> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.conversive.ai/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.conversive.ai/_mcp/server. # Regulation, Compliance, and Digital Health > Accreditation, regulators, data and messaging rules, and India's digital health stack (ABDM, ABHA, FHIR). # ## NABH and NABL accreditation NABH (National Accreditation Board for Hospitals) is a voluntary but increasingly expected quality accreditation for hospitals, and insurers and PM-JAY empanelment sometimes require it. NABH standards explicitly expect structured patient feedback and communication loops, which makes them relevant to patient surveys and grievance handling. NABL (National Accreditation Board for Testing and Calibration Laboratories) is the equivalent accreditation for diagnostic labs. ## CDSCO, the Clinical Establishments Act, and the NMC The Central Drugs Standard Control Organisation (CDSCO) is India's national regulator for drugs and medical devices, relevant mainly for pharma or device-related products. The Clinical Establishments Act is a state-level law that requires hospitals, clinics, and diagnostic centres to register and be licensed, with requirements and enforcement varying by state. The National Medical Commission (NMC) registers and licenses doctors in India and replaced the Medical Council of India (MCI). ## Telemedicine Practice Guidelines (2020) The Telemedicine Practice Guidelines of 2020, issued by the body that is now the NMC (then the MCI), made teleconsultation legal practice in India. They set what a doctor can and cannot prescribe remotely, consent requirements, and record-keeping for teleconsultations, which makes them directly relevant to telehealth and patient-engagement platforms. ## The DPDP Act, 2023 The Digital Personal Data Protection (DPDP) Act, 2023 is India's data privacy law. Patient phone numbers and health-related messages count as personal data, and processing them requires consent. A hospital CIO or IT head will raise data protection early in any serious evaluation, so vendors should understand the general shape of their compliance even if detailed commitments come from their legal team. ## TRAI DLT rules for commercial SMS Commercial SMS in India must be registered on TRAI's Distributed Ledger Technology (DLT) platform, covering the sending entity, sender ID, and message templates. Messages without a registered Principal Entity (PE) ID and Template ID are silently dropped by telecom operators, without bouncing or any error. Promotional messages are also limited to 10 AM to 9 PM IST, and Do Not Disturb (DND/NCPR) registry rules affect delivery. ## WhatsApp Business API rules versus SMS WhatsApp Business messaging does not require DLT registration; it follows Meta's own policy instead. That policy requires user opt-in, approved message templates in four categories (Marketing, Utility, Authentication, and Service), and a sender quality rating that affects delivery. Many hospitals unknowingly lose SMS reminders to DLT filtering, which gives WhatsApp-first platforms a clear, provable advantage. ## India's digital health stack The Ayushman Bharat Digital Mission (ABDM) is India's national digital health stack, built to make health records portable across providers. The ABHA ID is its patient-facing part, a digital health ID that links a patient's records across hospitals and providers. PM-JAY (Ayushman Bharat) is the government health insurance scheme for economically weaker sections, reimbursing empanelled hospitals at fixed rates. e-Sanjeevani is the government's own telemedicine platform, used heavily in the public health system and distinct from private telehealth platforms such as Practo. The National Health Stack and the Unified Health Interface (UHI) form the wider interoperability framework around ABDM. UHI is often called "UPI for healthcare" because its goal is to let any registered app discover and book health services across providers, as any UPI app can pay into any bank. ## The ABHA number and ABHA address The ABHA number is a 14-digit unique health ID created voluntarily with the patient's consent, at an ABDM-linked facility or through the ABHA app or portal. The ABHA address is a human-readable handle in the form username\@abdm that works like a login for health-record apps. ABHA is an index rather than a database: records stay with the hospital or lab that created them, and ABHA links them so they can be fetched on demand with the patient's consent. ## Scan and Share Scan and Share is an ABDM service launched in 2022 for OPD registration. The patient scans the hospital's QR code, shares their ABHA-linked details directly into the hospital's HIMS, and