Your first steps when a device with patient photos goes missing
A lost device with patient photos on it is stressful, but your clinic can handle it calmly with a clear plan. The first hour matters most. The right steps help you lock the device, work out which photos were on it, and decide whether you must report it to your health authority, the government body that oversees health care in your emirate.
In the UAE, the federal health data law says patient information must be kept confidential and kept inside the country. It does not give a breach deadline. Each emirate sets its own reporting rules, and in Abu Dhabi the deadline is counted in hours. This is why the checklists ask you to write down each step and the time you did it. Your notes are your proof. Starting early makes every later step easier. For a fuller explanation, read our guide on what to do when a device with patient photos is lost.
Our lost device checklist for US clinics
Important:This checklist is a practical guide, not legal advice or a guarantee that your clinic follows UAE health data rules. Rules differ by emirate and can change. Check with your health authority and ask a qualified lawyer when needed.
This page has two checklists for when a device with patient photos is lost. Use Checklist 1 if your clinic takes patient photos in a clinical photo app. Use Checklist 2 if you save photos another way, for example with the phone’s own camera app rather than a clinical photo app.
Each checklist takes you from getting ready, through the first hour and working out how serious the incident is, to reporting. The last part is split by emirate, so go to the one that matches your clinic. Abu Dhabi follows the Department of Health’s ADHICS standard, and Dubai follows the Dubai Health Authority’s rules, including its NABIDH breach policy. Tick each box your clinic can honestly say yes to. Any box you cannot tick is a gap to fix.
Choose the checklist that matches your clinic. Each checklist includes the steps to prepare, respond to a missing device, work out how serious the incident is and report it to your health authority when required.
Checklist 1: UAE clinics using a clinical photo app
A. Before a device goes missing
B. First hour: What to do when a device is lost
C. Check which patient photos may have been exposed
Important: An audit trail may not show photos opened outside the clinical photo app, such as images already saved in the phone’s gallery.
D. Decide how serious the incident is
E. Report to your health authority
If your clinic is in Abu Dhabi
If your clinic is in Dubai
If your clinic is in another emirate
F. After the incident
Checklist 2: UAE clinics not using a clinical photo app
A. Before a device goes missing
B. First hour: What to do when a device is lost
C. Find out which patient photos may have been exposed
D. Decide how serious the incident is
E. Report to your health authority
If your clinic is in Abu Dhabi
If your clinic is in Dubai
If your clinic is in another emirate
F. After the incident
How CureCast helps with patient photos
For UAE hosting details and clinic onboarding, explore CureCast clinical photo management for Dubai and UAE clinics. Confirm your account deployment, staff permissions and device controls during your demo.
CureCast is a clinical photo app for plastic surgeons, dermatologists and medical spas. It is built to support HIPAA-compliant workflows. It keeps patient photos in one place, not on personal phones or in the normal camera. Here is how it helps with your checklist:
- Secure upload link: Patients send photos from home. They need no app or account, and the photos go straight into CureCast.
- Encryption: Stored photos and records are encrypted, and so is data sent between your device and CureCast.
- Staff management: You decide what each staff member can see, and you can turn off their access when they leave.
- Audit trail: It records who views, changes or downloads patient information. You can export the record.
- Reauthentication: Inactive sessions end after 2 hours on desktop and 4 hours in the iPhone and iPad app. The person then signs in again.
- Device management: You can see which devices are signed in. If a phone or tablet is lost, you can end its CureCast session.
- Business Associate Agreement: CureCast provides one from the first day of your trial.
CureCast does not make your clinic HIPAA compliant on its own. Your clinic still needs to work through the full checklist above. You can read how CureCast handles security on our security and compliance page.
Resources
These official DoH and DHA pages cover the rules used in this checklist:
