Med spa laws by state: What Florida requires for ownership and compliance
Ask five different states who’s allowed to own a med spa, and you’ll...
Last Updated: August 21, 2026
Key takeaways
Riayati is MOHAP’s national health information exchange, not a Dubai or Abu Dhabi platform.
Your licensing authority decides your exchange: DHA means NABIDH, DoH means Malaffi, MOHAP means Riayati.
Riayati covers the facilities MOHAP licenses, mainly across the Northern Emirates and federal sites.
No facility connects by itself, so the link runs through an EMR vendor MOHAP already lists.
Riayati, NABIDH, and Malaffi have been integrated since January 2023, so records move between all three.
Riayati is the UAE’s national health information exchange, run by the Ministry of Health and Prevention (MOHAP). It links patient records across the facilities MOHAP licenses, which sit mostly outside Dubai and Abu Dhabi. So if your practice is in Sharjah, Ajman, or Fujairah, Riayati is the exchange your license depends on.
The UAE runs three of these exchanges, and each one belongs to a different regulator. Mix them up and a license renewal can stall. Pabau, our practice management software, connects to NABIDH, the DHA’s health information exchange, so the Dubai side is familiar ground.
The rule that decides which exchange applies turns out to be simple, and it starts with who signed your license.
What Riayati actually does for a UAE practice
Riayati delivers the National Unified Medical Record, or NUMR, the UAE’s push toward one digital medical file per patient. Ministerial Resolution No. 156 of 2021 sets the legal basis for the platform, and defines what a Riayati health file has to contain.
In practice, Riayati links more than 3,000 public and private facilities, according to MOHAP. That count covers hospitals, clinics, day care centers, and diagnostic centers. A single-room dermatology practice therefore sits on the same exchange as a government hospital.
When a patient moves between connected facilities, their history travels with them. The patient stops carrying printouts, and your front desk stops chasing a previous provider for notes.
Patients and providers both reach the platform at riayati.mohap.gov.ae. For account or access problems, MOHAP lists [email protected] and 800-6867 as the contact points.
MOHAP licenses the facilities that have to connect
Any facility MOHAP licenses has to connect to Riayati, and that is the whole test. MOHAP, the Ministry of Health and Prevention, owns and runs the platform.
It licenses public and private facilities across the Northern Emirates: Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah, and Fujairah. A set of federal facilities sits under the same license.
Dubai and Abu Dhabi work differently. The Dubai Health Authority (DHA) and the Department of Health Abu Dhabi (DoH) license the facilities in their own emirates. Each of them runs its own exchange. That is where most of the confusion starts.
Your license decides whether you use Riayati, NABIDH, or Malaffi
A facility reports to exactly one of the three exchanges, and the licensing authority makes that call. Dubai practices use NABIDH, Abu Dhabi practices use Malaffi, and every facility MOHAP licenses uses Riayati.
Three regulators, three exchanges, one national record underneath.
Since January 2023, when UAE health authorities confirmed the three platforms were integrated, that split stopped mattering for patient care.
A patient treated in Sharjah under Riayati now appears inside Malaffi as a Riayati record, which Abu Dhabi providers can open directly. The regulatory split still matters for compliance, even though the data crosses it.
Running more than one site changes the picture. A group with a branch in Dubai and a branch in Sharjah reports to two different exchanges, not one. Each branch answers to its own local license.
How a practice connects, and who does the work
Once you know which exchange applies, the next question is who builds the link.
A MOHAP-licensed facility cannot wire itself into Riayati. The connection runs through an EMR or practice management system that already meets the platform’s integration criteria.
That system has to speak HL7 or FHIR messaging, and match patients on a national identifier such as an Emirates ID. It also has to pass a security assessment and sign a data-privacy agreement before it goes live.
Before assuming a rebuild is needed, check MOHAP’s Connected EMRs list. It names the systems already wired into Riayati. For many facilities the fastest route is picking a vendor from that list, rather than commissioning a custom integration.
Size does not change the route. A two-room wellness clinic and a 40-bed hospital both connect through a vendor, and both face the same security review. Side by side, the three exchanges set much the same conditions.
Run these checks before you start the integration
Most of the delay in one of these projects lands before a single message is sent. Work through the list below first, because each item is cheap to settle now and expensive to settle later:
- Confirm who licenses the facility. DHA licenses show up in Sheryan, and the license decides the exchange, not the address.
