The UAE has repeatedly made digital technology adoption a national priority before its usefulness was universally accepted. In October 2017, it launched its national artificial intelligence strategy and created a ministerial portfolio for AI. That decision placed an emerging technology within government responsibility well before the recent wave of consumer AI applications. It signalled that adoption would involve institutions, skills and public services as well as investment in technology. [1]

Dubai's paperless government programme offers an especially relevant precedent. In December 2021, Dubai announced that it had achieved the objectives of the strategy. The significance for healthcare lies in the operating idea behind it: institutions can redesign how work is completed so people have fewer documents to carry and fewer repeated procedures to perform. Moving a form onto a screen is useful; removing the need to submit information that a trusted authority already holds can be more valuable. [2]

Healthcare presents a strong opportunity for the next leap. The UAE's investments in identity, medical records, licensing and payments provide a foundation for connecting the decisions and transactions that surround treatment. The potential benefits are tangible: less time coordinating organisations, clearer information about costs, and greater confidence that the right professional has the information needed to help.

Consider the work around a single specialist consultation. Someone has to find a suitable doctor, check insurance coverage, obtain a referral, transfer test results, arrange approval and understand the bill. Afterwards, someone must arrange the next test or make sure a follow-up happens. Even where each organisation offers a digital service, the patient or a family member can still become the person connecting them.

For someone managing a long-term condition, these tasks recur. For an older person, a parent caring for a child, or a worker who cannot easily take time away from a job, they can influence whether care is completed. The quality of a healthcare system is experienced through these ordinary moments as much as through the sophistication of its hospitals.

The UAE has a strong opportunity to make more of this journey work as one connected service. This is the practical promise of programmable healthcare: approved software coordinating defined steps under clear rules, with appropriate human responsibility. The term describes a direction for development, rather than an official UAE programme.

A strong starting point in existing infrastructure

The opportunity rests on foundations already in use. UAE PASS provides a common digital identity and digital signatures. Aani, introduced by Al Etihad Payments in October 2023, supports instant payments around the clock. These services illustrate the value of shared infrastructure that many organisations can use. Connecting them to a particular healthcare journey would still require the appropriate permissions and implementation. [3][4]

Within healthcare, Riayati, the National Unified Medical Record programme, connects with Abu Dhabi's Malaffi and Dubai's NABIDH. The Department of Health describes Malaffi as connecting more than 2,700 facilities and confirms its integration with the other two systems. This creates a basis for information to follow a patient across participating providers. [5]

Dubai Health Authority reported that, by the end of June 2025, NABIDH connected 1,888 licensed facilities and 91 electronic medical record systems, with more than 10.41 million medical records. These dated measures demonstrate infrastructure scale; they do not measure how many people completed a connected care journey. [6]

Trust and financial administration also have digital foundations. The Ministry of Health and Prevention announced a unified national platform for health licences in February 2025. Abu Dhabi's Shafafiya publishes reference information and transaction structures for activities including claims, prior authorisation and electronic prescriptions. Dubai's eClaimLink and Riayati's e-Claims Post Office support payer and provider transactions in their respective markets. [7][8][9][10]

Patient access is advancing too. In October 2025, Abu Dhabi announced Sahatna's integration into TAMM, bringing appointments, prescriptions, medical records and other services into a familiar government platform. It reported more than one million Sahatna users in its first year, a measure of reach rather than proof of regular use of every service. [11]

Together, these investments make programmability a credible opportunity. Much of the underlying information and transaction infrastructure exists. The next source of value lies in making its capabilities work together around a person's needs, with clear agreements on access and responsibility across organisations.

The opportunity seen through one patient journey

Imagine a resident managing diabetes who needs a routine review. In a proposed connected service, the person verifies their identity through a trusted channel. If a family member is helping, the service checks their authority to act on the patient's behalf. It identifies suitable participating clinicians, checks insurance information and presents available appointments.

Before the patient commits, the service explains what is covered, what requires an insurer's decision and the likely patient contribution. Estimates are clearly identified. Relevant medical information accompanies the appointment under the appropriate authority, allowing the clinician to assess whether new tests are necessary. Any required referral or approval is submitted through the authorised channel and its status becomes visible.

After the consultation, the prescription reaches a participating pharmacy. An authorised patient payment goes through a licensed payment provider. Results return to the responsible care team, while reminders or follow-up requests support completion of the agreed care plan. These steps illustrate the opportunity; they are not a claim that this complete journey is available today.

The value is continuity. The patient spends less effort discovering where a request has stalled or which organisation needs another document. Each provider retains its clinical and operational responsibilities, while the service makes the handoffs more dependable.

The same journey should be accessible with help from a receptionist, call centre or authorised carer. A person who cannot use a smartphone, or encounters a digital identity outage, still needs a practical route to care. A connected service earns its value by reducing the patient's burden across these situations.

Connecting identity with payments and authoritative registries

Digital rails are shared ways to establish facts, exchange information and complete transactions. Their practical value increases when a service can use them together for a defined purpose. Identity establishes who is involved. A professional licence establishes authority to practise. Insurance information establishes the relevant cover. A payment service moves money when properly authorised.

These answers are related, but each has a separate role. Verifying a patient's identity does not grant access to every medical record. A clinician's licence does not establish that their services are covered by a particular policy. A family relationship does not automatically establish authority to make every decision for another adult. Programmability depends on respecting these distinctions.

Registries supply authoritative information about specific subjects. Professional and facility registries identify licensed participants. Provider network information identifies which facilities participate in an insurance arrangement. Medicine catalogues help systems identify the same product, while diagnostic and service codes give providers and insurers a consistent way to describe care. Shafafiya already publishes several relevant categories, including licences, drugs and benefit packages. [8]

Other connections could support particular needs. A verified directory could help software send a referral to the correct organisation. An authorised delegation record could establish what a carer may do. A benefit registry could confirm eligibility for a screening programme. Each requires a responsible source, appropriate access rules and a way to keep information current. An outdated network list or expired licence can undermine an otherwise efficient service.

Digitally signed credentials offer one possible way to communicate selected facts so recipients can verify who issued them. Their value depends on reliable issuers and a way to check validity or withdrawal. The aim is to make a trustworthy answer reusable without requiring every organisation to collect the same documents again.

Payments add a further connection. Insurance approval records what a payer has agreed to cover under specified conditions. A claim requests payment for care delivered. Settlement moves the money. Linking their status could give the patient and provider greater clarity about costs and outstanding amounts. Existing payment infrastructure creates a foundation for this opportunity, although faster payment alone does not resolve insurance eligibility, claim disputes or missing approvals.

The result would be a service able to coordinate information and action across different domains. Its usefulness comes from receiving dependable answers in the right sequence, while preserving the authority of the organisation responsible for each answer.

Open finance connects insurance to the wider opportunity

Open finance adds a relevant dimension to this discussion. It creates regulated ways for customers to allow authorised providers to access specified financial information and initiate defined services. In insurance, that could make permitted policy information easier to use across services. The value comes from giving a customer more control over information held by an institution, with clear limits on who may use it and why.

The UAE already has a regulatory foundation for this direction. The Central Bank's Open Finance Regulation, issued in July 2025, includes insurance companies within its scope and establishes a framework for data sharing and service initiation through shared infrastructure. Inclusion in the framework should be distinguished from the availability of any particular insurance product or connection; implementation depends on the relevant scope, standards and participating institutions. [17]

The boundary with healthcare is essential. The current rules prohibit processing sensitive data for open finance data sharing even with explicit user consent. Sensitive data includes information revealing a person's health status. An open finance licence also does not, by itself, authorise insurance brokerage or underwriting; relevant additional permissions are needed. Access to financial information therefore cannot be treated as permission to retrieve medical records. [18]

This leaves a valuable opportunity for carefully designed connections. A proposed patient service might use permitted, non-sensitive insurance information to explain the policy, then obtain treatment eligibility or approval from the insurer through the appropriate healthcare channel. The clinical team would receive relevant medical information through authorised health exchanges. A payment provider would handle an authorised payment through its own regulated service. Each part would answer the question it is entitled to answer.

