Hospital information systems and digital health (ABDM and ABHA)

In short

A hospital information system (HIS) is the integrated software that records and moves a hospital's clinical, administrative and financial data — registration, admission, orders, results, pharmacy, billing, discharge and MIS — so that one patient identity carries one longitudinal record. Digital health extends that record beyond the hospital walls: the Ayushman Bharat Digital Mission (ABDM, launched 27 September 2021, run by the National Health Authority) gives every citizen an ABHA number and links verified facilities, professionals and health records through a federated, consent-driven network. BHA/BBA Hospital Management syllabi examine HIS modules, HIS implementation steps, interoperability standards (HL7 FHIR, SNOMED CT, LOINC, DICOM), the ABDM building blocks and the legal position on data privacy and telemedicine. It is applied daily by hospital IT and operations teams at Apollo, Fortis, Max, Manipal, Narayana Health, AIIMS and district hospitals, and by HIS vendors and NABH/NABL accreditation teams. Interview rounds for Hospital Administrator, HIS/EMR implementation executive and quality-coordinator roles lean heavily on this topic.

Explained

What an HIS is, and how its modules fit together

• HIS / HMIS: a single database serving clinical care, operations, finance and reporting. EMR is the clinical record inside one organisation; EHR is the patient-centred record shared across organisations; PHR is the copy the patient controls (in ABDM, the ABHA mobile app).
• Patient administration (front office): registration creating a unique hospital identifier (UHID), appointments, OP billing, admission-discharge-transfer (ADT), bed management, insurance/TPA and Ayushman Bharat PM-JAY claim desk.
• Clinical modules: CPOE (computerised physician order entry), e-prescription, nursing notes, OT scheduling, ICU charting, blood bank, immunisation, discharge summary, clinical decision support (allergy and interaction alerts).
• Diagnostics: LIS (laboratory — sample barcoding, worklists, analyser interfacing, auto-verification), RIS (radiology workflow and reporting) and PACS (image storage and viewing, DICOM format).
• Support and back office: pharmacy and stores with batch/expiry, CSSD tracking, diet orders, biomedical equipment and asset registers, HR and payroll, finance, MRD/coding, and the MIS/dashboard layer.
• Architecture layers: database → application/business logic → presentation (web/thick client/mobile); deployed on-premises, hosted (private cloud) or SaaS. A three-tier web architecture is now the norm; on-premise is still chosen where connectivity is unreliable.
• Integration engine / middleware: translates messages between HIS, LIS, PACS, analysers and ABDM gateway so that each system need not know the others' formats.

Types, classifications and selection

• By scope: departmental/best-of-breed (separate LIS, PACS, pharmacy, stitched by interfaces) versus enterprise/single-vendor suite. Best-of-breed gives depth, the suite gives one identity and one bill.
• By ownership of code: proprietary (Apollo's internal HIS, Birlamedisoft, Insta by Practo, Attune, Napier, Medha, KareXpert, Oracle Health/Cerner, Epic in a few large groups) versus government/open-source (eHospital by NIC, e-Sushrut, DHIS2 for public-health reporting, OpenMRS, Bahmni, HMIS in several state programmes).
• By level of care: PHC/CHC packages (IPHS reporting, ANM registers), secondary hospital HIS, tertiary/multi-specialty HIS with research and teaching modules.
• Selection criteria: functional fit, standards compliance (FHIR, ABDM M1/M2/M3 certification), uptime and support SLA, scalability, data migration path, total cost of ownership (licence + implementation + AMC, typically 15–20% of licence a year), and exit/data-export rights.
• Costing models: perpetual licence per concurrent user/bed, subscription per bed per month, or per-transaction. Figures vary widely by vendor and are negotiated — do not quote a single market rate as fixed.

