What Dubai and Saudi Arabia teach us about connected records

The region has two government models worth learning from. We do not compare ourselves to them: they are national infrastructure, and we are an operations layer for providers.

Dubai’s NABIDH links healthcare facilities so that a patient’s information can follow them, under rules on consent. Saudi Arabia’s NPHIES sits between hospitals and insurers, and has a health information side as well. Both show what must be settled before anything connects.

What can Dubai and Saudi Arabia teach about connected records? Three things. Shared rules come before technology: who sees what, and with whose consent. Consent and privacy are the basis of trust, not an add-on. And administrative delay is an operations problem that can be organised, not a fact of life. Each applies to a single clinic as much as to a national platform.

In short:

• Dubai’s NABIDH is a health information exchange that links facilities; its published rules cover consent, opting out and a documented exception for emergencies.
• Saudi Arabia’s NPHIES has two parts, Taameen for insurance and Sehey for health information, and acts as the intermediary between hospitals and insurers.
• The lessons travel: write the rules first, treat consent as the foundation, and treat delay as something to organise and measure.

Two models, two jobs, one starting point.

What is a health information exchange? Five terms

Words that come up whenever records are connected, in plain language:

• Health information exchange: a shared platform through which facilities pass health information to one another under common rules. Dubai’s NABIDH is one.
• Consent and opting out: consent is the patient’s permission to share; opting out is the patient saying no to sharing through the platform.
• Break the glass: in the Dubai Health Authority’s definition, access by health professionals to a patient’s information without consent, when necessary to lessen or prevent a serious threat to the patient’s health, such as an emergency.
• Intermediary: a platform between two sides, such as hospitals and insurers, that passes requests and replies between them. NPHIES’s implementation guide calls the platform a “smart courier”.
• Implementation guide: the published technical rules every connected system follows. NPHIES’s guide says it provides the standards used by all parties for the exchange of financial information.

The Dubai model: NABIDH

According to published coverage and the authority’s own documents, Dubai’s health authority runs a health information exchange that links facilities. It rests on patient consent, allows opt-out, and has a documented exception for emergencies when a patient cannot consent.

Those documents fill in the detail:

• Consent. The authority’s 2025 standard on consent and access control says consent should be specific, freely given, informed and unambiguous, and requires facilities to include sharing with NABIDH in the general consent they ask patients for. Gulf News reported in 2024 that patients at a connected facility are asked to consent.
• Opting out. The patient-rights policy lets patients opt out of NABIDH and opt back in at any time. Under the 2025 standard, withdrawing does not undo earlier sharing, and an opted-out patient’s information should not be retrieved through emergency access. As Gulf News put it, citing NABIDH: opt out, and access is blocked even for emergency treatment.
• The emergency exception. Only physicians giving direct care may use “break the glass” access, for an emergency condition or a serious threat to public health. The reason and a detailed audit trail must be documented; the access triggers a notification, is monitored and is reviewed regularly. The patient should be told of it.
• Access by role. The authority’s authentication policy limits exchange to the minimum number of people needed for the purpose, and grants access by role, according to each person’s job.
• Patients’ rights. Patients should be able to see their information in a readable, electronic form, ask for a report of who disclosed it and to whom, and upload documents from care received outside Dubai and the UAE.

What this means for a patient is in a record that moves with you and from Cairo to Dubai: the cross-border patient’s paperwork.

The Saudi model: NPHIES

NPHIES is a national platform with two parts: Taameen for health insurance (eligibility, pre-authorisation, claims) and Sehey for health information. According to a published interview with an official, hospitals used to deal with insurers directly; now the platform is the intermediary.

The interview, given in 2023 by the medical director of Saudi Arabia’s Council of Health Insurance, describes the change: before Taameen, hospitals sent requests directly to insurance companies, following the prior authorisation process; now hospitals and insurers connect their systems to NPHIES, requests go through it and insurers respond through it, so the council can monitor the transactions. Sehey, meant to hold data such as medication history, allergies, vaccination records and outpatient visits, was then in testing, and he called the process for hospitals “quite costly and complex”.

One platform in the middle, instead of a line from every hospital to every insurer.

The platform’s implementation guide describes the design: a centralised, validating, standards-based gateway connecting providers and payers, with no more peer-to-peer exchanges. Transactions are checked against data formats and coding standards, and invalid ones are rejected. The guide is as clear about what NPHIES does not do: it does not adjudicate claims, regulate the market or determine fraud, and it is not a practice management system for providers. In a 2022 interview, integrating health information, radiology and revenue-cycle systems with the platform was described as part of what providers and payers need to use it, which is why we called integration large, slow work in on top of your system, not instead of it.

Put side by side, the two models teach three lessons.

Three lessons that apply to a clinic as much as to a country.

Lesson one: shared rules come before technology

Shared rules come before technology: who sees what, and with whose consent.

Both models show it. NPHIES’s guide explains why a platform was needed at all: historically, each provider organisation developed its own codes for billing and information management, and the result was a lack of efficiency and of interoperability. The answer was a standard every party uses. Dubai’s documents start the same way, with roles: access granted on a need-to-know basis, with the least privilege that does the job.

For a clinic, the lesson costs an afternoon. Before choosing any software, write down four things:

1. Who may see each part of a patient’s file, and why their job needs it.
2. What a patient is asked to agree to, and where that agreement is kept.
3. What happens in an emergency, and who reviews it afterwards.
4. Which names you use for the same thing, so two desks do not call one test by two names.

