National Regulatory Advisory — NHA / CEA / DPDP 2023

The digital mandate for Indian healthcare facilities.

Solo practitioners and private clinics now face a transformed regulatory landscape. Registration is no longer merely administrative — it is a statutory prerequisite for clinical operations, medicolegal safety, and cashless insurance settlement.

Statutory Mandate

Clinical Establishments Act (CEA)

Under the CEA and parallel state acts, operating an unregistered clinical premise is legally non-compliant — regardless of size or patient volume.

  • Penalty provisions: Escalating fines and cease-and-desist closures for unregistered operation.
  • DVO cross-check: District Health Authorities verify municipal licenses against the Central HFR registry in real time.
NHA Ecosystem

ABDM, IRDAI & NHCX Integration

Clinics without HFR and HPR identifiers are excluded from national health networks, NHCX digital claim processing, and insurer cashless OPD panels.

  • IRDAI/NHCX mandate: Insurers reject cashless claims from non-HFR registered facilities.
  • DHIS payouts: Up to ₹500/day via direct bank transfer for ABHA-linked OPD records.
Patient Data

DPDP Act 2023 & ABHA Standards

Explicit informed consent required before any Aadhaar-based authentication. Raw Aadhaar numbers may never be stored in facility systems.

  • Zero Aadhaar storage: Numbers used only as in-memory transit — only the 14-digit ABHA number is retained.
  • Consent gate: Every patient check-in requires digital acknowledgement before OTP generation.
Milestone 2

FHIR R4 & Digital Health Incentives

ABDM M2 requires outpatient consultations to be emitted as HL7 FHIR R4 document bundles via a registered HIP node on the NHA Gateway.

  • ICD-10 + SNOMED CT: All diagnoses and prescriptions require internationally standardised codes.
  • ₹20 per transaction: Direct benefit transfers for each ABHA-linked FHIR record emitted to the gateway.

Register and certify your clinic in 45 minutes.

The guided compliance wizard walks your field agent and doctor through HFR registration, HPR binding, front-desk ABHA simulation, and a live FHIR R4 prescription test — all on the NHA Sandbox.

Prerequisite Module

Clinical Establishment Profiling

Provide baseline facility details matching your local municipal or state public health registration certificate.

NHA Infrastructure Setup

Health Facility Registry (HFR) & DVO Tracking

Submit facility master records to the Central HFR and monitor your District Verification Officer approval status.

Drag & drop exterior clinic image with visible signboard

PNG, JPG — max 5 MB
DVO Audit TrackerPENDING_DVO_VERIFICATION
Application Tracking Number
APP-HFR-2026-9912
Verification Officer
DVO – Thane / Navi Mumbai
Sandbox Bridge Status
M1 / M2 Connected
Medical Council Validation

Healthcare Professional Registry (HPR)

Bind the licensed practitioner to this facility node in the National HPR. POST /v1/hpr/search-by-registration

HPR Identity Verified — NMC Registry

Dr. Sameer Sharma · HPR: 91-8832-1928-1123 · MMC Registration cross-matched. All outgoing FHIR bundles will carry a valid practitioner digital signature.

Milestone 2 Operational Loop HIP Gateway Node

ABHA Check-in & FHIR R4 Prescription Generator

Complete OPD workflow: patient ABHA authentication, digital Rx creation, and FHIR R4 bundle dispatch to the ABDM gateway.

Front-Desk Patient Intake (DPDP Compliant)
Consultation & Prescription Note
NHA Sandbox Bridge Terminal
● READY

> System initialized · ClientID: ABDM_PROD_9941

> Host: https://dev.abdm.gov.in/gateway

> Facility: IN270008492 (Sharma Healthcare Clinic)

> Practitioner HPR: 91-8832-1928-1123 linked

> X-CM-ID: sbx | X-HIP-ID: IN270008492

> Awaiting OPD consultation sync...

FHIR R4 Bundle Verified
DHIS Eligible +₹20
Transaction ID: TX-FHIR-20261015-0857
Patient ABHA: patient.demo@abdm
Endpoint: /v0.5/health-information/notify [200 OK]
Digital Health Incentive Scheme (DHIS)
Estimated rebate earned today: 20 ABHA transactions
₹400

ABDM M1 & M2 Compliance Verified

Sharma Healthcare Clinic is registered on the Central HFR, linked to Dr. Sameer Sharma's HPR credentials, and enabled for live FHIR R4 digital prescription exchange via the ABDM HIP gateway.