Implementation life cycle (SDLC applied to a hospital)

1. Feasibility and needs analysis — process mapping of every department, volumes, forms inventory, gap list; constitute an HIS steering committee with clinicians, not only IT.
2. Requirement specification (SRS/RFP) and vendor evaluation; demo scripts drawn from the hospital's own workflows.
3. Design — master data (service master, tariff, item master, doctor master), role-based access matrix, report formats.
4. Infrastructure — servers/cloud, network (structured cabling, Wi-Fi, redundant ISP), UPS and DG backup, barcode/thermal printers, kiosks, biometric devices, data-centre security.
5. Configuration, interfacing and data migration; build test cases.
6. Testing — unit, integration, UAT by department users, load test, security test.
7. Training and super-users (one per shift per department); written SOPs.
8. Go-live — strategies: big bang (all modules at once, risky, short pain), phased/modular (registration → billing → pharmacy → clinical), parallel run (paper and system together, safest but doubles work), pilot in one department.
9. Post-implementation — hypercare support, change management, downtime (business continuity) forms, periodic audit, version upgrades and benefit measurement.
10. Common failure causes: poor master data, no clinician ownership, inadequate training, workflow copied from paper without redesign, no downtime plan, and underestimating data migration.

ABDM: the national digital health building blocks

• Policy trail: National Health Policy 2017 → EHR Standards for India (2016 revision) notified by MoHFW → National Digital Health Blueprint (2019) → NDHM pilot in UTs (15 August 2020) → ABDM nationwide from 27 September 2021, implemented by the National Health Authority (NHA), the same body that runs AB PM-JAY.
• ABHA number: a 14-digit unique health account number, created with Aadhaar, driving licence or mobile; voluntary, and care cannot be denied for not having one.
• ABHA address: a self-declared handle like name@abdm (or @sbx in sandbox) used to share and receive records — the "UPI ID" of health data. One ABHA number can have more than one ABHA address.
• Health Facility Registry (HFR): verified directory of hospitals, clinics, labs, pharmacies — public and private. Healthcare Professionals Registry (HPR): verified directory of doctors, nurses and allied professionals.
• Health Information Provider (HIP): an entity that creates records (hospital, lab, radiology centre). Health Information User (HIU): an entity that requests records (another hospital, insurer, doctor). Health Repository Provider (HRP): stores records for HIPs.
• Consent Manager / HIE-CM (Health Information Exchange and Consent Manager): routes consent requests; a consent artefact carries purpose, data range, data types, the HIU, and an expiry. Data flows only after patient consent and is federated — ABDM does not run a central store of records.
• Unified Health Interface (UHI): open network for discovery and booking of services (teleconsultation, lab tests, ambulance) — the "ONDC for health".
• Scan and Share: OPD registration by scanning a facility's QR code and sharing the ABHA profile, replacing queue-based form filling; widely deployed in government hospitals.
• Other components: ABDM sandbox for developers; M1/M2/M3 milestone certification for software (M1 = ABHA creation/verification, M2 = linking records as HIP, M3 = fetching records as HIU); Drug Registry and Health Claims Exchange (HCX) for standardised insurance claims.
• Digital Health Incentive Scheme (DHIS): NHA incentives to hospitals and labs for creating/linking digital records — amounts and eligibility windows have been revised more than once, so check the current NHA circular rather than relying on a remembered figure.

Standards, coding and interoperability

• Messaging/exchange: HL7 v2.x (pipe-delimited messages such as ADT^A01 admission, ORM order, ORU result), HL7 CDA (documents) and HL7 FHIR R4 — resource-and-REST based, and the standard ABDM mandates.
• Clinical terminology: SNOMED CT for clinical findings and procedures (India has a national licence through the NRC-SNOMED CT at MoHFW, free for Indian users), LOINC for lab and clinical observations, ICD-10 (WHO) for morbidity/mortality coding and reporting, ICD-11 adopted by WHO from 1 January 2022 with Indian transition ongoing, ICHI for interventions, and the NDHM/ABDM-aligned Indian drug and procedure codes.
• Imaging: DICOM for image format and transfer; IHE profiles describe how systems should work together.
• Identifiers and security: ABHA number, UHID, Aadhaar-based e-KYC, digital signatures under the Information Technology Act, 2000, and audit trails.
• Interoperability levels: foundational (data moves), structural (format understood), semantic (meaning understood — needs SNOMED/LOINC), organisational (governance and consent in place).
• Why standards matter in exams: without them a referral letter, a lab result and a discharge summary cannot be read by the receiving system; the ABDM network is only as useful as the coding behind it.

