Find a Healthcare Regulatory & Licensing Lawyer

Dubai's healthcare sector is regulated by the Dubai Health Authority (DHA); Abu Dhabi's by the Department of Health – Abu Dhabi (DOH); and healthcare activity that falls outside either emirate's specific remit, or that touches the other emirates, by the Ministry of Health and Prevention (MOHAP) at the federal level. These are genuinely separate regulators with their own licensing systems, their own rules and their own inspection regimes — not regional offices of a single national health authority.

A healthcare business operating in more than one emirate needs to treat each regulator's requirements as a distinct compliance exercise, not assume that a DHA licence or approval automatically satisfies DOH, or vice versa. A lawyer advising on multi-emirate healthcare operations should map out each regulator's specific requirements separately.

The Emirates Drug Establishment was established by Federal Decree-Law No. 28 of 2023. Federal Decree-Law No. 38 of 2024, governing medical products, pharmacists and pharmaceutical establishments, then made it the federal regulator for those areas in place of Federal Law No. 8 of 2019, and a substantial set of functions that had previously sat with MOHAP moved across. Content or advice that still describes these functions as sitting entirely with MOHAP may no longer reflect where the relevant regulatory authority actually sits.

Businesses in pharmaceuticals, medical devices or related supply chains should confirm current jurisdiction directly rather than assuming a pre-2024 regulatory map still applies — a lawyer active in this space should be able to tell you, function by function, whether MOHAP or the Emirates Drug Establishment is now the relevant authority.

Opening or operating a medical facility — a clinic, hospital, pharmacy, diagnostic centre or similar — requires licensing from the relevant emirate-level regulator (DHA or DOH) or, where applicable, MOHAP, with requirements covering facility standards, staffing, equipment and ongoing compliance. Licensing requirements differ meaningfully between DHA and DOH, even for a similar type of facility.

A facility operating across Dubai and Abu Dhabi needs separate licences from each regulator, each with its own application, inspection and renewal cycle. This is one of the most common points of confusion for healthcare groups expanding beyond their home emirate.

Individual healthcare professionals — doctors, dentists, nurses, allied health practitioners — need to be licensed with the relevant regulator to practise, and licensing typically involves credential verification, examinations or assessments, and ongoing continuing-education or renewal requirements. A practitioner moving between emirates generally needs to obtain licensing with the new emirate's regulator, not simply transfer an existing one automatically.

Practitioner licensing issues — a delayed licence, a licensing condition, a dispute over credential recognition — are regulatory matters distinct from a malpractice claim against the same practitioner, and are handled through the regulator's own administrative processes rather than the medical liability committee route.

When a patient alleges harm from medical treatment, the UAE's dispute route generally runs through a dedicated medical liability committee process before the matter can proceed to court — a specialised step this category doesn't itself cover, since it sits under LEXNOVA's separate medical malpractice category.

Healthcare regulatory work is different: it's about the facility's or practitioner's licensing status, compliance obligations and standing with the regulator, which can run in parallel with, but is legally distinct from, a liability committee process arising from a specific patient's claim.

Dubai and Abu Dhabi each run their own mandatory health-insurance framework, and the schemes are not identical — Abu Dhabi's approach, including its Thiqa and Daman-linked arrangements for different population groups, differs in structure from Dubai's DHA-mandated scheme. Employers and insurers operating across both emirates need to treat compliance as two separate exercises.

A federal Basic health-insurance framework also exists alongside the emirate-level schemes for certain categories, adding a further layer that a lawyer advising a multi-emirate employer or insurer should map out precisely rather than assuming one emirate's rule applies UAE-wide.

Federal Law No. 2 of 2019 concerning the use of information and communication technology in health fields sets a health-data localisation obligation. Article 13 provides that health data and information relating to health services provided inside the State may not be stored, processed, generated or transferred outside the State except by a resolution of the Health Authority in coordination with the Ministry. Article 2 applies the Law to all methods and uses of information and communication technology in the areas of health in the State, ‘including the free zones’. This is a federal requirement, not an emirate-level one.

Where it gets genuinely uncertain is the financial free zones. A mistake advisers frequently make is assuming that DIFC's or ADGM's own data protection regimes fully displace federal health-data rules for a provider or health-tech business operating through either centre. The opposite assumption is not safe either: Federal Law No. 8 of 2004 exempts the financial free zones from federal civil and commercial laws, ADGM describes its own position in those terms, and no primary source found resolves whether Article 2's reference to free zones is meant to cut through that. A business in DIFC or ADGM handling patient data should have the point assessed specifically rather than rely on either assumption.

