Radiology PACS and RIS Software in Dubai (2026): Residency, 25-Year Retention and Real AED Costs
DHA ST-34 took effect 26 November 2025. What PACS and RIS software really costs in Dubai, plus the residency, retention and 30-minute critical-result rules that decide the architecture.
- PUBLISHED
- 03 OCT 2026
- READ TIME
- 13 MIN
- AUTHOR
- AQUARIUS · DUBAI
- UNIT
- REV 2026.09
Short answer: a compliant radiology stack in Dubai runs roughly AED 290-7,340 a month for a hosted PACS archive, plus AED 180,000-450,000 one-off for a custom RIS and the Dubai compliance layer around it. The money is not in the image viewer, which is a commodity. It is in four requirements - UAE-only data storage, 25-year retention, 30-minute critical-result notification and a documented PACS/RIS downtime plan - that most imported systems do not satisfy out of the box.
Dubai Health Authority replaced its diagnostic imaging rulebook on 26 November 2025, when the Standards for Diagnostic Imaging Services (DHA/HRS/HPSD/ST-34, Issue 1.1, issued 26 September 2025) took effect. It is the first version with a dedicated artificial intelligence standard and an explicit PACS/RIS business-continuity clause. If your software was specified before that date, your spec is out of date.
The market is growing, and so is the paperwork
Three numbers set the stakes. The UAE diagnostic imaging equipment market stood at USD 167.41 million in 2025 and is forecast at USD 177.54 million in 2026, heading to USD 225.35 million by 2030 at a 6.12% CAGR, with X-ray holding 28.12% of 2025 share and CT the fastest-growing modality at an 8.44% CAGR. Federal spending points the same way: the AED 5.51 billion health allocation in 2025 explicitly prioritises diagnostic-imaging infrastructure, AI integration and centralised medical records.
Then the number that decides whether your scanner earns: Dubai processed about 49.6 million insurance claims in 2025, up from 43.69 million in 2024 - 13.5% growth in a single year - across 4.9 million covered beneficiaries and 3,936 healthcare providers, with more than 95% of claims submitted electronically. Imaging is one of the highest-volume claim lines in that pipe. A study that is acquired but not cleanly reported, coded and transmitted is not a clinical problem. It is an unbilled one.
Most Dubai imaging centres get this wrong: they buy a PACS on viewer features - hanging protocols, 3D, mammography tools - and treat Dubai regulation as a configuration step afterwards. It is not configuration. Residency, retention, critical-result timers and downtime reconciliation are architecture. Retrofitting them means moving every study you have already stored.
PACS, RIS, VNA: what you are actually buying
These three get sold as one product and fail as three. PACS stores and displays DICOM images - capture, transfer, storage, interpretation workstations and an offline archive. RIS runs the business: orders, modality worklists, scheduling, structured reporting, coding and the handoff to billing. A VNA is the vendor-neutral archive underneath, so your images survive a change of PACS vendor. In Dubai, the RIS is where the regulation lives, and it is the layer imported systems localise worst.
