National Regulatory Advisory — NHA / CEA / DPDP 2023

The digital mandate for Indian healthcare facilities.

Solo practitioners and private clinics now face a transformed regulatory landscape. Registration is no longer merely administrative — it is a statutory prerequisite for clinical operations, medicolegal safety, and cashless insurance settlement.

Statutory Mandate

Clinical Establishments Act (CEA)

Under the CEA and parallel state acts, operating an unregistered clinical premise is legally non-compliant — regardless of size or patient volume.

Penalty provisions: Escalating fines and cease-and-desist closures for unregistered operation.
DVO cross-check: District Health Authorities verify municipal licenses against the Central HFR registry in real time.

NHA Ecosystem

ABDM, IRDAI & NHCX Integration

Clinics without HFR and HPR identifiers are excluded from national health networks, NHCX digital claim processing, and insurer cashless OPD panels.

IRDAI/NHCX mandate: Insurers reject cashless claims from non-HFR registered facilities.
DHIS payouts: Up to ₹500/day via direct bank transfer for ABHA-linked OPD records.

Patient Data

DPDP Act 2023 & ABHA Standards

Explicit informed consent required before any Aadhaar-based authentication. Raw Aadhaar numbers may never be stored in facility systems.

Zero Aadhaar storage: Numbers used only as in-memory transit — only the 14-digit ABHA number is retained.
Consent gate: Every patient check-in requires digital acknowledgement before OTP generation.

Milestone 2

FHIR R4 & Digital Health Incentives

ABDM M2 requires outpatient consultations to be emitted as HL7 FHIR R4 document bundles via a registered HIP node on the NHA Gateway.

ICD-10 + SNOMED CT: All diagnoses and prescriptions require internationally standardised codes.
₹20 per transaction: Direct benefit transfers for each ABHA-linked FHIR record emitted to the gateway.

Prerequisite Module

Clinical Establishment Profiling

Provide baseline facility details matching your local municipal or state public health registration certificate.

Clinic Commercial Name *

System of Medicine *

Physical Street Address (As on Municipal Certificate) *

State / UT *

District / PIN Code *

Type of Establishment

Contact Number

NHA Infrastructure Setup

Health Facility Registry (HFR) & DVO Tracking

Submit facility master records to the Central HFR and monitor your District Verification Officer approval status.

State CEA / Municipal License Number *

Date of Municipal License Issuance

Clinic Signage / Geo-tagged Exterior Photo

Drag & drop exterior clinic image with visible signboard

PNG, JPG — max 5 MB

DVO Audit TrackerPENDING_DVO_VERIFICATION

Application Tracking Number

APP-HFR-2026-9912

Verification Officer

DVO – Thane / Navi Mumbai

Sandbox Bridge Status

M1 / M2 Connected

Medical Council Validation

Healthcare Professional Registry (HPR)

Bind the licensed practitioner to this facility node in the National HPR. POST /v1/hpr/search-by-registration

Doctor Full Name (As per Medical Council) *

State / National Registration Number *

Registering Medical Council *

HPR Professional Health ID (If issued)

HPR Identity Verified — NMC Registry

Dr. Sameer Sharma · HPR: 91-8832-1928-1123 · MMC Registration cross-matched. All outgoing FHIR bundles will carry a valid practitioner digital signature.

Milestone 2 Operational Loop HIP Gateway Node

ABHA Check-in & FHIR R4 Prescription Generator

Complete OPD workflow: patient ABHA authentication, digital Rx creation, and FHIR R4 bundle dispatch to the ABDM gateway.

Front-Desk Patient Intake (DPDP Compliant)

Patient Mobile Number *

Aadhaar Number (NHA Vault transit only) *

Consultation & Prescription Note

Diagnosis (ICD-10 code + description)

Medicine & Dosage (SNOMED CT mapped)

> System initialized · ClientID: ABDM_PROD_9941

> Host: https://dev.abdm.gov.in/gateway

> Facility: IN270008492 (Sharma Healthcare Clinic)

> Practitioner HPR: 91-8832-1928-1123 linked

> X-CM-ID: sbx | X-HIP-ID: IN270008492

> Awaiting OPD consultation sync...