receives a digital queue token. Government-cited studies report OPD registration waits dropping from about an hour to a few minutes. ## ABDM consent architecture: HIP, HIU, and HIE-CM ABDM's consent system has three roles. A Health Information Provider (HIP) is where a record originates, such as a hospital, lab, or clinic, and a Health Information User (HIU) is whoever asks to view it, such as another doctor, an insurer, or the patient's own app. The Health Information Exchange and Consent Manager (HIE-CM) sits between them: the HIU requests access, the patient approves in their app, and a consent artefact records exactly what was shared and for how long. To take part in ABDM, facilities register in the Health Facility Registry (HFR) and doctors register in the Healthcare Professionals Registry (HPR). ![](https://files.buildwithfern.com/visual-editor-images/docs.conversive.ai/2026-10-22T09:52:19.276Z/user-guides/healthcare-university/regulation-compliance-and-digital-health/Screenshot_2026-10-22_at_15.21.53.png) ABHA links records but does not store them: the HIP keeps each record and releases it only against the patient's consent. ## FHIR and ABDM record types FHIR (Fast Healthcare Interoperability Resources) is the modern HL7 standard for exchanging health data, and ABDM exchanges records as FHIR R4 document bundles that follow India-specific profiles published by C-DAC's National Resource Centre for EHR Standards (NRCeS). Each record therefore travels as a structured, coded package rather than a scanned PDF. The latest implementation guide also extends the standard to billing invoices and health-claim artefacts such as claims and coverage-eligibility requests, which links ABDM to TPA and cashless-claim processes. ABDM defines seven clinical record types. An OPConsultation record holds an outpatient visit note, including symptoms, examination, diagnosis, medications, advice, and follow-up, and usually comes from the EMR or OPD module. A Prescription record holds medication orders from the EMR's e-prescription function, and a DiagnosticReport holds lab or imaging results from the LIS or RIS/PACS. A DischargeSummary summarizes an inpatient stay, including diagnosis, procedures, medications, and care plan, and is produced by the HIMS or EMR's IPD module. An ImmunizationRecord holds vaccination history from immunization and EMR systems. A HealthDocumentRecord holds unstructured documents such as scans and PDFs uploaded by the patient or provider, and a WellnessRecord holds vitals and general or women's wellness data from patient health-record apps. ## Government incentives for ABDM adoption As of the guide's writing, ABHA is voluntary for citizens, and adoption is driven by incentives and convenience rather than a blanket mandate on private hospitals. The Digital Health Incentive Scheme (DHIS) offers financial incentives, publicly described as up to ₹4 crore, to hospitals, labs, pharmacies, and digital-solution companies that create ABHA-linked, interoperable records. Rules change quickly, so any claim that ABDM participation is now compulsory should be checked against the latest National Health Authority (NHA) notifications. ## How software integrates with ABDM: the sandbox Hospitals and software vendors connect to ABDM through the ABDM sandbox at sandbox.abdm.gov.in, either directly or through a technology service provider. An integrator builds and tests against the sandbox APIs, completes the sandbox exit form, and demonstrates its workflows to a review panel, after which production credentials are issued ([DPI Global](https://www.dpi.global/globaldpi/abdm)). Integration is optional for facilities as of the source's writing, and the sandbox documentation covers building a HIP or HIU, packaging FHIR data, encryption, and sample API collections ([ABDM developer forum](https://devforum.ndhm.gov.in/t/knowledge-repository/2079)). The FHIR record formats used in ABDM exchange are defined in the NRCeS FHIR Implementation Guide for ABDM, version 6.5.0 at the time of checking, built on FHIR R4 ([NRCeS](https://nrces.in/ndhm/fhir/r4/)). It sets the minimum health record artefacts that can be captured and exchanged under ABDM's Health Data Interchange Specifications 1.0. ## Where ABDM touches patient communication ABDM creates several patient-communication moments. Scan and Share produces a digital token the hospital can send messages against, and ABHA creation and record-linking both require patient consent that must be requested and explained clearly. DHIS also gives hospitals working toward ABDM readiness a new budget lever, and being able to discuss HIP, HIU, and FHIR record types with a CIO signals real expertise.