The clauses your software has to satisfy
| DHA ST-34 clause | What it requires | What your software must do |
|---|---|---|
| 11.2 | All patient data shall be stored in the UAE, per Federal Law No. 2 of 2019 | UAE-resident hosting and backups; no overseas region, no overseas support tenancy holding images |
| Appendix 1 (B) | Critical results needing immediate action communicated within 30 minutes; urgent-but-not-immediate within 2 hours | A timer that starts at identification, tracks acknowledgment via read receipt, and escalates on breach |
| Appendix 1 (C) | Radiologist documents the finding, date and time, recipient name and role, method, and acknowledgment | A structured notification log written into the report and the medical record - not a WhatsApp screenshot |
| 12.15 | A formal PACS/RIS downtime contingency plan | Offline encrypted local capture, manual worklist and image labelling, urgent-case prioritisation, retrospective reconciliation into PACS, periodic drills |
| 13.10 | Dose-tracking software for cumulative patient dose; doses documented in records and reports | Ingest modality dose data and print dose into the report, per patient, over time |
| 13.1.1 | Patient identification using a minimum of two identifiers | Two-identifier verification enforced at the modality worklist, not only at reception |
| 10.6, 10.7, 10.9.1 | DICOM transfer; small-matrix minimum 512 x 512 at 8-bit; large-matrix 2.5 lp/mm at 10-bit; no loss of clinically significant information | No lossy re-compression in transit, and record the amount and method of compression used (10.8.2) |
| 10.3, 10.4, 10.10 | Teleradiology must not compensate for radiologist shortage or absence; receiving-site radiologists must be licensed in the country the service is provided | Route reads only to licensed, logged readers and keep an auditable record of who read what, where |
| 11.1.2, 11.1.4 | AI used under radiologist supervision, with evidence of continuous monitoring and training | Every AI output attributable to a supervising radiologist, with a performance log you can hand an inspector |
| 5.2, 5.3 | Add the service through DHA Sheryan; notify and register with FANR e-licensing | Sequencing, not software - but it gates go-live, so plan it as a dependency |
Clause 10.10 is the one that costs people money. The cheap overnight-reads model - ship studies to a low-cost reading centre in another time zone - is not a licence loophole in Dubai. The receiving radiologist must be licensed in the country where the service is provided and should be certified in teleradiology, the transmitting site still needs a full-time radiologist, a radiographer and a system manager with informatics certification (10.4), and teleradiology facilities must comply with the DHA Telehealth Standards for registration and licensing (10.2). Build the routing assuming the reader list gets audited, because it does.
The 25-year number that decides your storage bill
Under Article 20 of Federal Law No. 2 of 2019, health information must be retained for a period matching its purpose and in any case no less than 25 years from the date of the last health procedure performed on the patient. Article 13 of the same law prohibits storing, processing, generating or transferring health data outside the UAE unless a health authority approves it in coordination with MOHAP, with narrow exceptions under Ministerial Resolution 51 of 2021. ST-34 clause 11.2 restates it for imaging.
Put those together and the arithmetic is unforgiving. As a planning estimate - not a regulation - a plain digital radiograph runs 10-30 MB, MRI 50-250 MB, CT 150-500 MB, and digital breast tomosynthesis 1-3 GB per study. A centre doing 3,000 studies a month at a 120 MB blended average produces about 4.3 TB a year, which is roughly 108 TB across a 25-year retention window before you add redundancy, a DR copy, or a single mammography line. That is a capacity plan with a storage-tiering strategy, inside the UAE, with at least one platform migration budgeted. It is not a hosting line item.
The good news is that the infrastructure exists locally. AWS me-central-1 has run three UAE availability zones since August 2022, Microsoft Azure operates UAE North and UAE Central, and sovereign-cloud capacity has kept expanding through 2026. The pattern that works is a primary UAE region with encrypted secondary copies in a second UAE region: vendor-concentration cover without the data leaving the jurisdiction that regulates it. We go deeper on that trade-off in our guide to Dubai hosting and data residency.
What it costs in Dubai
Published hosted-PACS plans, converted at AED 3.67 to the dollar, start around AED 290 a month for an entry tier with 100 GB and one user and reach roughly AED 5,140 a month at about 700 cases, with small-centre tiers landing near AED 440-1,835 a month and typical ten-user configurations around AED 7,340 a month. Per-study pricing is published between AED 0.37 and AED 7.35 - roughly AED 0.66 per radiograph and AED 4.40 for PET/CT. Implementation benchmarks for small and mid-size practices sit near AED 18,000-73,000. Those are the international baseline figures; they move up once residency, retention and integration are in scope.
