Healthcare, pharma and life sciences
ABDM consent and Health Data Management Policy concepts do not replace DPDP role/consent analysis or binding clinical, drug, medical-device and hospital record duties.
Distinct operating contexts
Section titled “Distinct operating contexts”| Context | Data/systems | Key actors |
|---|---|---|
| care delivery | registration, EHR/EMR, orders, LIMS, PACS, pharmacy, billing | hospital, clinician, lab, payer, TPA |
| ABDM | ABHA-linked discovery/exchange and consent artefacts | HIP, HIU, consent manager/gateway roles |
| clinical research | protocol, consent, eCRF, lab, imaging, safety | sponsor, site, CRO, investigator, ethics committee |
| pharmacovigilance | adverse event, reporter/patient, product and follow-up | marketing authorisation holder, affiliates, regulator |
| devices/connected care | telemetry, app, cloud, service/support | manufacturer, provider, patient, distributor |
Do not combine treatment consent, clinical-trial informed consent, ABDM health-information exchange consent and DPDP consent into one checkbox.
Purpose and emergency processing
Section titled “Purpose and emergency processing”Map treatment/diagnosis, payment, operations, research, safety reporting, product quality, regulatory submission, support and marketing separately. Section 7 contains specified uses for medical emergency and health-threat contexts; apply their exact facts. Ordinary longitudinal analytics does not become an emergency use.
Identity and rights
Section titled “Identity and rights”Match through an existing patient/trial/device reference before collecting new identity data. Access responses must protect other patients, relatives, reporters and clinician notes according to applicable law. Correction of a clinical record commonly requires an addendum and provenance, rather than destructive overwrite.
Retention conflicts
Section titled “Retention conflicts”Build separate rules for clinical record types, diagnostic images, prescriptions, billing, research essential documents, consent forms, safety cases, device complaints, manufacturing quality, regulator submissions and security logs. Record the applicable central/state clinical, drug/device, trial, tax and limitation sources after specialist counsel review. De-identification for research requires a documented re-identification risk and purpose; it is not a label.
Minimum configuration
Section titled “Minimum configuration”- facility/sponsor/manufacturer/CRO legal entity and role;
- state/facility licences, study protocol and ABDM participation;
- health data categories and high-risk systems;
- child/guardian and emergency workflows;
- research/archiving exemption assessment and “no individual decision” control;
- cross-border sponsor, lab, safety database and cloud map;
- processor contracts, site/CRO instructions and subprocessor chain;
- incident clocks and patient safety escalation;
- record-class retention and preservation.
Sample workflow
Section titled “Sample workflow”A patient withdraws optional research recontact and asks for correction of a diagnostic address. The system stops recontact across CRM/CRO destinations, keeps trial/safety records under the source-linked rule, creates a non-destructive EHR correction task, obtains destination acknowledgements and delivers a secure explanation. It does not delete an adverse-event case needed for pharmacovigilance.
Security and availability
Section titled “Security and availability”Connector agents run within the provider/sponsor boundary. Raw DICOM, pathology, genomic or trial records do not enter the control plane. Incident planning includes clinical availability and patient safety; emergency access is time-bound, justified and reviewed.
Open counsel questions
Section titled “Open counsel questions”- Which central/state facility, clinical-record, trial, drug/device and safety instruments apply?
- When are hospital, doctor, lab, TPA, sponsor, CRO and site independent Fiduciaries or processors?
- Which ABDM production APIs and certification requirements are current for the participant role?
- What secondary research use is covered by consent, a section 7 use or section 17(2)(b)?
- What overseas sponsor/safety access must be preserved, localised or restricted?