Shafafiya explained: Abu Dhabi's e-claims standards and Post Office

Shafafiya is the Abu Dhabi Department of Health (DOH) system for health insurance data. It does two jobs: it publishes the standards (the Shafafiya dictionary of data elements, codes and file formats), and it runs the Shafafiya Post Office, the web-service exchange that carries claims, prior authorisations and remittances between providers and payers. If you are an insurer or a TPA (third-party administrator) with Abu Dhabi members, your systems have to speak Shafafiya’s language. This guide explains what the portal holds, how the main transactions flow, and what an insurer’s own systems need to do around it.

What Shafafiya is, in DOH’s own words

DOH describes the Shafafiya portal as the home of “the key standards that govern how healthcare information is exchanged and used”, in line with chapter VIII (Data Management) of its Regulator Policy Manual. The documents on it describe the standard language used to exchange data, such as codes and licences, and the technical specifications of the exchange systems.

DOH also says that any electronic transaction between healthcare entities needs to be structured and exchanged according to these standards. Changes are announced on the Shafafiya Notices page, and Abu Dhabi healthcare entities are required to monitor that page to keep their systems up to date.

The name means “transparency” in Arabic. In practice, people use “Shafafiya” for three things at once:

What people mean	What it is
The Shafafiya portal	The DOH web section with standards, notices, prices, reporting rules and the dictionary
The Shafafiya dictionary	The data standard: data elements, code sets, licence lists, schemas and samples
The Shafafiya Post Office	The exchange itself, used through web services

DOH’s portal also sets out the key concepts behind the data. A Patient has an Encounter with a Provider. The Provider claims the charges from the Payer. Each clinical service is an Activity (a consultation, a lab test, a drug), and an Activity can carry Observations, such as a test result. A claim, in DOH’s definition, is “an original request for payment for health services provided to a single Patient”.

The Shafafiya dictionary: what is inside

The Shafafiya dictionary is the page most technical and claims teams bookmark. It is a library rather than a single document. As published today it holds:

1. Data elements. The definition of each field used in transactions, plus a release schedule for changes.
2. Codes. ICD-10-CM diagnosis codes (several editions are listed), CPT and HCPCS procedure codes, a Drugs code list, LOINC for lab observations, SNOMED CT, an Approved Health Technologies list (September 2026 edition), benefit packages, and an “Other Codes” file.
3. The Reference Price List, listed as “All Phases Combined”, updated 21 January 2025.
4. Licences. Downloadable lists of licensed insurers, clinicians and facilities in Abu Dhabi, with licensing history, plus DHA and MOH licence lists.
5. XSDs (file schemas). Claim Submission, Remittance Advice, Person Register, Prior Request, Prior Authorization, Electronic Prescription, and newer Cost Submission, Common Types and Data Dictionary schemas.
6. XML samples for claims (including claims with a DRG, a diagnosis-related group), remittances, person registers, prior requests and pharmacy transactions, with a note on schema restrictions.
7. Transactions guidance, including an overview, Prior Request/Authorization notes and the Public Test Environment.
8. The Drug and Medical Product Inventory System (DMPIS), marked “NEW” and linked to DOH Circular 58 of 2026.

For anyone searching for “Shafafiya drugs”, the Drugs code list sits under Codes on this page. It is the coded drug list that claims and prescriptions refer to.