These connections address different stages of the same experience. Health information exchange helps the professional understand the patient. A health claims exchange carries eligibility, approval and claim messages between providers and payers. Open finance supports permitted financial data and services. Payment infrastructure transfers money. Combining their approved outputs could help a patient understand the next step and expected cost without creating unrestricted access across all four domains.

There is also an opportunity for insurance services to become useful throughout the life of a policy. People need help understanding whether a provider is in their network, what remains subject to approval and why a bill differs from an estimate. Some answers require policy information; others require a current decision from the insurer or provider. A connected service should make that distinction visible. Its promise is clearer information and fewer repeated requests, while the responsible institutions retain their decisions and obligations.

What makes a service programmable

Programmability allows approved software to perform defined steps when agreed conditions are met. A valid referral might permit an appointment request. A recorded insurer approval might allow the service to confirm coverage within stated limits. A discharge notification might initiate a follow-up request to the responsible team.

The opportunity is to turn routine coordination into a dependable service. A patient would have less need to chase each step, and staff would spend less time transferring information between systems. This requires institutions to agree on the meaning of each transaction, who may initiate it and who is responsible for the response.

Permissions should remain specific. Software allowed to search appointments should not automatically be allowed to book a paid procedure. Access to a prescription should not confer authority to change it. Payment initiation requires its own authorisation. The application itself needs a verifiable identity, an accountable operator and a defined scope that can be suspended or withdrawn.

The record of an action should show which organisation acted and under what authority. Exceptions also need an owner. An unavailable insurance system should produce a pending status with a route to assistance. A retried request should not create duplicate bookings or charges. If a payment succeeds but the booking fails, the service needs a clear correction or refund process.

Programmability also creates opportunities for more targeted benefits. An insurer, employer or public programme might fund a defined preventive service at approved providers. The service could check eligibility, confirm completion and arrange payment while limiting what the sponsor learns about the patient's health. Such a model would require explicit participation and exception rules; it is an illustration, not a description of an existing national scheme.

These functions can often use conventional software and existing payment systems. Their success depends on precise authority, reliable transactions and practical recourse when something goes wrong. Technology makes the rules executable, while institutions remain responsible for the rules and their consequences.

Privacy is part of the value proposition

Privacy determines whether useful connections are also acceptable to the people receiving care. A patient may want a specialist to see their medical history while limiting what reaches an employer, a payment provider or an unrelated application. A connected system needs to support those differences directly.

A booking service generally needs enough information to arrange the appointment. A payment provider needs the details required to process the transaction and meet its obligations. An insurer may need defined clinical evidence to assess a claim. An employer funding a benefit might need confirmation of use, while detailed results remain with the patient and authorised care team. Each participant should receive information appropriate to its legitimate task.

This creates a practical opportunity to reduce unnecessary disclosure. A verified eligibility confirmation may answer an administrative question without revealing the medical history behind it. Where a clinician needs detailed records for safe care, the service should enable that access under the appropriate authority. Privacy depends on matching information to purpose.

Where consent is the basis for access, people should understand what is shared, with whom and for how long. Permission to help with one appointment should not become permanent access to every record. Withdrawing optional access should stop future use, with a clear explanation of records that must still be retained under applicable obligations.

Consent is only one part of healthcare governance. Treatment, emergencies and public health involve other responsibilities, and the lawful basis for access must be established. Exceptional access needs controls and an audit trail. Patients also need a way to question access, correct errors and contact a responsible person.