Lesson two: consent and privacy are the basis of trust

Consent and privacy are the basis of trust, not an add-on.

Dubai’s rules put consent and its limits in writing: what the patient agreed to, how to withdraw, what happens in an emergency, and a notice when anyone breaks the glass. Saudi Arabia’s Personal Data Protection Law, in the English translation published by the Saudi Data and AI Authority (SDAIA), counts health data as sensitive data, and lists among a person’s rights access to their data, a copy in a readable and clear format, and correction. In Egypt, published legal commentary on the executive regulations describes explicit written consent for processing health data, as set out in the data-protection law and your clinic.

A record patients do not trust is a record they will not share. So decide first what the patient controls, then build the connection around it. For a clinic, that means telling patients what is shared, with whom and why; recording consent where you can find it; and keeping a trail of who opened a file, so “who looked?” has an answer.

Lesson three: administrative delay is an operations problem

Administrative delay is an operations problem that can be organised, not a fact of life.

Taameen’s story is about exactly that. A request that used to travel from each hospital to each insurer now goes through one platform, which checks it, delivers it and lets the regulator watch the flow; the official interview lists patient care delays among the issues the council can address that way. The implementation guide publishes key performance indicators, among them the share of authorisations adjudicated within 30 minutes. A delay that is measured can be managed.

A clinic has its own version: the hours a case waits for a missing paper, a callback or an approval. Count them before trying to fix them. Time to the next step is one of the things a first pilot measures, as set out in measure before we claim.

Test what you took from the two models. Six statements; decide whether each is true:

A composite example: one clinic, three lessons

A composite example, built from many cases, with no identifying detail. A clinic with three doctors receives results by chat, keeps paper files at reception and chases insurers’ approvals by phone. It wants to “connect its records”.

• Rules first. Before looking at software, the owner writes one page: who opens which part of a file, what patients are asked to agree to, and who may open a file in an emergency and who reviews it the next day.
• Consent. The reception form gets a separate line on sharing, in plain words, and the signed forms get one place.
• Delay. For two weeks, the front desk notes when each approval was requested and when it came back. The longest waits share a cause: a missing paper.

Only then does the clinic talk to a software supplier, with a page of rules and a measured problem. It needed no national platform, only the order the two models followed.

Common mistakes, and how to avoid them

• Choosing the software before the rules. Write the page first.
• Treating consent as one signature at reception. Ask for what each kind of sharing needs, in plain language.
• Emergency access with no review. Write down who may use it and who checks it afterwards.
• Calling delay normal. Measure it before deciding it cannot change.

What is different for us

Every market has its own conditions. Medigize builds for a region where patients often pay out of pocket and sometimes cross borders for care, and it works on top of provider systems. We do not claim any partnership or connection with any national platform.

That changes where the work sits. A national exchange connects facilities from above; Medigize starts from the case: the complaint, the file, the handover and the follow-up, inside the systems a provider already runs. That is why our story does not start with AI. And the rules the two models wrote first are the ones we build on: consent-based sharing, only what is needed, and a trail of who looked. See Medigize for providers and our governance and privacy page.

Frequently asked questions

What is NABIDH?

Dubai’s health information exchange, run by the Dubai Health Authority, connecting public and private healthcare facilities in Dubai under the authority’s rules on consent and access.

Can patients opt out of NABIDH?

Yes. The authority’s patient-rights policy provides an opt-out and a way back in at any time. Under its 2025 standard, an opted-out patient’s information should not be retrieved through emergency access.

What happens in an emergency if a patient cannot consent?

Dubai’s standard allows physicians giving direct care to use “break the glass” access in an emergency, with the reason and an audit trail documented, a notification, and a review.

What is NPHIES?

Saudi Arabia’s national platform with two parts: Taameen for insurance transactions such as eligibility, prior authorisation and claims, and Sehey for health information.

Does NPHIES decide insurance claims?

No. Its implementation guide says it validates and delivers transactions but does not adjudicate them, regulate the market or determine fraud.

What can a clinic learn from national health platforms?

Write the rules before choosing technology, treat consent as the foundation, and measure administrative delay so it can be organised.

Do Dubai’s and Saudi Arabia’s rules apply in Egypt?

No. Each country has its own. In Egypt, published legal commentary on the executive regulations of the Personal Data Protection Law describes health data as sensitive data, with explicit written consent required to process it. This is not legal advice.

Is Medigize connected to NABIDH or NPHIES?

No. We do not claim any partnership or connection with any national platform. Medigize works on top of provider systems.

Medigize is a non-diagnostic navigation tool. This article is general information, not medical advice. In an emergency, call an ambulance or go to the nearest emergency department.

References

1. Dubai Health Authority: Standards for Health Information Consent and Access Control (2025)
2. Dubai Health Authority: NABIDH Policies and Standards, Subject of Care Rights (2020)
3. Dubai Health Authority: NABIDH Policies and Standards, Authentication and Authorization Policy (2020)
4. Gulf News: Emergency in Dubai? NABIDH ensures doctors know your medical history instantly (2024)
5. Healthcare IT News: Understanding NPHIES, KSA’s health information exchange (2023)
6. NPHIES: Healthcare Financial Services Implementation Guide, introduction
7. CIO: Saudi Arabia transforms healthcare with NPHIES data exchange (2022)
8. Saudi Data and AI Authority (SDAIA): Personal Data Protection Law, English translation
9. Chambers and Partners: A first look at Egypt’s personal data protection executive regulations