Most hospital systems treat compliance as a layer added on top: a module, a report, a pre-audit scramble where someone reconciles what actually happened against what should have. It works, in the sense that a fire drill works. But it means the hospital is only ever compliant in retrospect.
In India, that gap has become expensive. Compliance here is structural, not optional, and four requirements touch nearly every record a hospital creates.
The four that touch every record
ABDM defines how health data is identified and moves between systems. DPDP defines how personal data is protected, consented and retained. NMC requirements shape what a medical record must contain and how it's attributed. And GST touches every bill you raise. Each is usually bolted on per project — and each bolt-on is a place where reality and the record can drift apart.
What "by design" actually changes
Compliant-by-design means the rule is part of how the record is written, not a check that runs afterward. Consent state gates access before data is read. A bill cannot be finalised in a GST-invalid state. An entry that NMC requires to be attributed to a named clinician cannot be saved anonymously. The system doesn't warn you later — it refuses to create non-compliant data in the first place.
The consequence is quiet but large: "can we prove it?" stops being a project and becomes a query. Because every action publishes an event and every event is kept permanently, "show me the consent that was in force when this data was accessed on that date" is answerable in seconds, months later — not reconstructed from memory and paper.
Why this matters more as AI enters operations
The moment software starts acting — an agent submitting a claim, flagging a record, routing data — compliance-as-afterthought stops being tenable. Every AI action has to run through the same permission-checked, consent-gated, audited path a person would. That's only possible if compliance lives in the data model rather than in a report. Governance and compliance are the same discipline seen from two angles, and both have to be foundational.
See it on your own numbers. An executive demonstration takes forty-five minutes, with the architecture open, using synthetic data shaped like yours. Write to hello@ospia.in.
Primary sources
This resource is grounded in the following official standards, laws and regulator guidance. Links were checked on 22 August 2026.