UHIN’s five-layer federated architecture, FHIR R4 data model, 11 ABDM API contracts, zero-trust security framework, and full regulatory compliance — all in one reference.
Each layer communicates with the adjacent layer only through well-defined, authenticated APIs. The data vault (Layer 4) is physically and logically isolated from the portal (Layer 2). Zero clinical data in the portal layer.
Patient registers once. ABDM issues 14-digit ABHA number + ABHA address (user@abdm). UHIN links patient profile to this ABHA ID across all facilities.
Hospital registers with UHIN and simultaneously as ABDM HIP. NHA issues Client ID + Secret — stored in AWS Secrets Manager, never in source code.
Every encounter (OPD, lab, prescription) creates a FHIR Bundle + registers a care context with ABDM gateway. Care context = pointer to a health record event.
Doctor initiates ABHA lookup. ABDM gateway sends discovery request to all registered HIPs. UHIN responds with matching care contexts for that ABHA ID.
ABDM consent manager pushes OTP notification to patient's ABHA Health app. Patient sees: who is requesting, what records, purpose, and duration.
Patient approves via OTP. ABDM issues a digitally signed, time-bound consent artefact — specifying requester, purpose, HI types, and date range.
UHIN (HIP role) validates the artefact, fetches matching FHIR bundles, encrypts with requester's public key, POSTs to HIU's dataPushUrl.
Receiving UHIN (HIU role) decrypts the bundle, renders records in consultation workspace, writes an immutable WORM audit log entry that can never be modified.
All resources conform to NRCeS Implementation Guide profiles — mandatory for ABDM HIP certification. India-specific extensions: CDSCO drug codes, NMC practitioner IDs, CoWIN vaccination, ICD-10 India variant.
Every patient's records are encrypted with their own unique AWS KMS customer-managed key. A breach of one patient's key is entirely contained — it cannot affect any other patient's data. Key deletion means permanent, auditable erasure.
Name, DOB, mobile, and Aadhaar reference encrypted at field level using AES-256-GCM with a unique per-patient AWS KMS key. Annual automated rotation.
External HTTPS uses TLS 1.3 minimum. Internal service-to-service uses mTLS 1.3 via AWS ACM Private CA certificates. Cipher suite: CHACHA20_POLY1305 and AES_256_GCM only.
All PII replaced with ABHA-linked tokens before data crosses into analytics or claims stores. The tokenisation map lives in the clinical store only — analytics layers never see patient identity.
Patient requests deletion → UHIN deletes their AWS KMS key → all encrypted records permanently inaccessible within 72 hours. Compliant with DPDP Act Section 12.
Every API call — internal or external — requires a valid JWT + active ABDM consent artefact for clinical data. No implicit trust. No persistent sessions. No direct internet access to the data vault.
JWT 15-minute expiry — access tokens. Redis blocklist for instant revocation.
MFA mandatory — TOTP + biometric for clinical and insurance roles. Cannot be disabled.
Zero secrets in code — all credentials via AWS Secrets Manager, rotated every 90 days.
All 11 mandatory ABDM HIP/HIU APIs implemented. NRCeS FHIR profiles loaded. 48 sandbox test cases passing. HIP certification filed Month 2. Dual HIP + HIU role operation.
Data fiduciary duties, purpose limitation, consent artefacts, right to erasure via KMS key deletion (S.12), grievance officer per S.13, privacy notice in portal.
Reasonable security practices (AES-256 + TLS 1.3). India data localisation — all data on AWS Mumbai or NIC MeghRaj. CERT-In registered entity. 72-hour breach notification SLA in runbook.
Insurance health data physically isolated in the Claims Store, separate from the Clinical Store. Pre-auth API compliant with IRDAI Cashless Claims Committee spec. 7-year data retention.
Zero data access without valid ABDM consent artefact validated live. ABAC policies enforce facility and department boundaries at the database layer.
Portal stores zero clinical data. A complete portal compromise exposes only UI code. Clinical records are in the air-gapped data vault — inaccessible without consent + KMS key.
JWT 15-minute expiry + Redis revocation. MFA mandatory. No persistent sessions. All service credentials in AWS Secrets Manager — zero hardcoded keys.
Container images scanned via AWS ECR. Dependency audit on every CI/CD build. Internal services use mTLS certificates only — no third-party SDK with network access in the vault.
AWS Shield Advanced on all external endpoints. WAF rules block malformed FHIR requests. Kafka queue decouples ingest from processing — ABDM callbacks never dropped under load.
RDS automated backups with 7-day retention and cross-AZ replication. S3 Versioning + Object Lock for WORM compliance. KMS key deletion has mandatory 7-day pending window.
We provide detailed security documentation for enterprise procurement, ABDM partner onboarding, and investor due diligence.