AI agents for UAE healthcare, kept to the admin side
An AI agent for healthcare in the UAE should never diagnose, never triage, and never open a patient record without an identity and an audit trail behind it. What is left is the administrative half of a clinic's day: booking and reminders, insurance eligibility and claims preparation, intake forms, referral letters, and chasing the people who did not reply. That half is large, it is deadline-driven, and it is where the software belongs.
What an agent is not allowed to do in a UAE clinic
This is the part of the page that decides everything else. Three prohibitions come straight out of law and regulator standards, and each rules out a category of product that vendors sell into this market. None of them are Telora Labs inventions; the sources are linked below.
It cannot make the clinical decision
Federal Decree-Law No. 4 of 2016 on Medical Liability applies to everyone who practises the profession in the UAE. Article 4 requires a physician to record the patient's health condition and medical and family history before diagnosing or treating the case. Article 5 states that a physician shall not prescribe any treatment before administering a clinical examination to the patient, while allowing the health authorities to develop a system for distance-health services under the implementing regulations.
Read that as a design constraint and it is unambiguous. The diagnosis, the treatment decision, and the clinical judgment about urgency belong to a named licensed practitioner who has examined the patient. Software that ranks a patient's symptoms and returns something a receptionist could act on is doing triage, whatever the marketing calls it. That is out of scope, as is the softer version where the agent writes a suggestion and a non-clinician is expected to know when to override it.
It cannot send the data out of the country
Federal Law No. 2 of 2019 on the use of information and communication technology in health fields prohibits storing, processing, generating or transferring health information and data related to health services provided inside the UAE to anywhere outside the UAE, other than in the cases permitted by the health authorities. The exemptions are set out in Ministerial Decision No. 51 of 2021 on the health data and information that may be stored or transferred outside the country, which the DHA lists among the legislation its licensees answer to.
The Dubai Health Authority states the operational version of this in its own policy: protected health information should not be transferred to a country or territory outside the UAE except within the exemption category, DHA approval must be granted under the Health Information Assets Classification Policy, and the approval request goes to the address DHA publishes for that purpose.
This is the constraint most generic AI tooling fails on before it reaches the second meeting. A hosted model endpoint in another region, an offshore support team with production access, a cloud transcription service, a backup bucket in Ireland: each is a transfer. The build has to keep identifiable health data inside the country by construction, which usually means standing up a self-hosted component where a managed service would have taken an afternoon. It is the reason healthcare work sits at the top of the price bands rather than the bottom.
It cannot touch a record anonymously
The DHA's Standards for Health Information Consent and Access Control require that each user of a health information system holds a unique user ID, that passwords and IDs are not shared with any other individual or entity, and that access is granted on a need-to-know and least-privilege basis. They further say roles should be defined by the code attached to the professional's licence in Sheryan, that all accesses should be logged and monitored, that sessions should time out, and that privileged accounts should be reviewed at least quarterly. The distinction between must and should is worth carrying into a scope, because only the first kind is a hard constraint.
The practical consequence is the one integrators get wrong most often. An agent cannot run on a clinician's login. It needs its own identity in the health information system, its own least-privilege role, and its own entries in the access log, so that a DHA inspector reading that log can tell which actions were taken by software and which by a person. If the system you run cannot issue a service identity, that is a scoping finding, and it goes in the proposal with the work it implies.
What is left, and why it is worth building
Strip out everything clinical and the remainder is still most of what a clinic's front and back office does all day. Five workflows are in scope for healthcare providers.
Appointment scheduling and reminders
Booking against real practitioner availability, rescheduling, and reminder sequences on WhatsApp and email in Arabic and English. No clinical prioritisation: the agent offers the slots the schedule already permits for that service, and a person decides if someone needs to be seen sooner.
Insurance eligibility and claims preparation
Checking a member's eligibility before the visit, assembling the claim from what the encounter already recorded, and getting it into the submission window rather than past it. The agent prepares and flags. A coder signs off on what is coded.
Patient intake
Turning the form the patient filled in, in either language, into structured fields in the record, with anything ambiguous left blank and queued for a person to read. Missing consent, missing Emirates ID, missing insurance card: named as gaps before the patient is in the chair.
