ABDMVendor selectionHMIS
How to check whether an HMIS is really ABDM certified
Where the NHA lists certified applications, what the M1, M2 and M3 certificates prove, the questions to ask a vendor and the phrases that should worry you.
- Author
- Kentron Technologies
- Published
- Reading time
- 4 min read
An HMIS is ABDM certified when the National Health Authority has tested it in the ABDM sandbox against the milestone test cases and approved it for production. Certified applications appear on the ABDM partners page, and the vendor holds a certificate for each milestone cleared: M1, M2 and M3. Anything short of that, however the brochure phrases it, is a claim rather than a certification.
Almost every vendor selling to Indian hospitals now says 'ABDM integrated'. Some have done the work. Some have a button that opens the ABHA website in a browser tab. This article shows you how to tell them apart in an afternoon, without needing to understand the APIs.
What does NHA certification involve?
The vendor registers the application in the ABDM sandbox, builds against the published APIs, runs through the functional test cases for each milestone, submits a demonstration, and receives approval to go live on production. The sandbox integration and exit process describes these steps. Certification is per application and per milestone. A company that has certified one product has not certified its other products, and a product certified for M1 is not certified for M2.
What do the three milestones prove?
| Milestone | Role | What you can do with it |
|---|---|---|
| M1 | ABHA creation and verification | Create ABHA IDs at the desk and link them to patient records |
| M2 | Health Information Provider | Link the prescriptions, reports and discharge summaries you generate to the patient's ABHA, in FHIR format, on consent |
| M3 | Health Information User | Request and view records from other facilities, with the patient's consent |
M1 is the easy one. M2 needs structured clinical documents, which is the real engineering. M3 closes the loop. A longer explanation is in what ABDM integration involves for a 30-bed hospital.
How do you check the NHA listing yourself?
- Open the ABDM partners page. This is where applications that have completed integration and are live on production are listed.
- Search for the product name, not the company name. Certification attaches to the application.
- Note which milestones are shown against it. If only M1 appears, that is what has been certified.
- Ask the vendor for the certificate for each milestone. Match the product name and version on the certificate with the product they are quoting.
- Ask for a live demonstration on production, not on the sandbox: a real ABHA created with a real OTP on a phone you are holding.
What questions should you ask the vendor?
- Which milestones has this exact product cleared, and when? Can I see the certificates?
- Show me a discharge summary leaving the system as a FHIR bundle, and the consent artefact it was sent against.
- Show me a consent request arriving from another facility and what my staff see.
- Is HFR and HPR registration done inside the software, or do I do it separately on the portal?
- If ABDM changes an API, who updates the software and at what cost?
- Is the ABDM module in the price or an add-on? Get the answer in writing.
What are the red flags?
- 'ABDM ready', 'ABDM compliant' or 'ABDM enabled' with no milestone named. These phrases mean nothing on their own.
- ABHA creation opens the government website in a new tab and the desk copies the number back by hand.
- Records are shared as PDFs. M2 requires structured FHIR documents; a PDF attached to an email is not it.
- 'We integrate through a partner.' The certified application is somebody else's, and your data passes through a third party you have no contract with.
- The listing shows a different product name from the one on the quotation.
- The demonstration only works on the sandbox, with test Aadhaar numbers.
- The vendor cannot tell you where your patient data is stored or who has access to the servers.
Healthixio has cleared M1, M2 and M3, is listed with the NHA, and does ABHA creation and HFR and HPR registration from the registration screen. The certificates are on the product page, and we will do the production demonstration on request; ask for one.
Frequently asked questions
Is 'ABDM compliant' the same as 'ABDM certified'?
No. Compliant is a description the vendor gives itself. Certified means the NHA has tested the application against the milestone test cases and approved it for production, and the application appears on the ABDM partners page. Ask which milestones have been certified, ask for the certificates, and check the listing yourself before you sign.
Can a hospital take part in ABDM without certified software?
Partly. You can register your facility in the HFR and your doctors in the HPR on the portal, and patients can create ABHA IDs themselves through the app. What you cannot do without certified software is link the records you generate to a patient's ABHA or receive records from other providers. That needs M2 and M3.
What if the vendor is certified for M1 only?
You get ABHA creation at the desk and nothing else. Your prescriptions and discharge summaries will not reach the patient's ABHA, and your doctors will not see records from other hospitals. Ask for a written timeline for M2 and M3, and be careful of paying now for a feature that does not yet exist.