- Check the Connected EMRs list for your current vendor before you scope any build work.
- Ask that vendor whether the Riayati connection is live in production, not simply built.
- Collect Emirates ID details across your patient records, since matching fails without them.
- Name one person to own the security assessment and the data-privacy agreement.
- Check each branch separately if you run more than one site.
Two mistakes come up again and again. One is assuming a Dubai head office covers a Sharjah branch, which it does not. Leaving patient identity until last is the other, because records will not match once traffic starts flowing.
Riayati also runs the UAE’s e-claims exchange
Riayati’s job goes beyond clinical history. The same platform carries the money side of a visit, which is why finance teams end up caring about it as much as clinicians do.
What moves through the e-Claims Post Office?
Eligibility checks, prior authorizations, claim submissions, and e-prescriptions. Riayati’s e-Claims Post Office digitizes each of those between providers and insurers, so clinical history and billing traffic share one platform.
The order matters at the front desk. Check eligibility before the visit, get the authorization on file, then submit the claim against that authorization. Skip the first step and the rework lands back on reception.
How much traffic does it carry?
MOHAP has reported over 20,000 transactions a day, from more than 6,000 doctors, 40 paying agents, and 1,000 facilities. For a front desk, that is the difference between a same-day eligibility check and a phone call to the insurer.
How Pabau handles the NABIDH connection in Dubai
All of that lands on whichever exchange your license points at. For DHA-licensed practices in Dubai that means NABIDH, and Pabau covers it with a built-in connector. Without one, a practice pays for custom development, then maintains the message formats itself every time the specification moves.
Pabau’s NABIDH connectivity generates the HL7 v2.5.1 messages Dubai’s exchange expects for patient demographics, visits, and clinical data. Those messages come out of the same records your team already keeps, so there is no export step and no second system to reconcile.
The outcome is one less project on the roadmap. Reporting happens as clinicians work, rather than as a monthly scramble before a compliance deadline.
That covers Dubai only. Pabau does not connect to Riayati or Malaffi today. A Northern Emirates or Abu Dhabi facility running on Pabau still needs its own route into whichever exchange its license requires.
Keep NABIDH reporting off your to-do list
Pabau generates the HL7 v2.5.1 messages NABIDH expects straight from the records your team already keeps. That means no separate export step, and no custom integration project to maintain.
Conclusion
Riayati, NABIDH, and Malaffi do the same underlying job for three different regulators. Start with the license, and the right exchange follows without a debate.
That makes the first job an administrative one rather than a technical one. Confirm the licensing authority, check whether your current vendor already holds the connection, then talk about build work. Running those three checks in that order keeps the scope honest.
For DHA-licensed practices in Dubai, Pabau already carries that connection, which takes one integration off the list. Book a demo to see how the NABIDH connector sits alongside records, scheduling, and billing in one system.
Continue your research
What is Malaffi? See Abu Dhabi’s exchange explained with the same licensing-authority rule.
Licensed by the DHA? Read the NABIDH rules that every Dubai facility has to meet.
Need to check a DHA license? See how Sheryan works before you scope any integration.
Choosing a system in Dubai? Compare Dubai EMR options on the connections they already hold.
Running a UAE med spa? UAE med spa software compared on compliance, not just features.
Frequently asked questions
Is connecting to Riayati mandatory for private practices?
Yes, for any private facility MOHAP licenses. MOHAP treats the connection as part of the licensing requirements, so it comes up at licensing and at renewal. Private facilities in Dubai and Abu Dhabi sit outside Riayati, because the DHA and the DoH license them instead.
Does Riayati replace a practice’s EMR?
No. Riayati sits above your records rather than replacing them, so your team keeps working in the same system. Your EMR still holds the chart, and it sends the agreed data across to Riayati in HL7 or FHIR messages.
What is the difference between Riayati and NUMR?
Riayati is the platform, and the National Unified Medical Record is what it produces. Connected facilities send data into Riayati, and the NUMR is the single patient file that comes out of it.
Can patients see their own Riayati record?
Yes. Patients and providers both use the portal at riayati.mohap.gov.ae, so a patient can view their own health file there. MOHAP lists [email protected] and 800-6867 for access problems.
Does a Dubai patient’s record reach Riayati?
Yes, since the three exchanges were integrated in January 2023. A patient treated in Dubai under NABIDH has that history available to MOHAP-licensed providers, and the flow works in reverse too.