| Component | What it covers | Dubai cost (AED) | Build or buy |
|---|---|---|---|
| DICOM archive / VNA on UAE infrastructure | Storage, tiering, viewer, in-country DR copy | 290-7,340 per month by volume | Buy - commodity, never build |
| Custom RIS and Dubai compliance layer | Orders, worklist, structured reporting, critical-result timers, dose fields, two-identifier checks, audit trail | 180,000-450,000 one-off | Build - where imported systems fail |
| Integration work | HL7 and DICOM interfaces, EMR and NABIDH path, claims submission, modality worklist, dose ingestion | 60,000-160,000 | Build |
| Downtime and BC/DR tooling (clause 12.15) | Offline capture, manual worklist, reconciliation queue, drill logging | 25,000-60,000 | Build |
| Teleradiology routing and reader governance | Licensed-reader routing, lossless transfer, read logs | 45,000-120,000 | Build on bought transport |
| AI assist with supervision and monitoring | Triage or measurement models, radiologist sign-off, performance log | From 90,000, plus vendor licence | Buy the model, build the governance |
Indicative bands sit on our pricing page. Two reference points if you are comparing scopes: a custom laboratory information system in Dubai typically lands at AED 250,000-600,000, and NABIDH EMR integration is usually the gating workstream in either project.
Do not build a PACS. Build the Dubai layer.
The best decision in these projects is also the laziest one. Image storage and display are solved problems with mature, certified products. What nobody sells you off the shelf is the Dubai half: residency-correct hosting, a retention model that survives 25 years, critical-result notification with 30-minute and 2-hour timers that actually escalate, reconciliation after a downtime event, dose printed into the report, licensed-reader routing, an AI supervision log, and clean coded output into your EMR and claims path so the study gets paid.
That is the order we scope: buy the archive, build the compliance and workflow layer on top, integrate into the systems already running your facility. It keeps capital cost down, keeps the regulator satisfied, and leaves you free to swap viewer vendors later without migrating a decade of studies. For the billing end of the same pipeline, see our note on medical billing and claims software for Dubai.
The cost of getting it wrong is not theoretical. In a market where claims volume grew 13.5% in one year to 49.6 million and over 95% of submissions are electronic, every report that cannot be produced, coded and transmitted cleanly is revenue you acquired and then lost - while a licence renewal clock runs in the background. Fixing the architecture before go-live costs a fraction of fixing it with 108 TB already in the wrong place.
FAQ
Can we send night studies to an overseas reading centre?
Not as a staffing substitute. ST-34 clause 10.3 states teleradiology shall not compensate for a radiologist shortage or absence from the facility, and 10.10 requires receiving-site radiologists to be licensed in the country the service is provided, ideally certified in teleradiology. Teleradiology services must also meet the DHA Telehealth Standards for registration and licensing. Design the routing around a licensed reader list with an audit log.
Can our PACS run on a global cloud region to save money?
No. ST-34 clause 11.2 requires all patient data to be stored in the UAE under Federal Law No. 2 of 2019, whose Article 13 bars storing, processing, generating or transferring health data outside the UAE without approval from a health authority in coordination with MOHAP. A cheap overseas region is the single most common non-compliance we find in imported imaging stacks.
How long do we have to keep images and reports?
At least 25 years from the date of the last health procedure performed on that patient, under Article 20 of Federal Law No. 2 of 2019 - longer where the purpose requires it. Size storage for that window and plan at least one format and platform migration inside it.
Does AI-assisted reporting need special approval?
AI is permitted but governed. Under ST-34 Standard Seven, AI use in radiology follows DHA policy for AI in healthcare, must stay under the responsibility and supervision of a radiologist, needs an ethics-based agreement with the provider covering transparency and safe control of data and algorithm, and requires documented evidence of continuous monitoring and staff training. Practically: every AI output needs an attributable human sign-off and a performance log.
How long does a Dubai RIS and PACS project take?
In our experience the Dubai compliance and workflow layer takes about 10-16 weeks once interfaces are available, and a full custom RIS with reporting, dose, claims and EMR integration runs 4-7 months. DHA service addition through Sheryan and FANR registration run in parallel and should start first, because they gate go-live rather than development.
Where to start
If you are licensing a new imaging centre, adding CT or MRI to an existing clinic, or replacing a PACS that was never built for Dubai rules, the first deliverable is not a demo. It is a priced, clause-by-clause gap list against ST-34 Issue 1.1 and Federal Law No. 2 of 2019. We will build that with you, say plainly which parts you should buy rather than build, and quote only what is genuinely missing. Talk to Aquarius and bring your modality list and monthly study volume - those two numbers set most of the budget.