Law, privacy, telemedicine and quality

• Digital Personal Data Protection Act, 2023 (DPDP Act): health data is personal data; a hospital is a Data Fiduciary. Under the DPDP Rules, 2025, the operative Data Fiduciary duties — notice, consent, breach intimation and erasure — and the omission of section 43A of the IT Act apply only from 13 May 2027; until then section 43A of the IT Act, 2000 and the SPDI Rules, 2011 (which classify medical records and health condition as sensitive personal data) continue to govern. Penalties under the DPDP Act go up to ₹250 crore for failure to take reasonable security safeguards.
• CERT-In directions (2022): reportable cyber incidents must be intimated within 6 hours; logs to be maintained for 180 days — relevant after the ransomware attacks on Indian hospital systems.
• Telemedicine Practice Guidelines, 2020 (Appendix to the then IMC Professional Conduct Regulations, now carried under the National Medical Commission framework): define first consult versus follow-up, modes (video/audio/text), the three drug lists (O, A, B and a prohibited list), mandatory identification of both doctor and patient, and the requirement to maintain records of the teleconsultation. eSanjeevani is the government's national telemedicine platform (OPD and hub-and-spoke doctor-to-doctor models).
• Medical records retention: the long-standing regulation (MCI Code of Ethics, 2002, reg. 1.3.1) required in-patient ("indoor patient") records for 3 years from commencement of treatment, and medico-legal records for the period directed; practice in NABH hospitals is commonly 5–10 years (and up to 21 years or more for obstetric/paediatric and medico-legal files). Retention periods vary by state and by regulation — state the policy source rather than a single number.
• Clinical Establishments (Registration and Regulation) Act, 2010 requires maintenance of records and reporting in adopting states. NABH 5th/6th edition standards expect defined data management, backup, information security and (increasingly) ABDM linkage; NABL accreditation of labs expects LIS traceability.
• ABDM and insurance: HCX standardises claims between hospitals, insurers and TPAs; PM-JAY uses its own transaction management system (TMS) with hospital empanelment and pre-authorisation workflows.

Key points

• HIS - integrated hospital software covering clinical, administrative, financial and MIS functions on one patient identity.
• EMR vs EHR vs PHR - record within one hospital vs shared across providers vs patient-controlled copy.
• UHID - hospital's own unique patient number; ABHA number - 14-digit national health account number.
• ABHA address - user@abdm handle used to push and pull records; multiple addresses per ABHA number allowed.
• ABDM - launched 27 September 2021, implemented by the National Health Authority; voluntary for citizens.
• Federated architecture - ABDM stores no central health records; data sits with HIPs and moves on consent.
• HIP / HIU / HRP / HIE-CM - creates records / requests records / stores records / routes consent.
• HFR and HPR - verified registries of facilities and of professionals, prerequisites for joining the network.
• UHI - open interoperable network for discovering and booking health services; Scan and Share - QR-based OPD registration.
• M1, M2, M3 - ABDM software certification milestones: ABHA creation, HIP linking, HIU fetching.
• HL7 FHIR R4 - the exchange standard ABDM mandates; HL7 v2 still runs most analyser and ADT interfaces.
• SNOMED CT / LOINC / ICD-10-11 / DICOM - clinical terms / lab observations / disease classification / medical images.
• Semantic interoperability - the receiving system understands the meaning, not just the format.
• Go-live strategies - big bang, phased, parallel run, pilot; parallel run is safest, costliest in effort.
• Downtime protocol - pre-printed forms, offline registration numbers and back-entry rules; a mandatory part of any HIS plan.
• DPDP Act, 2023 with Rules, 2025 - fiduciary duties effective 13 May 2027; until then IT Act s.43A and SPDI Rules, 2011 apply; penalty up to ₹250 crore.
• CERT-In - cyber incident reporting within 6 hours, logs retained 180 days.
• Telemedicine Practice Guidelines, 2020 - legalised teleconsultation in India with defined drug lists and record-keeping; eSanjeevani is the public platform.

