ABDM v3 · M1–M4 implemented
Sandbox keys, issued on signup

For hospitals CIO, IT head, administration

ABDM compliance for hospitals, on the systems you run

ABDM asks a hospital for a registered identity, a registration desk that can handle ABHA, and clinical records in a form patients can carry to their next doctor. None of that requires a new HMS. This page explains what it does require, department by department.

Plan your rollout with us Go-live checklist

01 The ask

What ABDM means for a hospital

Four obligations. Each lands on a different part of the hospital, which is why an ABDM project stalls when it is treated as an IT-only change.

Identity

The hospital is registered

Each site has an entry in the Health Facility Registry, linked to the software that makes the ABDM calls. Every record the hospital shares is attributed to one of those entries.

Front desk

Patients can use their ABHA

Registration can find, verify or create a patient’s Ayushman Bharat Health Account and attach it to the hospital’s own MRN.

Outbound

Records reach the patient

OPD notes, prescriptions, lab reports and discharge summaries are linked to the patient’s ABHA, where the patient can see them in their PHR app and share them with another doctor.

Inbound

Clinicians see prior history

With the patient’s consent, a doctor can pull records that other hospitals and labs hold, rather than relying on the file the patient remembered to bring.

Is it mandatory? Participation is voluntary for private providers under national policy. Government schemes such as PM-JAY and CGHS increasingly expect ABHA-linked, ABDM-compliant records from the hospitals they empanel, so check what applies to your empanelments. NHA’s Digital Health Incentive Scheme has also paid for ABDM-linked transactions above set thresholds. It has been revised several times, so check its current terms on abdm.gov.in before building a business case on it.

02 The registration desk

Where most of the change is felt

A busy OPD counter has one operator and a queue of patients, and not all of them brought a charged phone. ABDM has a route for most situations, and only some need an OTP.

The patientRoute at the counterOTP?
Has an ABHA app on their phone Scan & Share: scans the counter QR, reads out the token their phone shows No
Has an ABHA, no phone to hand Find ABHA by mobile or Aadhaar, then a fingerprint or iris capture No
Has their phone with them Login by OTP Yes
Has no ABHA, wants one Enrol with Aadhaar OTP, sent to the mobile linked to their Aadhaar Yes, once
Does not want an ABHA Register as today. ABHA is voluntary, and treatment cannot be refused without one —
Queue

One QR per counter

Each counter prints its own Scan & Share QR, so two desks can run two queues, and tokens restart each day. NHA leaves token numbers and queue display to the hospital’s software, so here they come from the connector, not from ABDM.

Devices

Biometric needs hardware and enablement

Fingerprint and iris capture require a UIDAI-certified RD device at the counter. For ABHA creation, NHA must also enable the method for the software’s client ID. Confirm both before buying devices.

Limits

What the desk cannot do

ABDM v3 has no call that confirms an existing ABHA against a patient’s name and year of birth. Find ABHA shows masked numbers so the operator can confirm the person, and a capture or OTP then proves the account. Train staff not to copy a masked number into the record.

03 Department by department

What each department shares, and in what form

ABDM groups records into health-information types. Each department maps to one or two of them, and how much work that is depends on what your HMS already stores.

01 / OPD

Consultations and prescriptions

OPConsultation and Prescription. These can be sent in plain fields, such as complaints, vitals, diagnoses and “1-0-1” dosing, and the FHIR is built for the HMS. The doctor’s HPR ID goes on each record.

02 / LABORATORY

Lab reports

DiagnosticReport, with results LOINC-coded where the test name is recognised and the signed PDF attached. The lab page covers LIS integration in detail.

03 / RADIOLOGY

Imaging reports

Sent as the report PDF. Structured imaging reports need DICOM media, which this connector does not build, so a radiology report travels as a document, not as images.

04 / IPD

Discharge summaries

DischargeSummary needs a full FHIR bundle from the HMS. Until the HMS can produce one, a scanned summary can go out as a HealthDocumentRecord, which is a PDF with a title.

Start with what is already digital. A hospital whose OPD and lab are in the HMS but whose discharge papers are printed can share the first two as structured records now, and the third as scanned documents, rather than waiting until everything is structured.

04Sites and HFR

HFR registration is per physical facility. A group with a main campus, two satellite hospitals and a standalone diagnostic centre has four entries, not one. Records are attributed to the site that produced them, and a consent names the facility that holds the record, so a group registered under one entry cannot produce that evidence later.

