Patient Health Information may only be transferred to a third party located in a jurisdiction outside DHCC if:

1. an adequate level of protection for that Patient Health Information is ensured by the laws and regulations that are applicable to the third party; and
2. the transfer is either:
   • authorized by the Patient; or
   • necessary for the ongoing provision of Healthcare Services to the Patient.

A jurisdiction shall be considered to have an adequate level of protection if that jurisdiction is listed as an acceptable jurisdiction under the Dubai International Financial Center Data Protection Law No. 1 of 2007 or has the written approval of the Central Governance Board.

As noted above, DHA’s regulations regarding Policy for Health Data Protection and Confidentiality 2022 may now override the transfer provisions of the HDPR.