ABDM Compliance for Hospitals: What It Actually Requires

Compliance is the software vendor’s job, then yours

A hospital cannot become ABDM compliant on its own. The certification is granted to the software, by the National Health Authority, after the vendor builds against the sandbox and passes a functional review. What the hospital does is choose certified software and register its facility.

This is worth knowing before you buy, because "ABDM ready" and "ABDM certified" are not the same claim. Ready means the vendor intends to build it. Certified means the NHA has tested it and issued a production client ID. Ask which one you are being sold, and ask for the bridge ID.

The four milestones, in plain terms

M1 is ABHA creation — your reception can create a patient’s national health ID from an Aadhaar or a mobile number, at the counter, in under a minute.

M2 is record linking. When a doctor writes a prescription or a lab publishes a report, that record is attached to the patient’s ABHA so it exists beyond your hospital. This is the milestone that takes real engineering, because records must be sent as FHIR documents with the right coding.

M3 is consent-based sharing. Another hospital requests a patient’s history, the patient approves it on their phone, and the records move — encrypted, with the consent artefact recorded on both sides.

M4 is the Health Facility Registry and Healthcare Professional Registry, letting your software register facilities and practitioners directly. This one additionally requires a security certificate from a CERT-In empanelled agency.

How long it takes

Sandbox access is quick. Building and passing M1 to M3 is a matter of months of engineering, not weeks, and the review cycle with the ABHA team adds more. M4 takes longer still because of the CERT-In requirement.

For a hospital, none of that matters — you inherit the vendor’s certification. What matters is whether the vendor has already finished, or is asking you to wait.

What it changes at the counter

Registration stops being a paper form. Reception scans an ABHA or creates one, and the patient’s existing records — from any ABDM-connected hospital — become requestable with the patient’s consent.

For a Tier-2 or Tier-3 hospital, the practical gain is referrals. A patient arriving from a district hospital brings their history with them instead of a plastic bag of papers.