Denial codes

The “Other Codes” file includes a sheet called Denial. It lists the standard reasons a payer gives when it rejects or adjusts a request or a claim. Each code has a description and, for many, a worked example. The families include:

Prefix	Family	Example from the DOH list
ELIG	Eligibility	ELIG-001 “Patient is not a covered member”
AUTH	Authorisation	AUTH-001 “Prior approval is required and was not obtained”
BENX	Benefit limits	BENX-005 “Annual limit/sublimit amount exceeded”
CODE	Clinical coding	CODE-014 “Activity/diagnosis is inconsistent with the patient’s age/gender”
DUPL	Duplicates	DUPL-001 “Authorization request/Claim is a duplicate based on service codes and dates”
MNEC	Medical necessity	MNEC-005 “Service/supply may be appropriate, but too frequent”
NCOV	Non-coverage	NCOV-001 “Diagnosis(es) is (are) not covered”
CLAI	Administrative	CLAI-014 “Claim not compliant with Resubmission type”

There are also families for prices, submission time limits, co-payments, audits and take-backs. For an insurer, these codes matter twice. Your claims team, or your TPA, has to use them correctly when it denies something. And your reporting needs to read them back, because denial patterns are one of the clearest views of how a medical book is behaving.

How the Shafafiya Post Office works

DOH’s rules for the Post Office are short and worth knowing exactly:

• Senders upload XML files to the Post Office for other organisations (receivers) to collect.
• Each file carries a SenderID and a ReceiverID. Only those two organisations and DOH can see it.
• Each partner must monitor the Post Office for new files sent to them and download them.
• The Post Office uses web services only. There is no DOH webpage or software to upload or download files.
• Users must get their own software to call the web services: a hospital information or billing system, a pharmacy system, an insurance company system, or an XML upload tool.
• DOH does not regulate particular software products.

That last point is why “Shafafiya portal login” is a common search with a confusing answer. There is no claims screen to log in to. Your software logs in, using credentials issued to your organisation. A DOH notice from 2015 also reminds healthcare facilities to change their Shafafiya passwords at three-month intervals, under Circular DG 10/15.

The web services

DOH lists the web services the Post Office offers. In plain terms:

Web service	What it is for
UploadTransaction	Send a file (a claim, a remittance, a person register and so on)
GetNewTransactions, DownloadTransactionFile, SetTransactionDownloaded	Find files addressed to you, download them, mark them as collected
SearchTransactions	Look up past transactions
CheckForNewPriorAuthorizationTransactions, GetNewPriorAuthorizationTransactions	Collect prior authorisation traffic
GetPersonInsuranceHistory	Return a person’s insurance history by Emirates ID or Unified ID
PersonProfile	Return a person’s demographic details
GetPrescriptions	Retrieve electronic prescriptions
AddDRGToEClaim, GetDRGDetails	DRG calculation for inpatient claims
GetClaimCountReconciliation	Reconcile claim counts
GetInsuranceContinuityCertificate, CancelInsuranceContinuityCertificate	Request and cancel insurance continuity certificates (the dictionary marks newer RequestCOC and GetCOCDetails services as test-environment only)

The main transactions, step by step

For an insurer or TPA, most day-to-day Shafafiya traffic follows one cycle. The schemas named here are the ones DOH publishes in the dictionary.

1. Member registration (Person Register). The payer reports its members to DOH. A DOH notice from March 2018, under circular US/05/18, set a process for registering members that uses the PersonProfile web service as the main source of members’ demographic details and requires the Unified ID in PersonRegister transactions.
2. Prior request and prior authorisation. Before a planned service that needs approval, the provider sends a Prior Request. The payer answers with a Prior Authorization. DOH’s notes on this transaction include the rule that a DenialCode is mandatory when the authorisation result is “No”.
3. Claim submission. After the encounter, the provider sends the claim, with its activities, diagnoses and codes.
4. Remittance advice. The payer answers with what it paid, adjusted or denied, line by line, using the denial codes.
5. Resubmission. If the provider disagrees or corrects something, it resubmits. The denial list itself has a code for a resubmission that does not match its declared type (CLAI-014).

Shafafiya is also used for reporting beyond insured claims. DOH Circular 109 of 2025 asks licensed providers to report self-pay and non-insurance claims through Shafafiya, with DOH as the Receiver ID. The Reporting page also lists rules such as DG/17/17 on real-time submission of electronic claims.

