OpenAI, Epic and the UAE’s Secure Healthcare AI Layer

OpenAI announced its ChatGPT for Healthcare platform can now allow approved organizations to bring authorized patient-chart context into a governed workspace.

Per what we can glean from the announcement, OpenAI outlines two paths: EHR context inside ChatGPT, and ChatGPT available inside supported EHR workflows. The available documentation states that the Epic connection is currently read-only, uses existing Epic and workspace permissions, requires Epic FHIR configuration and OAuth setup, and depends on the right BAA and organizational approvals.

That is important, since healthcare AI is moving from generic assistance into secure inference over patient context: the ability to strongly posit from the documented and clinically validated data provides better remotely-assisted guidance, qualified second-opinion sessions to aid medicall staff.

It also brings more strongly the question as to how does a healthcare provider expose enough data for useful AI, protect patient identity, preserve clinical meaning, and turn the result into a protocol-of-care action?

We knew this will happen sooner than later — and have been preparing for.

This is what Yma Health has been dedicating its efforts to through its engineering endeavours — in a booming healthcare market that has been adopting the frontier technology: the UAE 🇦🇪.

Through our recently published UAE Healthcare AI Readiness Index — we mapped the landscape to identify providers and their steps to become visible to clients, who are ready and are rather querying AI assistants w.r. to the their health concerns.

From this practical knowledge we assessed market’s overall and operators’ individual steps to communicate with users digitally, infering from this the sequential importance to manage the funnel — since a digital path informs expectations of seamless triage, contextually relevant advice etc.

And this is where it becomes tricky.

Seeing the bandwidth of data travelling over public channels, exported into myriads of medical systems, we sought to orchestrate this coherently, professionally and in secure manner.

While cognisant of EHR exposure in AI systems to accompany doctor’s judgement, before appearing on screen of a doctor during patient’s session, the very same clinical context will first enter the overloded front-desk operations that enables prioritisation and doctor routing.

OpenAI’s announcement presents that ChatGPT for Healthcare can bring authorized Epic patient context into a governed workspace so clinicians can review recent changes, lab results, medication shifts, specialist notes, follow-ups, referrals, and unresolved issues.

Per above, before a doctor infers from the workflow providing patient context with the aid of OpenAI or Epic, someone has to route the patient to the doctor.

The UAE Is Already Building The Data Rails

Riayati, the National Unified Medical Record program, reports 4 billion connected medical records, 14 million unique patients, 116,071 connected clinicians, and 4,952 connected healthcare facilities. It is integrated with NABIDH in Dubai and Malaffi in Abu Dhabi, creating the national connective tissue for health records.

DHA’s July 2025 update reported more than 10.41 million records, 1,888 licensed healthcare facilities, 53,659 healthcare professionals, and 91 integrated EMR systems operated in Dubai.

Dubai’s Health Data Sandbox adds another innovation path: secure, de-identified real-world datasets drawn from NABIDH, including EHR and other clinical data from 2018 onward. The sandbox explicitly welcomes privacy-preserving data access and consent tools, and asks participants to demonstrate a clear data-access requirement, regulatory relevance, and compliance with UAE Health Data Law and PDPL.

Malaffi per the latest available data from DoH in Abu Dhabi is connecting more than 2,700 facilities and collating medical interactions into a longitudinal patient file. DoH’s 2026 Health Information Exchange standards require specific coding standards, units, data classification, and minimum data sets from source EMRs and reference labs into Malaffi. Required demographic and clinical categories include patient identifiers, name, date of birth, nationality, phone, email, allergies, chronic conditions, and laboratory results.

Seeing the movement to systematize access to sensitive healthdata — as a staging excerice to expose it in both internal workflows — and potentially open this to external control use, we built a secure standard for this.

Yma’s VPN-for-Healthcare platform to enable secure retrieval from EHR/HIS systems, anonymization middleware, confidential execution, attestation, and downstream AI workflows that can support clinical operations and patient communication.

Developed to be used by a major EHR operator in the UAE and clinics connected to it, we have built a commercial anonymization middleware service that retrieves records from EHR/HIS systems, performs context-aware anonymization, and releases de-identified clinical outputs for AI applications.

The architecture runs anonymization and inference inside Trusted Execution Environments via confidential tunnels, attestation, trusted loading, immutable execution proofs, and confidential infrastructure. The technical stack included MedGemma 27B, vLLM, NVIDIA HGX B200 confidential GPU mode through Nebius AI Cloud, and CPU-based confidential execution for anonymization.

The product meaning is straightforward: Yma can help providers expose clinical data to AI through a trust boundary with governed transfer.

From this practical experience, we see a potential implementation scenario: a secure data tunnel, anonymization, attested workload, protocol-of-care action, and measurable patient communication, enabling EHR data safely accessed and used not just internally in isolated deployments — but at a nation level in the growing number of consumer-facing user-cases.

Seeing the looming crisis of staffing adequacy, the industry both locally and globally will have to adapt. Yma Health stands at the forefront, facing this challenge.