Facility ID (HFR)IN270008492
Practitioner Registry (HPR)91-8832-1928-1123
CEA License NumberCEA-MH-2024-8849
Annual Retainer Renewal15 October 2027
NHCX / IRDAI Insurance Gateway Whitelisted
DHIS Payout Status Active — ₹20/transaction

ABDM API Reference

All endpoints sourced from the official NHA-ABDM/ABDM-wrapper GitHub repository and the ABDM Community sandbox documentation. Use the ABDM Sandbox environment (X-CM-ID: sbx) during development; switch to abdm for production.

https://dev.abdm.gov.in/gateway
https://healthidsbx.abdm.gov.in/api
https://dev.abdm.gov.in/devservice
sbx
github.com/NHA-ABDM/ABDM-wrapper
sandbox.abdm.gov.in/swagger/
1 — Gateway Authentication
POST /v0.5/sessions Get access token (v0.5)
Host: https://dev.abdm.gov.in/gateway  ·  Auth: None (credentials in body)  ·  Headers: Content-Type: application/json

Request Body

// clientId and clientSecret issued after sandbox approval { "clientId": "YOUR_CLIENT_ID", "clientSecret": "YOUR_CLIENT_SECRET", "grantType": "client_credentials" }

Response (200)

{ "accessToken": "eyJhbGci...", "tokenType": "bearer", "expiresIn": 1800 }
NHA-ABDM/ABDM-wrapper README
POST /api/hiecm/gateway/v3/sessions Get access token (v3)
Host: https://dev.abdm.gov.in  ·  Required Headers: REQUEST-ID, TIMESTAMP, X-CM-ID: sbx

Request Body

{ "clientId": "YOUR_CLIENT_ID", "clientSecret": "YOUR_CLIENT_SECRET", "grantType": "client_credentials" }

Notes

// v3 is the latest (2024). Use v0.5 for // legacy HIP/HIU flows. TIMESTAMP format: // ISO-8601: 2026-10-15T08:57:00.000Z // REQUEST-ID: any UUID v4
NHA-ABDM/ABDM-wrapper README (v3 section)
2 — Bridge & HIP Registration
PATCH /devservice/v1/bridges Register callback URL
Host: https://dev.abdm.gov.in  ·  Auth: Bearer <accessToken>  ·  Sandbox only (set via HFR in production)

Request Body

{ "url": "https://your-clinic-emr.in" }

Purpose

// Registers the callback URL for async responses // from the ABDM Gateway. One Client ID = one URL. // Gateway will POST callbacks here for all // discovery, linking, consent and data flows.
ABDM Community Docs — Working with APIs
PUT /devservice/v1/bridges/addUpdateServices Register HIP / HIU ID
Host: https://dev.abdm.gov.in  ·  Auth: Bearer <accessToken>

Request Body

[{ "id": "IN270008492", "name": "Sharma Healthcare Clinic", "type": "HIP", "active": true, "alias": ["IN270008492"] }]

Response (200)

// HTTP 200 = accepted // Check via GET /v1/bridges/getServices // type: "HIP" | "HIU" | "HRP"
NHA-ABDM/ABDM-wrapper README
GET /api/hiecm/gateway/v3/bridge-services Check bridge config & facilities
Host: https://dev.abdm.gov.in  ·  Auth: Bearer  ·  Headers: REQUEST-ID, TIMESTAMP, X-CM-ID: sbx

Response

{ "bridge": { "id": "ABDM_PROD_9941", "url": "https://your-clinic-emr.in" }, "services": [{ "id": "IN270008492", "type": "HIP", "active": true }] }

Use case

// Verify your callback URL and HIP/HIU IDs // are correctly registered before testing // async discovery and consent flows.
NHA-ABDM/ABDM-wrapper README (v3)
3 — ABHA Number & Health ID (Milestone 1)
POST /v1/registration/aadhaar/generateOtp Generate Aadhaar OTP
Host: https://healthidsbx.abdm.gov.in/api  ·  Auth: Bearer  ·  DPDP: Consent checkbox must be checked before calling

Request Body

{ "aadhaar": "<RSA-encrypted 12-digit number>" // Encrypt with NHA public key before sending // NEVER send plain Aadhaar. See RSA encryption docs. }