Registration is done by a facility manager, who signs in with an HPR login. HFR may review a submission before it issues an ID. After the ID is issued, one more step is needed: linking the facility to the software’s bridge. Without that link the facility authenticates normally, every linking call is rejected, and no ABDM error names the cause. The HFR integration page covers the four registration calls.

05Staff and HPR

Doctors who author records need an HPR ID, the identity half of the Healthcare Professional Registry. Council registration and qualifications form a separate professional record, verified by the council and the facility over days. Start collecting HPR IDs early, because a doctor without one cannot sign a prescription that ABDM will accept.

Each site keeps a roster of its practitioners. The HMS picks the signing doctor from it, and a consent request raised by a hospital clinician carries that doctor’s registration number, which the patient sees before deciding.

06Working with your HMS and LIS vendor

Most hospitals do not integrate ABDM themselves. Their HMS or LIS vendor adds it, and a connector sits between that software and the ABDM gateway. Responsibilities split three ways:

  • The hospital: HFR entries, HPR IDs, desk workflow and devices, staff training, and deciding which records to share first.
  • The HMS or LIS vendor: the screens, the mapping from its data model, and the call to publish a record when a visit closes or a report is signed.
  • The connector: the ABDM protocol, callbacks, consent enforcement, FHIR assembly and Fidelius encryption.

The software that makes the ABDM calls must also have passed NHA’s exit process: functional testing, a security audit by a CERT-In empanelled auditor, and committee review. Ask your vendor where theirs stands before you set a go-live date. HMS vendors should read making an HMS ABDM compliant or the HMIS vendor page.

When another provider asks for a patient’s records, the hospital may release only what the patient’s consent covers: the health information types, date range and facility it names. Revoked consent stops release immediately, not at expiry. The connector re-checks each consent at transfer time rather than trusting the request.

Records the hospital receives carry an erase-by date and are purged when it passes. Records travel end to end encrypted with Fidelius (Curve25519 ECDH, HKDF-SHA256, AES-256-GCM), so the national gateway carries data it cannot read. Every ABDM call and consent decision is written to an append-only audit trail. The security page sets out the controls, and what ABDM is explains the network for colleagues who are new to it.

08 Go-live checklist

From decision to the first record in a PHR app

In roughly this order. The HFR and certification steps have the longest waits outside your control, so start them first.

  1. List the sites and search HFR

    One row per physical facility. Check whether any are already registered, perhaps by a previous team or an earlier vendor, before registering anything.

  2. Name a facility manager and register

    They sign in with an HPR login and submit each site. Doctors start creating their own HPR IDs in parallel.

  3. Confirm the software’s certification

    The vendor’s status for each milestone you plan to use. A hospital sharing records needs M1 and M2; fetching history from other providers adds M3.

  4. Link each site to the bridge

    Then activate the facility. Until this step is done, linking calls fail without an ABDM error that names the cause.

  5. Prepare the desk

    Print the counter QRs, fit RD devices if biometric is enabled for you, and brief staff that ABHA is offered, never required.

  6. Pilot one OPD

    Publish consultations for a week, confirm they appear in a patient’s PHR app, then add the lab, then discharge.

Bring ABDM to the systems you already run

Tell us which HMS and LIS you use and how many sites you have, and we will explain what the rollout involves on your side and on your vendor’s.

Talk to us How ABHA works

FAQ Common questions

Frequently asked questions

Is ABDM mandatory for private hospitals?
Participation in ABDM is voluntary for private providers under the national policy. Government schemes such as PM-JAY and CGHS increasingly expect ABHA-linked, ABDM-compliant records from the hospitals they empanel, so check what applies to yours.
What does a hospital need to start with ABDM?
An HFR entry for each site, a facility manager with an HPR login to register it, software that can make the ABDM calls, and a registration desk ready to create or verify ABHA for patients who want one.
Do we have to replace our HMS to be ABDM compliant?
No. ABDM compliance is added beside the systems a hospital already runs. Your HMS or LIS keeps the clinical record; a connector carries the protocol, the encryption and the FHIR conversion.
How do patients without a smartphone get an ABHA at the hospital?
The registration desk can enrol them with an Aadhaar OTP sent to the mobile linked to their Aadhaar, or — where the method is enabled — find and verify an existing ABHA with a fingerprint or iris capture.