FHIR R4 Bundle Verified

DHIS Eligible +₹20

Transaction ID: TX-FHIR-20261015-0857
Patient ABHA: patient.demo@abdm
Endpoint: /v0.5/health-information/notify [200 OK]

Digital Health Incentive Scheme (DHIS)

Estimated rebate earned today: 20 ABHA transactions

₹400

ABDM M1 & M2 Compliance Verified

Sharma Healthcare Clinic is registered on the Central HFR, linked to Dr. Sameer Sharma's HPR credentials, and enabled for live FHIR R4 digital prescription exchange via the ABDM HIP gateway.

Facility ID (HFR)IN270008492

Practitioner Registry (HPR)91-8832-1928-1123

CEA License NumberCEA-MH-2024-8849

Annual Retainer Renewal15 October 2027

NHCX / IRDAI Insurance Gateway Whitelisted

DHIS Payout Status Active — ₹20/transaction

ABDM API Reference

All endpoints sourced from the official NHA-ABDM/ABDM-wrapper GitHub repository and the ABDM Community sandbox documentation. Use the ABDM Sandbox environment (X-CM-ID: sbx) during development; switch to abdm for production.

Gateway Base URLhttps://dev.abdm.gov.in/gateway

ABHA / Health ID Basehttps://healthidsbx.abdm.gov.in/api

Dev Services Basehttps://dev.abdm.gov.in/devservice

Sandbox CM IDsbx

Source Repositorygithub.com/NHA-ABDM/ABDM-wrapper

API Spec (Swagger)sandbox.abdm.gov.in/swagger/

1 — Gateway Authentication

POST /v0.5/sessions Get access token (v0.5)

Host: https://dev.abdm.gov.in/gateway · Auth: None (credentials in body) · Headers: Content-Type: application/json

Request Body

// clientId and clientSecret issued after sandbox approval
{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "grantType": "client_credentials"
}

Response (200)

{
  "accessToken": "eyJhbGci...",
  "tokenType": "bearer",
  "expiresIn": 1800
}

NHA-ABDM/ABDM-wrapper README

POST /api/hiecm/gateway/v3/sessions Get access token (v3)

Host: https://dev.abdm.gov.in · Required Headers: REQUEST-ID, TIMESTAMP, X-CM-ID: sbx

Request Body

{
  "clientId": "YOUR_CLIENT_ID",
  "clientSecret": "YOUR_CLIENT_SECRET",
  "grantType": "client_credentials"
}

Notes

// v3 is the latest (2024). Use v0.5 for
// legacy HIP/HIU flows. TIMESTAMP format:
// ISO-8601: 2026-10-15T08:57:00.000Z
// REQUEST-ID: any UUID v4

NHA-ABDM/ABDM-wrapper README (v3 section)

2 — Bridge & HIP Registration

PATCH /devservice/v1/bridges Register callback URL

Host: https://dev.abdm.gov.in · Auth: Bearer <accessToken> · Sandbox only (set via HFR in production)

Request Body

{
  "url": "https://your-clinic-emr.in"
}

Purpose

// Registers the callback URL for async responses
// from the ABDM Gateway. One Client ID = one URL.
// Gateway will POST callbacks here for all
// discovery, linking, consent and data flows.