Referral letter drafting
A draft assembled from data already in the record, in the receiving facility's expected format, presented to the referring practitioner to edit and sign. The practitioner sends it. Nothing carrying a clinical claim leaves the building without a named signature on it.
Follow-up chasing
The results nobody acknowledged, the post-discharge call nobody made, the recall list that lives in a spreadsheet. This is a dated workflow with an owner, which is the shape software handles best and rotas handle worst.
Every one of these is administrative by construction. None requires the agent to hold an opinion about a patient's condition, which is the test applied before anything in this sector is scoped.
Which regulator you answer to changes the build
The UAE does not have one health regulator, and the differences are not cosmetic. Where the facility is licensed decides which health information exchange it must connect to and which standards the integration is written against.
| Where the facility is licensed | Regulator | Health information exchange |
|---|---|---|
| Dubai | Dubai Health Authority | NABIDH |
| Abu Dhabi | Department of Health, Abu Dhabi | Malaffi |
| Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah, Fujairah | Ministry of Health and Prevention | Riayati, the national record |
Riayati is the National Unified Medical Record operated by the Ministry of Health and Prevention, and the three platforms are electronically linked, so a record created in one is reachable from the others. The link between them does not make the standards interchangeable, and the facility's own licence is what decides which set the integration is written against.
For a Dubai facility the governing document is the DHA's Standards for Interoperability and Data Exchange, which applies to all DHA licensed health facilities. It names HL7 version 2 as the recommended standard for accessing and submitting data, and states that health information systems should also support FHIR and Integrating the Healthcare Enterprise messaging standards.
The same DHA document set includes a Policy for Use of Artificial Intelligence in the Healthcare in the Emirate of Dubai, which the authority lists as required reading alongside these standards. Its current full text could not be retrieved from a public URL, so it is not summarised here. It is read from the facility's own compliance library during scoping and its requirements stated in the proposal, the same way the DHA's Health Information Audit Policy is handled.
One retention figure is worth knowing before you design anything that writes to a record: the DHA sets a minimum retention period of twenty five years after the last encounter with the patient for electronic medical records. Anything the agent writes is being written for a quarter of a century, which is a reason to be conservative about what it is allowed to write at all.
Claims preparation is the workflow with the hardest deadlines
In Dubai the claim cycle is not a matter of practice or of contract. It is standardised by the Dubai Health Insurance Corporation under the Health Insurance Law No. 11 of 2013, and the standard supersedes any longer timeline a provider and a payer had agreed between themselves.
| Step | Deadline | If it slips |
|---|---|---|
| Provider submits the eClaim | No later than the 15th of the month following the service month | Payer may charge 0.03% per calendar day of the net claimed amount |
| Provider resubmits a disputed or rejected claim | Within 21 calendar days of receiving payment or the remittance advice with the denial reason | Same 0.03% per calendar day |
| Resubmissions permitted per claim | Two, inclusive of reconciliation | No further attempt |
| Payer pays and posts remittance advice | 45 calendar days from submission, 30 from a resubmission, 7 days for emergency claims | Provider may charge 0.03% per calendar day |
Two of those lines are why this workflow is worth automating and why the automation has to be careful. A monthly cliff edge on the 15th is exactly the kind of deadline a rota misses and a scheduled job does not. A hard ceiling of two resubmissions is exactly the reason the agent must not guess: a claim submitted with a plausible but wrong code has spent one of the two attempts, and the agent that produced it cannot tell you why. So the build assembles the claim, checks it against the payer's published denial codes, and puts anything it could not resolve in front of a coder with the reason attached, rather than filling the field and moving on.
Outside Dubai and Abu Dhabi the volume side changed recently. Basic health insurance became mandatory for private sector employees and domestic workers in Sharjah, Ajman, Umm Al Quwain, Ras Al Khaimah and Fujairah on 1 January 2025, on a package quoted at AED 320 per year, with a 20% co-payment on hospital visits capped at AED 500 per visit and AED 1,000 a year, and a 25% co-payment on doctor visits capped at AED 100. For a clinic in those emirates, more insured patients means more claims administration, which is the thing this page is about.
Where an agent helps
Representative builds for clinics and providers, each written as what the agent would do in that situation.
"Reception spends the morning on the phone rebooking the people who did not turn up yesterday."