Formulas and examples

Example 1 — HIS availability. A hospital HIS is scheduled for 24 × 30 = 720 hours in a month and records 3 hours 36 minutes of unplanned downtime.

• Downtime = 3.6 h. Availability = (720 − 3.6)/720 × 100 = 716.4/720 × 100 = 99.5%.
• The SLA demands 99.9%, i.e. maximum allowed downtime = 0.001 × 720 = 0.72 h ≈ 43 minutes. The vendor has breached the SLA by about 2 hours 53 minutes.

Example 2 — MTBF, MTTR and availability. In 2,000 operating hours the HIS server failed 4 times with total repair time 10 hours.

• MTBF = 2,000/4 = 500 h; MTTR = 10/4 = 2.5 h.
• Availability = 500/(500 + 2.5) = 500/502.5 = 0.99502 → 99.50%.

Example 3 — TCO and payback of an HIS. Licence ₹40,00,000; implementation and training ₹10,00,000; servers and network ₹15,00,000; AMC 18% of licence per year; annual support staff ₹6,00,000. Benefits: 4 clerks redeployed saving ₹14,40,000 a year, pharmacy leakage cut by ₹5,00,000 a year, and faster billing recovering ₹3,60,000 a year.

• AMC = 0.18 × 40,00,000 = ₹7,20,000 per year. Annual recurring cost = 7,20,000 + 6,00,000 = ₹13,20,000.
• Capital outlay = 40,00,000 + 10,00,000 + 15,00,000 = ₹65,00,000.
• Annual benefit = 14,40,000 + 5,00,000 + 3,60,000 = ₹23,00,000; annual net saving = 23,00,000 − 13,20,000 = ₹9,80,000.
• Payback = 65,00,000/9,80,000 = 6.63 years. Five-year TCO = 65,00,000 + 5 × 13,20,000 = ₹1,31,00,000.
• Interpretation: on these numbers the project is justified by service quality and compliance, not by cash payback alone — a point examiners look for.

Example 4 — ABDM linkage KPI. A district hospital registers 1,200 new OP patients in a week; 930 get an ABHA number created or verified, and 744 of those consent to have the visit record linked to their ABHA.

• ABHA creation rate = 930/1,200 × 100 = 77.5%.
• Linkage rate (of all new patients) = 744/1,200 × 100 = 62%; of ABHA holders = 744/930 × 100 = 80%.
• With Scan and Share, registration time falls from 4.0 to 1.5 minutes per patient: time saved per day (1,200/7 ≈ 171 patients) = 171 × 2.5 = 427.5 minutes ≈ 7.1 hours of counter time a day.

Example 5 — PACS storage sizing. A radiology department does 60 CT studies a day, 300 images per study, 0.5 MB per image, with 1 year (365 days) of online retention.

• Per day = 60 × 300 × 0.5 = 9,000 MB = 9,000/1,024 = 8.79 GB.
• Per year = 8.79 × 365 = 3,208 GB ≈ 3.13 TB; with RAID and 30% growth headroom, provision about 4.5–5 TB online plus archive.

Where it is used

• Corporate hospital chains — Apollo, Fortis, Max, Manipal, Narayana Health and Aster run enterprise HIS with PACS, LIS and ABDM HIP integration; roles: HIS implementation executive, EMR trainer, data analyst.
• Government health systems — NIC eHospital and e-Sushrut in AIIMS and state hospitals, Scan and Share OPD tokens, PM-JAY TMS claims, state HMIS/DHIS2 reporting from PHCs and CHCs.
• HIS and health-tech vendors — Attune, Napier, Insta by Practo, KareXpert, Birlamedisoft, Oracle Health, Siemens/GE (PACS), plus ABDM sandbox integrators building M1/M2/M3 certified products.
• Diagnostics chains and teleradiology — Dr Lal PathLabs, Metropolis, SRL, Thyrocare: LIS with barcoded samples, LOINC-mapped catalogues and ABDM-linked e-reports.
• Insurance, TPAs and claims — HCX-based claim exchange, pre-authorisation and fraud analytics; roles in claims operations and medical audit.
• Quality, MRD and compliance roles — NABH/NABL documentation, information-security and DPDP readiness, CERT-In incident handling, downtime drills and clinical-audit dashboards.