ABDM Community Docs — Working with APIs

PUT /devservice/v1/bridges/addUpdateServices Register HIP / HIU ID

Host: https://dev.abdm.gov.in · Auth: Bearer <accessToken>

Request Body

[{
  "id": "IN270008492",
  "name": "Sharma Healthcare Clinic",
  "type": "HIP",
  "active": true,
  "alias": ["IN270008492"]
}]

Response (200)

// HTTP 200 = accepted
// Check via GET /v1/bridges/getServices
// type: "HIP" | "HIU" | "HRP"

NHA-ABDM/ABDM-wrapper README

GET /api/hiecm/gateway/v3/bridge-services Check bridge config & facilities

Host: https://dev.abdm.gov.in · Auth: Bearer · Headers: REQUEST-ID, TIMESTAMP, X-CM-ID: sbx

Response

{
  "bridge": {
    "id": "ABDM_PROD_9941",
    "url": "https://your-clinic-emr.in"
  },
  "services": [{
    "id": "IN270008492",
    "type": "HIP",
    "active": true
  }]
}

Use case

// Verify your callback URL and HIP/HIU IDs
// are correctly registered before testing
// async discovery and consent flows.

NHA-ABDM/ABDM-wrapper README (v3)

3 — ABHA Number & Health ID (Milestone 1)

POST /v1/registration/aadhaar/generateOtp Generate Aadhaar OTP

Host: https://healthidsbx.abdm.gov.in/api · Auth: Bearer · DPDP: Consent checkbox must be checked before calling

Request Body

{
  "aadhaar": "<RSA-encrypted 12-digit number>"
  // Encrypt with NHA public key before sending
  // NEVER send plain Aadhaar. See RSA encryption docs.
}

Response (200)

{
  "txnId": "a825f76b-0696-40f3-864c-5a3a5b389a83",
  "mobileNumber": "******9201"
  // OTP sent to Aadhaar-linked mobile
}

ABDM Docs — ABHA via Aadhaar OTP

POST /v1/registration/aadhaar/verifyOTP Verify Aadhaar OTP

Host: https://healthidsbx.abdm.gov.in/api · Auth: Bearer

Request Body

{
  "otp": "<RSA-encrypted 6-digit OTP>",
  "txnId": "a825f76b-0696-40f3-..."
}

Response (200)

{
  "txnId": "a825f76b-...",
  "userToken": "...",
  "healthIdNumber": "91-2094-1182-3918",
  "healthId": "patient.demo@abdm"
}

ABDM Docs — ABHA via Aadhaar OTP

POST /v2/registration/aadhaar/checkAndGenerateMobileOTP Mobile OTP (if mobile ≠ Aadhaar)

Host: https://healthidsbx.abdm.gov.in/api · Auth: Bearer · Required when patient's mobile differs from Aadhaar-linked mobile

Request Body

{
  "mobile": "9820198201",
  "txnId": "a825f76b-..."
}

Response (200)

{
  "txnId": "a825f76b-...",
  "mobileLinked": false
  // OTP sent to provided mobile number
}

ABDM Dev Forum — ABHA API sequence

POST /v2/registration/aadhaar/createHealthIdByAdhaar Create ABHA number

Host: https://healthidsbx.abdm.gov.in/api · Auth: Bearer · Prerequisite: OTP verified in same txnId

Request Body

{
  "txnId": "a825f76b-...",
  "consent": {
    "code": "abha-enrollment",
    "version": "1.4"
  }
}

Response (200)

{
  "healthIdNumber": "91-2094-1182-3918",
  "healthId": "patient.demo@abdm",
  "token": "...",
  "name": "Rajesh Kumar"
}

ABDM Swagger — ABHA Number V1/V2

4 — Healthcare Professional Registry (HPR)

POST /v1/hpr/search-by-registration Verify practitioner by council reg.