Response (200)

{ "txnId": "a825f76b-0696-40f3-864c-5a3a5b389a83", "mobileNumber": "******9201" // OTP sent to Aadhaar-linked mobile }
ABDM Docs — ABHA via Aadhaar OTP
POST /v1/registration/aadhaar/verifyOTP Verify Aadhaar OTP
Host: https://healthidsbx.abdm.gov.in/api  ·  Auth: Bearer

Request Body

{ "otp": "<RSA-encrypted 6-digit OTP>", "txnId": "a825f76b-0696-40f3-..." }

Response (200)

{ "txnId": "a825f76b-...", "userToken": "...", "healthIdNumber": "91-2094-1182-3918", "healthId": "patient.demo@abdm" }
ABDM Docs — ABHA via Aadhaar OTP
POST /v2/registration/aadhaar/checkAndGenerateMobileOTP Mobile OTP (if mobile ≠ Aadhaar)
Host: https://healthidsbx.abdm.gov.in/api  ·  Auth: Bearer  ·  Required when patient's mobile differs from Aadhaar-linked mobile

Request Body

{ "mobile": "9820198201", "txnId": "a825f76b-..." }

Response (200)

{ "txnId": "a825f76b-...", "mobileLinked": false // OTP sent to provided mobile number }
ABDM Dev Forum — ABHA API sequence
POST /v2/registration/aadhaar/createHealthIdByAdhaar Create ABHA number
Host: https://healthidsbx.abdm.gov.in/api  ·  Auth: Bearer  ·  Prerequisite: OTP verified in same txnId

Request Body

{ "txnId": "a825f76b-...", "consent": { "code": "abha-enrollment", "version": "1.4" } }

Response (200)

{ "healthIdNumber": "91-2094-1182-3918", "healthId": "patient.demo@abdm", "token": "...", "name": "Rajesh Kumar" }
ABDM Swagger — ABHA Number V1/V2
4 — Healthcare Professional Registry (HPR)
POST /v1/hpr/search-by-registration Verify practitioner by council reg.
Host: https://dev.abdm.gov.in/gateway  ·  Auth: Bearer  ·  X-HIP-ID required

Request Body

{ "stateCode": "MH", "councilName": "MMC", "registrationNumber": "MMC-2008-04-1234", "name": "Sameer Sharma" }

Response (200)

{ "hprId": "91-8832-1928-1123", "name": "Dr. Sameer Sharma", "qualification": "MBBS", "registrationNumber": "MMC-2008-04-1234" }
ABDM Docs — Health Professional Registry
5 — HIP Care Context Linking (Milestone 2)
POST /v0.5/links/link/add-contexts HIP-initiated care context link
Host: https://dev.abdm.gov.in/gateway  ·  Auth: Bearer  ·  Headers: X-HIP-ID, X-CM-ID: sbx

Request Body

{ "requestId": "<UUID>", "timestamp": "2026-10-15T08:57:00.000Z", "link": { "accessToken": "<ABHA link token>", "patient": { "referenceNumber": "PAT-20261015", "display": "Rajesh Kumar OPD 15-Oct-2026", "careContexts": [{ "referenceNumber": "CC-RX-20261015-001", "display": "OPD Prescription 15-Oct-2026" }] } } }

Async Callback (on-add-contexts)

// Gateway calls back to your registered URL: // POST /v0.5/links/link/on-add-contexts { "acknowledgement": { "status": "SUCCESS" } }
ABDM Docs — HIP Initiated Linking
POST /v0.5/care-contexts/discover Gateway-initiated patient discovery (callback)
Incoming callback at your registered URL  ·  Headers: X-HIP-ID

Payload received

{ "patient": { "id": "patient.demo@abdm", "verifiedIdentifiers": [{ "type": "MOBILE", "value": "9820198201" }] } }

Your response back

// POST /v0.5/care-contexts/on-discover back to gateway { "patient": { "referenceNumber": "PAT-20261015", "display": "Rajesh Kumar", "careContexts": [...] } }
ABDM Docs — Discovery & Link
6 — Consent Management (Milestone 2 / 3)
POST /v0.5/consent-requests/init Initiate consent request
Host: https://dev.abdm.gov.in/gateway  ·  Auth: Bearer  ·  X-CM-ID: sbx

