What ABDM actually means for a small clinic

Patients have started arriving with ABHA numbers. Vendors have started calling to say your clinic needs to be "ABDM compliant". Most of what is written about this is written by people selling software, and it tends to overstate how much you are obliged to do.

Here is what ABDM is, what you actually have to do about it, and what to ask anyone who tells you they have it solved.

This page is about the network. If your question is about the prescription itself — whether you can send it on WhatsApp, or what it must carry — those are covered separately: sending it on WhatsApp and what a prescription must carry.

The four pieces

ABHA — the Ayushman Bharat Health Account. A 14-digit number that identifies a patient across the health system. This is the piece patients have; many already do.

HPR — the Healthcare Professionals Registry. Registers you, the doctor.

HFR — the Health Facility Registry. Registers your clinic as a facility and gives it an ID.

HIP and HIU — a Health Information Provider is a facility that can push records into the network. A Health Information User is one that can request records from it, with the patient's consent. Most clinics are conceptually both.

The point of all of it is that a patient's records stop living in one clinic's files. With the patient's consent, a doctor at any participating facility can see what another doctor prescribed, and the patient carries their own history rather than a plastic bag of old slips.

Do you actually have to do anything?

Not to run a private clinic. HFR registration is voluntary in that sense. You can practise, prescribe and bill without ever touching ABDM.

Where it stops being optional is when you want something built on ABDM rails. Empanelment under Ayushman Bharat PM-JAY and similar government schemes asks for a facility ID. Insurance and corporate tie-ups increasingly ask. Accreditation standards are moving the same way.

So the accurate statement is not that ABDM is mandatory. It is that the things you might want to be part of are increasingly built on top of it, and the number of those grows every year.

What registering involves

Both registries are run by the National Health Authority, both are free, and both are self-service with Aadhaar-based verification.

The doctor registers first. You create an HPR profile and get an HPID. Self-declaration typically takes under half an hour.

Then the facility. Sign in with your HPID at the HFR portal and choose the facility-manager role. Many clinics were pre-loaded from older directories — if yours appears, you claim it rather than creating it. Otherwise you register a new facility with its type, ownership, address, timings and services, and submit for verification.

Verified facilities are issued a QR code that can be displayed in the clinic, so a patient can confirm they are at a registered facility.

There have been incentive schemes paying facilities per ABHA-linked transaction. The terms and the qualifying period change; check the current position on the ABDM site rather than on a vendor's page.

What changes once you are on it

Registration by itself changes very little. What it enables is the thing worth understanding.

A patient with an ABHA number can consent to their records being linked to it. Once linked, those records can be requested by another facility they visit — with a specific, time-bound consent that the patient grants and can revoke. The consultation you did last month can be visible to the specialist they see next month, if they choose to allow it.

That is the whole idea. Not a government database of medical records, but a consent-gated way for records to follow the patient.

What to ask a vendor who says they are ABDM compliant

This is the part worth reading carefully, because "ABDM compliant" is not a defined status and is used very loosely.

Are you registered as a HIP, and in sandbox or production? Every integrator starts in the NHA sandbox. Sandbox access is not production access. A vendor operating in sandbox cannot move a real patient's records, whatever the brochure says.

Which milestones have you completed end to end, with real data? The integration is certified in milestones — identity, then record linkage, then consented exchange. "We have built M2" and "M2 works in production" are different claims.

Has your security audit been completed? Exiting the sandbox requires a security audit by a CERT-In empanelled auditor. Ask whether theirs is done, in progress, or not started.

Does a record actually reach the patient's app? The test is not whether the software can create an ABHA-linked record. It is whether a patient can open a health app of their choosing and see what you wrote.

If a vendor cannot answer those four questions plainly, the compliance claim is marketing.

This page describes the ABDM ecosystem in general terms and is not legal or regulatory advice. The National Health Authority's own materials at abdm.gov.in are the authoritative source; registration requirements and incentive schemes change.