Host: https://dev.abdm.gov.in/gateway · Auth: Bearer · X-HIP-ID required

Request Body

{
  "stateCode": "MH",
  "councilName": "MMC",
  "registrationNumber": "MMC-2008-04-1234",
  "name": "Sameer Sharma"
}

Response (200)

{
  "hprId": "91-8832-1928-1123",
  "name": "Dr. Sameer Sharma",
  "qualification": "MBBS",
  "registrationNumber": "MMC-2008-04-1234"
}

ABDM Docs — Health Professional Registry

5 — HIP Care Context Linking (Milestone 2)

POST /v0.5/links/link/add-contexts HIP-initiated care context link

Host: https://dev.abdm.gov.in/gateway · Auth: Bearer · Headers: X-HIP-ID, X-CM-ID: sbx

Request Body

{
  "requestId": "<UUID>",
  "timestamp": "2026-10-15T08:57:00.000Z",
  "link": {
    "accessToken": "<ABHA link token>",
    "patient": {
      "referenceNumber": "PAT-20261015",
      "display": "Rajesh Kumar OPD 15-Oct-2026",
      "careContexts": [{
        "referenceNumber": "CC-RX-20261015-001",
        "display": "OPD Prescription 15-Oct-2026"
      }]
    }
  }
}

Async Callback (on-add-contexts)

// Gateway calls back to your registered URL:
// POST /v0.5/links/link/on-add-contexts
{
  "acknowledgement": {
    "status": "SUCCESS"
  }
}

ABDM Docs — HIP Initiated Linking

POST /v0.5/care-contexts/discover Gateway-initiated patient discovery (callback)

Incoming callback at your registered URL · Headers: X-HIP-ID

Payload received

{
  "patient": {
    "id": "patient.demo@abdm",
    "verifiedIdentifiers": [{
      "type": "MOBILE",
      "value": "9820198201"
    }]
  }
}

Your response back

// POST /v0.5/care-contexts/on-discover back to gateway
{
  "patient": {
    "referenceNumber": "PAT-20261015",
    "display": "Rajesh Kumar",
    "careContexts": [...]
  }
}

ABDM Docs — Discovery & Link

6 — Consent Management (Milestone 2 / 3)

POST /v0.5/consent-requests/init Initiate consent request

Host: https://dev.abdm.gov.in/gateway · Auth: Bearer · X-CM-ID: sbx

Request Body

{
  "requestId": "<UUID>",
  "timestamp": "2026-10-15T08:57:00.000Z",
  "consent": {
    "purpose": { "code": "CAREMGT" },
    "patient": { "id": "patient.demo@abdm" },
    "hiu": { "id": "IN270008492" },
    "hiTypes": ["OPConsultation", "Prescription"],
    "permission": {
      "accessMode": "VIEW",
      "dateRange": {
        "from": "2026-01-01T00:00:00Z",
        "to": "2026-12-31T23:59:59Z"
      },
      "dataEraseAt": "2027-10-15T00:00:00Z",
      "frequency": { "unit": "HOUR", "value": 1, "repeats": 0 }
    }
  }
}

Async callback

// Gateway posts to your callback URL:
// POST /v0.5/consent-requests/on-init
{
  "consentRequest": { "id": "<consent-request-id>" }
}

ABDM Docs — Understanding Consents

7 — Health Information Transfer (FHIR R4)

POST /v0.5/health-information/notify Notify data transfer (HIP → Gateway)

Host: https://dev.abdm.gov.in/gateway · Auth: Bearer · X-HIP-ID, X-CM-ID: sbx

Request Body

{
  "requestId": "<UUID>",
  "timestamp": "2026-10-15T08:57:00.000Z",
  "notification": {
    "consentId": "<from consent artefact>",
    "transactionId": "TX-FHIR-20261015-0857",
    "doneAt": "2026-10-15T08:57:00.000Z",
    "statusNotification": {
      "sessionStatus": "TRANSFERRED",
      "hipId": "IN270008492"
    }
  }
}

Encrypted FHIR payload

// Actual data goes via POST /v0.5/health-information/transfer
// Payload: AES-256-GCM encrypted FHIR R4 Bundle
// Key: ECDH-derived shared secret (Fidelius CLI)
// Profile: nrces.in/ndhm/fhir/r4/StructureDefinition/DocumentBundle