Prices, notices and keeping up with changes

Shafafiya changes often, and much of the work is simply keeping up. Three pages carry most of the change:

• Prices. The mandatory tariff files, including DRG updates, and material on the Outpatient and Emergency Care Reimbursement Reform (ADOC), with rules and materials for ADOC shadow billing dated September 2026.
• Notices. Dated announcements. Examples include a December 2023 notice on dose, frequency and prescription instructions in pharmacy authorisations and claims, a 2018 notice adding VAT data elements to the PersonRegister and ClaimSubmission schemas, and a 2017 notice on migrating the Shafafiya portal to a new platform. An older notice records that the www.shafafiya.org address was retired from 1 December 2016, so old documents pointing there should be read as doh.gov.ae/shafafiya.
• Dictionary release schedule. Upcoming changes to data elements and validation rules.

DOH offers a Public Test Environment so that entities can test new schemas and validation rules before they go live, and it encourages payers to use it.

Continuity of cover and the insurance history check

One Shafafiya service matters directly to sales and underwriting, not only to claims: GetPersonInsuranceHistory. DOH documents it as taking an Emirates ID or Unified ID and returning the person’s insurance details.

This is the data behind a continuity check. When a new member joins, the insurer wants to know whether the person was insured before, whether there was a gap, and whether they are already insured elsewhere on the start date. Those answers affect waiting periods, pre-existing condition terms and duplicate cover. The DOH denial list even carries a code for waiting periods on pre-existing or specific conditions (AUTH-011), and its worked example turns on “uninterrupted prior coverage”.

What to look for in your own systems

Day-to-day claims traffic on Shafafiya often runs through the claims platform, frequently the TPA’s. But the insurer’s core system feeds that traffic and reads its results. When you review your set-up, look for:

• Members registered correctly from the start. Clean identity data (Emirates ID, Unified ID, dates of birth) at policy issue means fewer eligibility denials later.
• A continuity check at the point of sale, with a clear rule for what happens if the check cannot be completed. “Could not check” should not be treated as “clear”.
• Plan data that matches what the regulator approved, including the DOH approval number per plan.
• Late-registration fines worked out by rule, not by hand.
• Claims data you can report on, including denial codes, by month and by network administrator.
• A named owner for Shafafiya Notices, so that schema and code changes reach your systems on time.

How VInsure handles the Abu Dhabi side

VInsure is VIONEX’s insurance core system. Its Medical module works on the sales and policy side of health insurance, and it uses Shafafiya where that side needs it. For Abu Dhabi members, VInsure runs an insurance-continuity check through the Shafafiya register. In Group Medical, the platform reads the DOH register to see whether a person is already insured elsewhere on the start date. It only reads. “Insured elsewhere” sends the file to an underwriter, “could not check” is not read as clear, and each check writes a history line.

Around that check, VInsure works out late-registration fines from a configurable DOH and DHA fine matrix and collects them with the premium. It issues continuity certificates in the Abu Dhabi and Dubai formats, records the DOH approval number per plan, and produces the ICP (MOI) upload file for Abu Dhabi visa holders. Claims themselves are handled by the network administrator; VInsure converts each administrator’s claim data into the Central Bank’s file format for claim-utilisation reporting. See the Medical page, the integrations in the Engine Room, or book a demo to see it on the live system.

The health proposals worklist, with the DOH fine and cut-off date shown per proposal (demo data).

Where to go next

Shafafiya rewards insurers that treat it as a living standard rather than a one-off integration. Keep the dictionary, prices and notices pages on someone’s weekly list, test changes in the Public Test Environment, and make sure your member data is right before it ever reaches a claim.

If you also write business in Dubai, the next article in this series covers eClaimLink, the Dubai Health Authority’s e-claims platform. For the wider picture of who regulates what, see who regulates insurance in the UAE, and for how a core system ties sales, policies and finance together, see what is a core insurance system.

This article describes published DOH standards for general information. Please confirm how any rule applies to your organisation with your compliance or legal team.