UAE Health Data Law 2023: What Clinics Must Do with AI-Generated Patient Notes

Category: Regulatory / Legal | Market: UAE | Keywords: UAE Health Data Law 2023 clinics AI generated patient notes compliance requirements

Federal Decree Law No. 4 of 2023 on the Regulation of Health Data in the UAE — the UAE Health Data Law — establishes the most comprehensive health data regulatory framework in UAE history, creating enforceable obligations for all UAE healthcare entities regarding the collection, processing, storage, protection, and sharing of health data. For UAE clinics and hospitals deploying AI medical scribing technology, the Health Data Law creates specific compliance obligations that must be understood and addressed: AI-generated patient notes are health data within the scope of the law, and the processing of consultation audio recordings and clinical content by AI scribing platforms involves health data processing activities that the law regulates.

The UAE Health Data Law compliance obligations for AI scribing deployments are not merely technical compliance requirements — they reflect genuine patient rights around privacy, consent, and control of their health information that UAE clinics must respect as a matter of both legal compliance and patient trust. Clinics that deploy AI scribing without addressing these compliance obligations risk regulatory sanction, patient complaints, and erosion of the trust that underlies the therapeutic relationship.

## Consent Requirements for AI Scribing Under the Health Data Law

The UAE Health Data Law requires that patients provide informed consent for the processing of their health data. In the context of AI scribing, this requires that patients be informed that their consultation will be recorded and processed by an AI system to generate clinical notes, the purpose of this processing, how their data will be stored and protected, and their right to object to AI scribing and receive an alternative documentation approach. Clinic consent frameworks — both verbal and written — must be updated to include AI scribing disclosure, and patients who object to AI scribing must be accommodated without adverse impact on their care. AI scribing platforms that provide patient-facing consent disclosure materials in Arabic and English facilitate this compliance requirement.

## Data Localisation Requirements

The UAE Health Data Law includes data localisation provisions requiring that certain categories of health data be stored within UAE territory or subject to specific cross-border transfer controls. AI scribing platforms that process UAE patient consultation audio and clinical documentation must demonstrate compliance with UAE data localisation requirements — either by processing and storing data on UAE-based infrastructure or by meeting the law's cross-border transfer approval requirements. Clinics evaluating AI scribing platforms must assess the platform's data residency and cross-border transfer practices as a specific compliance due diligence requirement. Platforms that rely on cloud processing outside the UAE may require specific cross-border transfer authorisation under the Health Data Law.

## Data Security Obligations

The UAE Health Data Law imposes specific data security obligations on health data processors, requiring implementation of technical and organisational measures appropriate to the sensitivity of health data. AI scribing platforms processing UAE patient data must implement: encryption for data in transit and at rest, access controls limiting data access to authorised personnel, audit logging of data access events, and incident response procedures for data breaches with UAE Health Authority notification requirements. Clinics deploying AI scribing are responsible for ensuring that their chosen platform meets these security obligations — vendor due diligence should include review of the platform's security certifications (ISO 27001, SOC 2 Type II) and UAE-specific compliance documentation.

## Patient Rights Under the Health Data Law

The UAE Health Data Law grants patients specific rights regarding their health data: the right to access their health data, the right to correct inaccurate data, the right to withdraw consent for certain processing activities, and the right to receive information about how their data is used. Clinics using AI scribing must have processes in place to respond to patient exercise of these rights — including providing access to AI-generated notes (which are part of the patient's health record), correcting inaccuracies in AI-generated notes identified by patients, and processing data processing objections or consent withdrawals. These patient rights obligations are not specific to AI scribing but apply to health data across the clinic's systems.

## Conclusion

UAE clinics deploying AI medical scribing must ensure compliance with the UAE Health Data Law 2023 across four key dimensions: patient consent for AI scribing, data localisation and cross-border transfer compliance, data security obligations, and patient rights response processes. Clinics that address these compliance requirements systematically — with updated consent frameworks, vendor due diligence on data residency, security certification review, and patient rights procedures — will deploy AI scribing in a manner that is both legally compliant and worthy of patient trust. The UAE Health Data Law creates obligations but also a framework that, when properly followed, builds the trust infrastructure on which sustainable AI scribing adoption rests.

Internal links: UAE Federal Medical Liability Law AI Documentation, DHA NABIDH Compliance AI Medical Scribes Dubai, Insurance Fraud Prevention UAE Healthcare AI Note Accuracy, Explainable AI Clinical Documentation UAE Hospitals