Protection must extend to notifications, support screens, logs and AI evaluation data. A secure medical database is insufficient if sensitive details appear elsewhere without need. The opportunity is a system in which organisations can cooperate on care without gaining an unrestricted view of the individual. That is a stronger basis for adoption and trust.

Sovereignty preserves the ability to govern and sustain care

Sovereignty in healthcare concerns the country's ability to govern sensitive information and maintain essential services. It includes where data is stored and processed, who can access it, which rules apply and whether care can continue if a supplier fails or changes its terms.

The UAE has a specific legal framework for information and communications technology in health. Federal Law No. 2 of 2019 addresses health information, including restrictions on processing and storage outside the country, with exceptions governed by the competent authorities. Any connected service must reflect applicable federal and emirate requirements. Use of overseas cloud or AI services therefore involves governance decisions as well as technology choices. [12]

Sovereignty also depends on operating arrangements. Healthcare organisations and public authorities need the ability to audit suppliers, retrieve usable records, replace components and maintain services during disruption. Locally hosted data can still create dependence if only one supplier can operate the system or make information usable elsewhere.

The UAE's combination of federal and emirate-level systems offers a basis for retaining distributed responsibilities while enabling agreed exchanges. Some functions may require shared repositories. Others may work through a limited answer obtained from an authoritative source. Clinical need, legal requirements and resilience should guide the choice.

Clear standards and local operational capability make international technology participation easier to govern. They also create a regional opportunity: authorised patient summaries or verified provider credentials could support specific cross-border services where legal arrangements permit. The exportable capability would be a method for connecting services while preserving each jurisdiction's authority over its health system.

A defined role for artificial intelligence

AI increases the usefulness of connected infrastructure when it helps people navigate care or helps professionals interpret relevant information. An assistant might explain administrative instructions, prepare questions or identify an incomplete step in a care plan. Its authority must remain distinct from its ability to generate a suggestion.

Identifying a possible need for follow-up does not confer permission to order a test, change a prescription or commit a patient to a cost. The service should distinguish the AI's proposal from the decision of the authorised clinician, patient or organisation. Material claims, such as insurance approval, need to be checked against the responsible source.

Abu Dhabi already has relevant governance foundations. Its Responsible AI Standard, published in October 2025, addresses systems used in clinical, financial and administrative functions, including AI agents. It covers human oversight, validation and continuity during failures. Its Digital Products Governance Standard, effective from August 2026, governs digital products within the emirate's healthcare sector. These are Abu Dhabi standards, rather than a single permission regime across the UAE. [13][14]

The opportunity is to give AI a useful, bounded role within a trusted service. Oversight should reflect the possible consequences of each task. Summarising a sensitive record can carry substantial risk, while some routine administrative actions are reversible. Expansion should follow evidence from real use, with clear routes to human help and responsibility for errors.

Countries are developing different parts of the connected model

International experience helps distinguish open insurance from healthcare exchange. Countries are developing different parts of the opportunity, under different rules. Their programmes offer practical lessons, rather than proof that one complete model is ready to copy.

Brazil provides an established example of open insurance. Its supervisory authority, SUSEP, describes a framework through which customers can permit participating organisations to share insurance information and initiate specified services. Standardisation supports potential uses such as policy comparison, information aggregation and claims notification. SUSEP also identifies interoperability with open banking as an objective. This is an example of opening regulated insurance services; it should not be read as evidence of unrestricted medical-record exchange. [19]

India's National Health Claims Exchange addresses a different problem. Developed under the Ayushman Bharat Digital Mission, it provides a gateway for standardised health claim information between insurers, administrators and healthcare providers. In July 2024, the government reported that 34 insurers and third-party administrators were live, with hospitals preparing to submit claims. That dated milestone shows implementation beyond a concept, without establishing universal adoption today. Its relevance is reducing the need for every hospital to work through a different claims process for every insurer. [20]

