NABH-ready. BMW-tracked. One platform.
Every hospital in India runs under six regulators at once: DPDP Act 2023 for patient data, NABH accreditation, Bio-Medical Waste Rules 2016, PCPNDT, AERB for imaging, and Drug & Cosmetics licensing. dcomply ships modules for each layer, from consent capture at reception to BMW bag counts to the pre-assessment file for your next NABH cycle. Nothing to integrate with your HIS.
ABDM-compliant consent artefacts · HL7 FHIR recordsEvery Indian hospital runs under six regulators.
DPDP is the foundation because every patient generates sensitive health data. NABH, BMW, PCPNDT, AERB and ABDM stack on top. CERT-In catches cyber incidents.
Four fires that cost the licence.
The reception consent artefact, the ransomware 6-hour clock, the NABH evidence file, the minor-patient guardian consent. Named, templated, logged.
Patient consent at reception. OPD, IPD, lab, pharmacy — each capture point needs purpose-itemised, timestamped consent. DPDP + ABDM both require it. Paper forms do not survive an audit. QR + e-sign consent at every desk.
Ransomware & CERT-In 6-h clock. Hospitals are a top ransomware target in India. CERT-In demands a 6-hour report with IP, hashes, systems. 180-day log retention. Pre-filled from the incident, CISO-signed.
NABH cycle evidence. Every NABH standard needs evidence. Pre-assessment files are usually stitched together days before the auditor arrives. Map standards → evidence once; keep it fresh continuously.
Minor patient parental consent. DPDP Rule 11 requires verifiable parental consent for under-18s. Covers appointment booking, prescriptions, lab reports. Age verification + guardian consent workflow built in.
Every hospital module, pre-mapped to Indian law.
Our Healthcare engagement (DPDP + NABH + BMW + ABDM bundled, from Rs 3,99,999 one-time, 90 days) covers all hospital-specific scope. Managed retainer from Rs 39,999/mo.
Healthcare compliance in four numbers.
Questions hospital compliance teams actually ask.
Indian healthcare faces DPDP Act 2023, Clinical Establishments Act, ABDM/ABHA norms for digital health, Biomedical Waste Management Rules 2016, NABH accreditation standards where sought, IT Act SPDI Rules for sensitive data, and CERT-In 6-hour breach reporting. Diagnostic labs additionally deal with PC-PNDT and blood-bank licensing.
DPDP does not use a formal sensitive data category (unlike GDPR), but the DPDP Rules 2025 draft treat health data as warranting stronger safeguards, including mandatory DPIA before high-volume processing, restricted secondary use, and stricter cross-border rules. dcomply's DPIA module auto-triggers when health data is added to a processing record.
dcomply provides consent artefact templates for ABDM's consent-manager standard, supports the HL7 FHIR data pattern in processing records, and produces required audit logs for ABDM audits. HFR and HPR facility linkage is captured in the tenant profile.
BMW Rules 2016 require category-wise segregation, monthly consumption plus disposal register, annual report to State PCB by 30 June, disposal via CBWTF with proof, and training records for all handlers. dcomply's Healthcare Biowaste module automates all of this.
CERT-In's 2022 direction requires reporting of network intrusions, ransomware, data breaches and unauthorised access within 6 hours of noticing. Hospitals are a frequent target of ransomware. dcomply pre-fills the CERT-In incident format and preserves logs for 180 days as required.
Yes. DPDP Rule 11 requires verifiable consent from a parent or lawful guardian for anyone under 18. For healthcare this includes appointment booking, prescription history and lab reports for minors. dcomply's children-data module implements the verifiable-consent workflow with age verification.
dcomply runs as a parallel compliance workspace and does not require HIS integration. Patient data stays in your HIS. Compliance evidence, workflows, and audit trails live in dcomply. Integrations for major HIS platforms are on the roadmap.
No. The platform is used by clinics, nursing homes, diagnostic centres, and multi-speciality hospitals. Pricing scales with the modules you actually turn on.
It maps every NABH standard to evidence you upload, flags gaps against the current cycle, and generates the pre-assessment file. Assessors have accepted the exported file directly.
The consultant handles the domain. dcomply handles the record-keeping, monthly CPCB returns, and the audit trail that survives inspection. Most hospitals keep both.
Included. Every dcomply tenant gets POSH and Labour modules. Hospitals hit both because of the size of the workforce.
Request a scope. Clear your NABH cycle.
Healthcare engagement from Rs 3,99,999 (90 days). Managed retainer from Rs 39,999/mo. vDPO Premium from Rs 19,999/mo.