Secure exposure of data still requires a guidance workflow

Secure access to clinical context creates the first half of the value chain. The second half is protocol-of-care orchestration.

Once an AI system identifies a follow-up, flags a care gap, extracts a relevant history, or prepares a patient-facing explanation, the provider still needs operating rules:

• Which team owns the next action?
• Which cases require clinician approval?
• Which messages can be drafted for review?
• Which messages can be sent automatically?
• Which data fields can enter the AI context?
• Which channel is approved for the patient response?
• Which handoff creates a booking, referral, reminder, or escalation?
• Which audit trail proves that policy was followed?

Yma Workspace has been designed with this gap in mind precisely, because the platform already treats patient communication as a governed process: unified inbox, priorities, approval modes, automated follow-ups, EHR-connected booking where scoped, confirmations, reminders, and drop-off analytics.

Press enter or click to view image in full size

Opportunities for Yma Health in the UAE

We aim to continue offering secure EHR AI pilots alongside local EHR vendors.

The OpenAI and Epic announcement accelerate the enterprise direction: healthcare AI is moving closer to governed clinical context. In the UAE, certified EHR vendors will need a local, regulator-friendly way to expand AI features without relaxing data controls. Yma Health can position its anonymization middleware and confidential tunnels as the bridge from EHR data to safe, usable AI capability.

We proceed promoting our domain-savvy protocol-of-care workflows via Yma Workspace.

Private clinics already have useful patient data and rising digital demand, but the handoffs between channels, front desk teams, clinicians, and follow-up workflows remain fragile. We are helping our clients package AI around actual care protocols: physiotherapy follow-ups, medication-review reminders, chronic-care check-ins, post-procedure instructions, reactivation, referral routing, and appointment preparation, so AI becomes part of care delivery instead of another disconnected tool.

We are looking to use Dubai’s Health Data Sandbox as a proving ground for privacy-preserving access.

Dubai’s Health Data Sandbox explicitly welcomes privacy-preserving data access and consent tools. That creates a natural lane for Yma Health’s VPN-for-Healthcare architecture. The Sandbox can become a place to demonstrate how confidential clinical data access can work in practice.

We aim to contribute in forming the AI gateway sitting on top of the UAE’s HIE rails.

Riayati, NABIDH, and Malaffi already create the regional proof environment for trusted health data exchange. What is still missing is the secure execution layer that lets providers turn those rails into governed AI workflows. We can see our formed confidential computing middleware as an HIE-compatible AI gateway: a layer that manages data movement, anonymization, governance, auditability, and downstream action without forcing providers to rebuild their core systems.

We research an opportunity to connect de-identified clinical outputs directly to patient communication.

The most commercially natural use-case is also the most operational: using secure, de-identified clinical context to improve patient communication. Summaries, visit-preparation prompts, follow-up nudges, reminders, care-plan reinforcement, and clinician-approved explanations all sit close to Yma Workspace. We see the above as a good opportunity to turn privacy from being merely a technical requirement into an open standard to give providers a measurable way to improve access, continuity, and trust.

Most imporantly, what do you think? What are your challenges or travails with the above? We would love to chat to jointly progress the market we operate in with caring love.

Yma Health Team.

Sources:

- OpenAI, “Healthcare organizations can now connect EHR and additional industry data to ChatGPT,” https://openai.com/index/chatgpt-connects-health-records-and-healthcare-sources/

- OpenAI Help Center, “Using the Epic plugin with ChatGPT and Codex,” https://help.openai.com/en/articles/20001490

- Epic, “Real Results, Right Now: How Epic AI Is Reducing Costs, Improving Care, and Helping Patients,” https://www.epic.com/epic/post/real-results-right-now-how-epic-ai-is-reducing-costs-improving-care-and-helping-patients/

- Ministry of Health and Prevention UAE, “Riayati,” https://mohap.gov.ae/en/riayati

- Dubai Future Foundation / Sandbox Dubai, “Health Data Sandbox,” https://prod.sandboxdubai.gov.ae/health-data-sandbox

- Dubai Health Authority, NABIDH first-half 2025 update, https://www.dha.gov.ae/ar/media/news/979

- Department of Health Abu Dhabi, “Malaffi,” https://www.doh.gov.ae/en/featured/malaffi.aspx

- Department of Health Abu Dhabi, “Health Information Exchange standards,” https://www.doh.gov.ae/en/resources/HIE

- UAE Government, “ICT in the health sector — legislations and policies,” https://u.ae/en/about-the-uae/digital-uae/whole-of-government-approach/digital-health/ict-in-the-health-sector

Yma Health, “VPN for Healthcare: A Confidential Data Layer for Medical AI in MENA,” https://www.yma.health/news/vpn-for-healthcare-a-confidential-data-layer-for-medical-ai-in-mena

- Yma Health and Super Protocol, “Confidential Medical AI: How Yma and Super Protocol Make Patient Data Usable,” https://www.yma.health/news/clinically-valid-and-ethically-compliant-healthcare-small-language-models