentially very broad net in terms of the relevant entities or individuals who should be concerned about what steps may be needed to be taken to ensure compliance moving forward. Moreover, the Law stipulates certain data localisation requirements whereby health data and information that pertains to health services provided inside the UAE must remain within the UAE, subject to possible exemptions that would need to be granted by way of resolution issued by the relevant health authority in conjunction with the Ministry. However, as with other aspects of the Law, the underlying detail of the data localisation requirements are pending clarification by way of subsequent regulatory instruments (which are anticipated to be issued by August of this year).
The coming months should be informative in terms of setting out further information about the obligations and compliance-related requirements that will emerge under the Law. For the time being, however, impacted organisations and other stakeholders should review what has already been set out in the Law and begin to formulate a plan for what further steps they will need to take before it comes into force next month.
Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.