Saudi Arabia's NPHIES offers a regional reference for connecting healthcare and insurance transactions. Its official implementation guide covers eligibility checks, prior authorisation, claims and payment-related messages. The exchange validates and routes information; the payer retains responsibility for deciding a claim. That separation matters: a common transaction system can improve coordination while preserving the roles of insurers and healthcare professionals. It is a health-sector exchange, rather than a general open finance permission to access health data. [21]

Estonia demonstrates how digital foundations can complete a familiar clinical task. Its electronic prescription service connects the doctor's prescription, patient identity, pharmacy access and applicable state subsidies. The official e-Estonia description reports that all prescriptions are digital. Patients present identification, the pharmacy retrieves the prescription and eligible subsidies are reflected in the price. [15]

Finland's MyKanta shows repeated use of a national patient service, recording 3.25 million users and 41.1 million logins in 2025. It supports access to health information and prescription renewal requests. Those figures demonstrate use, while clinical improvement and savings require separate evidence. [16]

For the UAE, the lesson is that each connection needs a clear purpose. Brazil illustrates customer-directed insurance information sharing. India and Saudi Arabia illustrate structured exchanges between healthcare providers and payers. Estonia and Finland show the everyday value of connected health information. The UAE's existing foundations create a strong opportunity to bring these kinds of capabilities into a more coherent patient experience under its own regulatory arrangements.

Shared foundations create room for innovation

Programmable healthcare creates opportunities for public institutions and private businesses with different responsibilities. Authorities can establish trusted sources, participation rules and common standards. Providers, insurers and technology companies can develop services around those foundations.

Malaffi illustrates one operating arrangement: it is a Department of Health initiative operated by Abu Dhabi Health Data Services, an M42 company, through a public-private partnership. Public purpose, regulatory authority and operational ownership need not sit with the same institution. Different arrangements may suit different functions. [5]

Common interfaces could allow businesses to specialise in discharge follow-up, home care or appointment coordination without rebuilding identity and licensing infrastructure. Hospitals could select tools suited to their operations while retaining the ability to exchange information. Participation would remain subject to certification, lawful access and agreed responsibilities.

The commercial incentives matter. The organisation paying for integration may not capture all the benefits. Contracts that reward continuity and completed care could help align investment with patient value. Provider recommendations should make the distinction between clinical suitability, insurance eligibility and commercial placement understandable. A competitive market is more useful to patients when they can change services without losing access to their information or becoming tied to one provider.

Making the opportunity tangible

A strong starting point would be a care pathway that crosses several organisations and creates a recognisable burden for patients. A primary-care referral to a specialist, including required insurer approval and results returning to the referring clinician, offers one example. Discharge with medication and follow-up offers another.

Participating organisations would need to agree which steps the service coordinates, which information it checks and who resolves a stalled request. Existing exchanges and transaction systems provide a foundation. Missing capabilities should address a specific need within the journey, with clear permissions and failure procedures.

The most useful measures would capture the patient's experience: time from referral to completed appointment, effort spent chasing approval, whether results reach the responsible team, and whether expected charges match the final bill. For staff, the test is whether repeated entry and follow-up work fall. Access controls and the handling of exceptions should be assessed alongside service performance.

Clinical outcomes and savings require careful evaluation over time. Faster processing is valuable only if decisions remain accurate, while fewer repeated tests are beneficial only when clinically appropriate. Adoption also needs to work for people with different languages, insurance arrangements and levels of digital confidence.

The UAE's technology investments have created a strong opportunity for this next stage. Identity, records, registries, insurance and payment services already provide important parts of the foundation. Programmability offers a way to bring more of them into a coherent patient journey, with privacy defining appropriate access and sovereignty preserving the ability to govern the system.

Its value would be visible in everyday care: a parent arranging a child's follow-up with less repeated explanation, a worker understanding the cost of a consultation, or an older resident whose care team receives the right information. Turning that opportunity into dependable services would give the UAE a meaningful next advance in digital healthcare.