Telehealth and digital health platforms sit at the intersection of healthcare licensing — is the platform, and the practitioners on it, properly licensed to deliver care remotely — and health-data rules, covering where patient data is stored and how it's protected. Each regulator has its own position on telehealth licensing, and a platform operating across emirates needs to satisfy each one separately.

A digital health business should also confirm whether its activities trigger any additional technology, data-protection or consumer-protection obligations on top of the healthcare-specific licensing requirements — this is a genuinely cross-disciplinary compliance exercise.

Pharmaceutical registration, import and distribution, and controlled-substance handling sit under a licensing and compliance regime that, since Federal Decree-Law No. 38 of 2024, is largely administered by the Emirates Drug Establishment, with MOHAP retaining certain functions including community and compounding pharmacies. Getting product registration and controlled-substance handling right is a compliance-heavy area with real regulatory-enforcement consequences for getting it wrong.

A pharmaceutical or pharmacy business should have a lawyer confirm current jurisdiction and requirements directly against the relevant regulator, rather than relying on an older description of MOHAP's scope that may no longer be accurate.

Medical devices are subject to their own registration and compliance regime, distinct from pharmaceutical regulation, covering everything from classification to import approval to post-market obligations. As with pharmaceuticals, which authority handles which function has shifted with the Emirates Drug Establishment's creation, so current jurisdiction should be checked rather than assumed.

A medical-device business entering the UAE market should have a lawyer map out the specific registration pathway for its device category before committing to a launch timeline.

Buying, selling or investing in a licensed healthcare facility involves regulatory considerations that a standard corporate M&A process doesn't — licence transferability, change-of-ownership approval requirements, and confirming that the facility's licensing status and compliance history are actually what the seller represents them to be.

A healthcare transaction that overlooks the regulatory-approval step can close on paper but leave the buyer unable to actually operate the facility until the relevant regulator approves the change of ownership — this needs to be built into the transaction timeline from the start, not treated as a formality.

Healthcare providers and practitioners are subject to specific rules around how they can advertise services, make claims about treatments or outcomes, and market to patients — generally more restrictive than standard commercial advertising rules, reflecting the sensitivity of health claims. Each regulator has its own position on what's permitted.

A healthcare business planning a marketing campaign, particularly one involving before-and-after claims, outcome guarantees, or influencer-driven promotion, should have its content reviewed against the relevant regulator's advertising rules before publication, not after a complaint.

DHA, DOH and MOHAP each carry out facility inspections and can impose licence conditions, suspensions or other regulatory measures where a facility or practitioner falls short of requirements — a process distinct from, though sometimes triggered by, an underlying patient complaint. Responding to an inspection finding or a proposed licensing action is a regulatory matter that benefits from a lawyer's involvement from the first notice, not after a decision is made.

A poorly handled regulatory response can affect a facility's or practitioner's licensing status well beyond the specific finding at issue, so early, considered engagement with the regulator through legal representation tends to produce a better outcome than an informal, unrepresented response.

Clinical trials and medical research involving UAE patients or facilities are subject to their own regulatory approval process, layered on top of standard facility and practitioner licensing. This is specialist regulatory territory that a general corporate or commercial lawyer may not be equipped to handle without specific healthcare-regulatory experience.

A pharmaceutical company, research institution or CRO planning a UAE clinical trial should engage a lawyer with direct experience of the relevant regulator's clinical-trials approval process well before the intended start date.

Employing licensed healthcare practitioners carries considerations beyond standard UAE employment law — contract terms often need to align with the practitioner's licensing obligations, non-compete and patient-confidentiality provisions carry particular weight in a healthcare context, and a practitioner's departure can raise both employment and regulatory questions, such as licence transfer or deactivation, simultaneously.

A healthcare employer's HR and legal processes should be built with these overlapping considerations in mind, rather than using a generic employment template not designed for a licensed clinical workforce.

Health-tech, telehealth and wellness businesses sometimes structure through DIFC or ADGM for corporate or investment reasons, but doing so doesn't remove the underlying healthcare-licensing requirement to actually deliver clinical services in the UAE — that licensing still runs through DHA, DOH or MOHAP depending on where the care is actually delivered. A lawyer should map out clearly which parts of the business the free-zone structure covers and which still require emirate-level healthcare licensing.

This is a genuinely common structuring mistake — treating a DIFC or ADGM corporate registration as if it also covers clinical licensing, when the two are entirely separate regulatory questions answered by different authorities.