ABDM Docs — Transferring Health Data

POST /v0.5/health-information/transfer Push encrypted FHIR bundle to HIU

Host: https://dev.abdm.gov.in/gateway · Auth: Bearer · Encrypt payload with Fidelius CLI before sending

Request Body

{
  "pageNumber": 1,
  "pageCount": 1,
  "transactionId": "TX-FHIR-20261015-0857",
  "entries": [{
    "content": "<base64 AES-GCM encrypted FHIR bundle>",
    "media": "application/fhir+json",
    "checksum": "<SHA-256 of plaintext>",
    "careContextReference": "CC-RX-20261015-001"
  }],
  "keyMaterial": {
    "cryptoAlg": "ECDH",
    "curve": "Curve25519",
    "dhPublicKey": { ... },
    "nonce": "<12-byte nonce>"
  }
}

Encryption stack

// 1. Generate Curve25519 key pair (HIP)
// 2. Get HIU public key from consent artefact
// 3. ECDH → shared secret
// 4. AES-256-GCM encrypt FHIR bundle
// 5. Base64-encode ciphertext
// Tool: Fidelius CLI (NHA open source)
// Repo: github.com/ProjectOpenH2/Fidelius

ABDM Docs — Encryption & Decryption

8 — Health Facility Registry (HFR)

GET /v1.0/facilities/{facilityId} Check HFR facility status

Host: https://dev.abdm.gov.in/gateway · Auth: Bearer · Replace {facilityId} with HFR ID e.g. IN270008492

Response (200)

{
  "facilityId": "IN270008492",
  "facilityName": "Sharma Healthcare Clinic",
  "status": "PENDING_DVO_VERIFICATION",
  "state": "MH",
  "systemOfMedicine": "Modern Medicine"
}

Status values

"PENDING_DVO_VERIFICATION" // after submission
"PROVISIONAL"          // DVO acknowledged
"VERIFIED"             // fully approved
"REJECTED"             // doc mismatch

ABDM Docs — Health Facility Registry

9 — Scan & Share (V3 Link Token)

POST /api/v3/link/carecontext/send-otp V3 scan & share — send OTP

Host: https://dev.abdm.gov.in · Auth: Bearer · Replaces the v0.5 scan & share flow for new integrations

Request Body

{
  "abhaAddress": "patient.demo@abdm",
  "hipId": "IN270008492",
  "requestId": "<UUID>",
  "timestamp": "2026-10-15T08:57:00.000Z"
}

Follow-up

// After patient enters OTP on ABHA app:
// POST /api/v3/link/carecontext/validate-token
// Then add care context via /v0.5/links/link/add-contexts

ABDM Swagger — V3 Link Token APIs

The digital mandate for Indian healthcare facilities.

Clinical Establishments Act (CEA)

ABDM, IRDAI & NHCX Integration

DPDP Act 2023 & ABHA Standards

FHIR R4 & Digital Health Incentives

Register and certify your clinic in 45 minutes.

Clinical Establishment Profiling

Health Facility Registry (HFR) & DVO Tracking

About asynchronous HFR verification

Healthcare Professional Registry (HPR)

HPR Identity Verified — NMC Registry

NMC Ethics & Prescription Regulations

ABHA Check-in & FHIR R4 Prescription Generator

ABDM M1 & M2 Compliance Verified

ABDM API Reference

Request Body

Response (200)

Request Body

Notes

Request Body

Purpose

Request Body

Response (200)

Response

Use case

Request Body

Response (200)

Request Body

Response (200)

Request Body

Response (200)

Request Body

Response (200)

Request Body

Response (200)

Request Body

Async Callback (on-add-contexts)

Payload received

Your response back

Request Body

Async callback

Request Body

Encrypted FHIR payload

Request Body

Encryption stack

Response (200)

Status values

Request Body

Follow-up