A multi-practitioner clinic would have the agent read the schedule, message each patient who missed an appointment on the channel they originally booked through, offer the slots that are genuinely open for that service and that practitioner, and write the new booking back. Nothing about the patient's condition enters the message. If a patient replies with a symptom, the agent stops, does not answer, and hands the conversation to a named person, because the moment it responds to a symptom it is doing triage.
Reception starts the morning with the rebooking list already worked and a short queue of conversations a clinician needs to read.
"Half the month's rejections come back for something that was fixable before submission."
A clinic submitting through eClaimLink would have the agent assemble each claim from what the encounter already recorded, check it against the published denial codes and the payer's own rules, and split the batch into two: claims that pass every check, and claims with a named problem attached. The first batch goes to the coder for sign-off. The second goes to the coder with the reason written out. The agent proposes no code that a human has not confirmed, because the resubmission budget is two and the clinic is the one that pays for spending it.
The 15th arrives with the batch already assembled and every problem claim named, in time for a coder to work through it.
"A referral letter takes a doctor twenty minutes and half of them get written a week late."
The agent would assemble a draft from data already in the record, in the receiving facility's expected format, and put it in the referring practitioner's queue with every field it could not fill left visibly empty. The practitioner edits and signs. The agent then tracks whether the receiving facility acknowledged it, and chases on a schedule that does not depend on anyone remembering. The same mechanism handles unacknowledged results and post-discharge calls, which is usually the workflow with the largest quiet gap in it.
Who signed this letter, and did the receiving facility ever acknowledge it? Both answers sit in the record, with dates.
What breaks, and what the agent does about it
The patient sends a symptom to the appointment reminder
This will happen on day one. The refusal has to be built as a hard stop with a named human on the other side of it, not as a model instruction that mostly holds. It is treated the way every irreversible action is treated on this site: the agent does not get to decide it is safe.
Two records for the same patient
Emirates ID is the identifier that resolves this; names arrive transliterated differently by every system that touches them. Matching on name will merge two people who are not the same person, and in this sector that is a patient safety incident rather than a data quality one.
A component quietly moves data offshore
This one arrives as a dependency: a new managed service, a support tool with production access, a model endpoint that fails over to another region. Nobody decided to export anything. The defence is an inventory of every component that can see identifiable health data, written down at build time, and a change process that routes any addition to that list through compliance before engineering starts.
An access log that cannot tell software from people
If the agent shares an account, the audit trail is worthless in exactly the situation it exists for. Its own identity, its own least-privilege role, and its own log entries are not optional extras; the build is blocked until the system can issue them.
The payer changes a rule mid-month
Denial codes and validation rules move. Every integration ships with an alert that names the payer and the number of claims that failed the new check, because the version of this that costs money is the one nobody sees until the 15th.
What an AI agent costs for a UAE clinic
An AI agent build is AED 10,000 to 50,000, fixed price, agreed before work starts. Healthcare work sits high in that range more often than other sectors, for the reason set out above: keeping identifiable health data inside the country tends to rule out the convenient hosted component and put a self-hosted one in its place.
Single-workflow agent: AED 10,000 to 20,000, 2 to 3 weeks
One trigger, one or two systems, a human escalation path. Appointment reminders and rebooking sit here when the scheduling system already exposes an API and the messaging channel is established.
Multi-system agent: AED 20,000 to 35,000, 3 to 5 weeks
Three or more systems, branching logic, error handling. Claims preparation that reads the encounter, checks payer rules and writes a submission queue sits here.
Complex agent: AED 35,000 to 50,000, 5 to 8 weeks
Custom logic, compliance constraints, a self-hosted model, or a heavy integration surface. Anything touching a health information exchange, or anything that has to run its language model inside the country on your own infrastructure, belongs in this band.
Ongoing changes and monitoring run on a monthly retainer, quoted separately. No payback figure is published for this sector, because the honest arithmetic depends on what your current rejection rate and administrative headcount cost you, and those are numbers you have and we do not. How we work covers scoping and delivery in more detail.
Which administrative job eats the clinic's week?
Send the workflow, the systems it runs through, and which authority licenses the facility. We will tell you which band it falls into and, more usefully, which parts are out of scope to automate.
hello@telora.dev