What modern hospital management software must do in India

A hospital management system (HMS) in India has to do more than bill and book beds. It must link patient records through ABDM, support NABH accreditation, answer insurers inside the IRDAI cashless time limits, and protect patient data under the DPDP Act. This guide gives each requirement with a test you can run in a vendor demo.

Last reviewed 8 November 2026 against the sources listed at the end. Regulations change; confirm current requirements with the National Health Authority, NABH, IRDAI and your counsel.

The requirements at a glance

ABDM and ABHA

In its release of 30 May 2026, PIB says the Ayushman Bharat Digital Mission (ABDM) has crossed 900 million ABHA accounts. It describes ABHA as a unique 14-digit digital health identity that lets citizens link, access and share their health records with their consent.

For a hospital, ABDM integration guides from software vendors describe three jobs for the HMS: create and verify ABHA at registration, link visits and share records when the patient consents, and fetch outside records, again with consent. Check the exact scope in the National Health Authority's ABDM documentation. Ask your vendor which of these functions are live in production at hospitals today, and whether your facility is registered in the Health Facility Registry. Do not accept "ABDM-ready" without a demo.

Records move in FHIR formats. According to the list of profiles on its site, the National Resource Centre for EHR Standards (NRCeS) publishes an ABDM FHIR implementation guide that includes OP consultation and discharge summary profiles. Ask whether the HMS stores records in those structures or converts free text at the last step.

NABH and the record

NABH is the accreditation board for hospitals in India. According to the contents listing of its Hospital Accreditation Standards, 6th edition (January 2025), the standards include a chapter on information management. We could not open the chapter text for this guide, so read it with your quality head before the demo. Items a records review is likely to ask for, in our reading and not NABH's wording:

• A complete record per patient, with identity, orders, results and the discharge summary
• Role-based access, so a billing clerk does not open clinical notes
• A log of who viewed or changed a record, and when
• Backups and a tested way to recover them
• Reports you can pull for quality indicators

This list is our reading of what accreditation reviews of records need. Check it against the chapter text for your hospital's category.

Billing that matches how Indian hospitals charge

Hospital bills are not a shopping list. A single admission can mix a surgical package, items outside the package, a deposit, an insurer's share and the patient's share. The software must:

1. Hold package and itemised tariffs, per payer and per ward class.
2. Let the desk add and approve exceptions, with a named approver and a reason.
3. Take deposits and refunds against the right episode.
4. Split a bill between insurer and patient and show each part clearly.
5. Close the day with a cash and card reconciliation that finance can audit.

Test it with your messiest real bill, not the vendor's sample.

TPA and insurance: the clock matters

Clause 15 of IRDAI's Master Circular on Health Insurance Business (29 May 2024) says an insurer shall decide on a cashless authorisation request immediately, but not more than one hour after receipt. Clause 16 says final authorisation is due within three hours of the hospital's discharge authorisation request, and the policyholder must not be made to wait for discharge. If the delay runs past three hours, the additional amount the hospital charges is borne by the insurer from shareholders' funds.

Those limits only help a hospital that sends a complete request on the first attempt. The HMS should:

• Build the pre-authorisation request from the clinical record, not by re-typing
• Attach the documents the insurer asks for
• Show a timer per case, so the desk knows which authorisation is late
• Record every insurer reply against the case
• Reconcile payments from each TPA against the claims raised

The National Health Claims Exchange (NHCX) is a claims exchange linked to ABDM. NRCeS lists an "Implementation Guide for Adoption of FHIR in ABDM and NHCX" on its site. We have not read it, so ask your vendor whether NHCX is live in production for your insurers and how it is tested.

Patient data protection

Patient records are personal data. The DPDP Act, 2023 and the DPDP Rules, 2025 apply. Per Rule 1 of the DPDP Rules, 2025, most duties apply 18 months after notification (13 November 2025).

What the HMS needs to support:

• Notice and consent for uses beyond care, such as promotions, research or sharing with partners. The Act allows processing without consent for medical treatment and for medical emergencies (section 7(f) and (g)), but that does not cover everything a hospital does.
• Children. A child is anyone under 18 (section 2(f)). The Rules (Fourth Schedule) exempt clinical establishments and healthcare professionals from the parental-consent and tracking limits, only to the extent needed to provide health services and protect the child's health.
• Safeguards under Rule 6: encryption or masking, access control, logs, backups, and one year of log retention.
• Breach notice under Rule 7: tell each affected patient without delay, and report to the Data Protection Board, with detail within 72 hours.
• Rights and grievance (Rule 14): a published contact and a grievance route that responds within 90 days.

Ask the vendor to show the consent log, the access log, and what happens when a patient asks for erasure of data the law does not require you to keep. See our DPDP checklist for websites and forms for the full list of duties.

Integration with the systems a hospital already runs

Few hospitals replace everything at once. The new HMS must exchange data with what stays: lab systems, imaging (PACS and RIS), pharmacy, billing and insurer interfaces, and often an older HIS in an acquired unit. Standards help. HL7 messages and FHIR resources are the usual formats. Ask for a live example of a lab result flowing in and a bill flowing out, using your own systems.

For a group with several hospitals on different systems, a patient-facing layer on top can unify booking and records before any HIS is replaced. That is a smaller, safer step than a group-wide replacement. See big bang or phased.

A demo checklist

1. Register a patient with an ABHA, and link the visit.
2. Open a discharge summary and show its access log.
3. Bill an admission with a package, an extra and a discount.
4. Raise a pre-authorisation from the clinical record and show the insurer timer.
5. Show the consent log and the breach-notice procedure.
6. Receive a lab result from another system without re-typing.
7. Restore a backup in front of you.
8. Ask where the data is stored, and who at the vendor can reach it.

Where Brihat fits

Brihat Infotech built a patient platform for a multi-city hospital network, integrated with three HIS vendors. Start a conversation.

Sources and primary texts

1. PIB: ABDM crosses 900 million ABHA accounts, 30 May 2026
2. IRDAI Master Circular on Health Insurance Business, 29 May 2024 (PDF)
3. FHIR Implementation Guide for ABDM, profiles (NRCeS)
4. Implementation Guide for Adoption of FHIR in ABDM and NHCX (NRCeS, PDF)
5. NABH Hospital Accreditation Standards, 6th edition, January 2025 (PDF)
6. Digital Personal Data Protection Act, 2023 (MeitY, PDF)
7. Digital Personal Data Protection Rules, 2025, Gazette of India (MeitY, PDF)