Request Body

{ "requestId": "<UUID>", "timestamp": "2026-10-15T08:57:00.000Z", "consent": { "purpose": { "code": "CAREMGT" }, "patient": { "id": "patient.demo@abdm" }, "hiu": { "id": "IN270008492" }, "hiTypes": ["OPConsultation", "Prescription"], "permission": { "accessMode": "VIEW", "dateRange": { "from": "2026-01-01T00:00:00Z", "to": "2026-12-31T23:59:59Z" }, "dataEraseAt": "2027-10-15T00:00:00Z", "frequency": { "unit": "HOUR", "value": 1, "repeats": 0 } } } }

Async callback

// Gateway posts to your callback URL: // POST /v0.5/consent-requests/on-init { "consentRequest": { "id": "<consent-request-id>" } }
ABDM Docs — Understanding Consents
7 — Health Information Transfer (FHIR R4)
POST /v0.5/health-information/notify Notify data transfer (HIP → Gateway)
Host: https://dev.abdm.gov.in/gateway  ·  Auth: Bearer  ·  X-HIP-ID, X-CM-ID: sbx

Request Body

{ "requestId": "<UUID>", "timestamp": "2026-10-15T08:57:00.000Z", "notification": { "consentId": "<from consent artefact>", "transactionId": "TX-FHIR-20261015-0857", "doneAt": "2026-10-15T08:57:00.000Z", "statusNotification": { "sessionStatus": "TRANSFERRED", "hipId": "IN270008492" } } }

Encrypted FHIR payload

// Actual data goes via POST /v0.5/health-information/transfer // Payload: AES-256-GCM encrypted FHIR R4 Bundle // Key: ECDH-derived shared secret (Fidelius CLI) // Profile: nrces.in/ndhm/fhir/r4/StructureDefinition/DocumentBundle
ABDM Docs — Transferring Health Data
POST /v0.5/health-information/transfer Push encrypted FHIR bundle to HIU
Host: https://dev.abdm.gov.in/gateway  ·  Auth: Bearer  ·  Encrypt payload with Fidelius CLI before sending

Request Body

{ "pageNumber": 1, "pageCount": 1, "transactionId": "TX-FHIR-20261015-0857", "entries": [{ "content": "<base64 AES-GCM encrypted FHIR bundle>", "media": "application/fhir+json", "checksum": "<SHA-256 of plaintext>", "careContextReference": "CC-RX-20261015-001" }], "keyMaterial": { "cryptoAlg": "ECDH", "curve": "Curve25519", "dhPublicKey": { ... }, "nonce": "<12-byte nonce>" } }

Encryption stack

// 1. Generate Curve25519 key pair (HIP) // 2. Get HIU public key from consent artefact // 3. ECDH → shared secret // 4. AES-256-GCM encrypt FHIR bundle // 5. Base64-encode ciphertext // Tool: Fidelius CLI (NHA open source) // Repo: github.com/ProjectOpenH2/Fidelius
ABDM Docs — Encryption & Decryption
8 — Health Facility Registry (HFR)
GET /v1.0/facilities/{facilityId} Check HFR facility status
Host: https://dev.abdm.gov.in/gateway  ·  Auth: Bearer  ·  Replace {facilityId} with HFR ID e.g. IN270008492

Response (200)

{ "facilityId": "IN270008492", "facilityName": "Sharma Healthcare Clinic", "status": "PENDING_DVO_VERIFICATION", "state": "MH", "systemOfMedicine": "Modern Medicine" }

Status values

"PENDING_DVO_VERIFICATION" // after submission "PROVISIONAL" // DVO acknowledged "VERIFIED" // fully approved "REJECTED" // doc mismatch
ABDM Docs — Health Facility Registry
9 — Scan & Share (V3 Link Token)
POST /api/v3/link/carecontext/send-otp V3 scan & share — send OTP
Host: https://dev.abdm.gov.in  ·  Auth: Bearer  ·  Replaces the v0.5 scan & share flow for new integrations

Request Body

{ "abhaAddress": "patient.demo@abdm", "hipId": "IN270008492", "requestId": "<UUID>", "timestamp": "2026-10-15T08:57:00.000Z" }

Follow-up

// After patient enters OTP on ABHA app: // POST /api/v3/link/carecontext/validate-token // Then add care context via /v0.5/links/link/add-contexts
ABDM Swagger — V3 Link Token APIs