Interview questions

• Q: What is the difference between an EMR and an EHR? A: An EMR is the clinical record created and used within one organisation; an EHR is a patient-centred record shared across providers, which in India is enabled by ABDM linkage through the ABHA number.
• Q: What is an ABHA number and is it compulsory? A: A 14-digit national health account number used to link and share health records; it is voluntary, and treatment cannot be refused to a patient who does not have one.
• Q: Where does ABDM store a patient's health records? A: Nowhere centrally — the architecture is federated, so records stay with the hospital or repository that created them and move only on a consent artefact routed by the Health Information Exchange and Consent Manager.
• Q: Differentiate HIP and HIU with examples. A: A Health Information Provider creates records (a hospital, lab or radiology centre); a Health Information User requests them (a referral hospital, a treating doctor or an insurer).
• Q: Why does ABDM insist on HL7 FHIR rather than HL7 v2? A: FHIR is resource-based and uses REST APIs and JSON, so it is far easier to implement over the internet and on mobile, and it supports granular queries that a pipe-delimited v2 message cannot.
• Q: What is semantic interoperability, and what gives it? A: It means the receiving system understands the clinical meaning of the data, not just the format; SNOMED CT for findings and LOINC for lab observations provide it.
• Q: Your HIS goes down for four hours during peak OPD. What do you do? A: Trigger the documented downtime protocol — pre-printed registration and billing forms with a reserved number series, manual lab requisitions, log the incident, then back-enter data in a defined sequence once service is restored, and reconcile billing before closing the day.
• Q: Which go-live strategy would you choose for a 300-bed hospital's first HIS? A: A phased go-live starting with registration, billing and pharmacy, with a short parallel run on billing, because a big-bang cutover risks revenue leakage and clinician resistance on day one.
• Q: What legal framework protects health data in India today? A: The DPDP Act, 2023 is enacted, but under the DPDP Rules, 2025 the fiduciary duties and the omission of IT Act section 43A take effect from 13 May 2027; until then section 43A and the SPDI Rules, 2011, which treat medical records as sensitive personal data, apply, alongside confidentiality duties in medical council regulations.
• Q: Can a doctor prescribe any drug over a teleconsultation? A: No — the Telemedicine Practice Guidelines, 2020 permit only the specified lists (O, A and B, with limits by consultation mode and first versus follow-up) and bar prohibited drugs such as narcotics and Schedule X items.
• Q: How would you measure whether an HIS implementation succeeded? A: With baseline-to-post indicators — OP registration and billing turnaround time, lab result turnaround, discharge summary completion within 24 hours, medication-error and duplicate-registration rates, uptime against SLA, ABHA creation and record-linkage rates, and claim rejection rate.
• Q: What are the ABDM M1, M2 and M3 milestones? A: Software certification stages — M1 for creating and verifying ABHA, M2 for linking and sharing records as an HIP, and M3 for requesting and fetching records as an HIU.

Common mistakes

• Treating ABHA as a central database of everyone's health records, when ABDM is federated and consent-driven; and confusing the 14-digit ABHA number with the ABHA address.
• Using EMR, EHR, PHR and HIS as synonyms in exam answers — each has a distinct scope and owner.
• Mixing up the standards: HL7 for messages, DICOM for images, ICD for classification, SNOMED CT/LOINC for terminology.
• Quoting repealed or superseded law — citing only IT Act section 43A as if the DPDP Act does not exist, or treating DPDP fiduciary duties as already enforceable before 13 May 2027.
• Writing an implementation plan with no master-data cleanup, no training plan and no downtime/business-continuity protocol.
• Computing availability or payback without stating units — mixing hours with days, or ignoring recurring AMC when calculating TCO.
• Assuming NABH or ABDM compliance is achieved by buying software; both require documented processes, audits and user discipline.

Related topics

Medical records and health information management (ICD coding) · Outpatient, inpatient and emergency department management · Hospital materials management and pharmacy stores · Quality accreditation: NABH and NABL · Health insurance, PM-JAY and claims management · Hospital planning and biomedical equipment management