National Health AuthorityNHA Docs

Command Palette

Search for a command to run...

HIE-CM

The Health Information Exchange & Consent Manager — the patient's agent in every data exchange.

The HIE-CM (Health Information Exchange & Consent Manager) is the service that acts on the patient's behalf. Every ABHA address belongs to exactly one consent manager, and every consent artefact is issued and enforced by it.

In the current ecosystem NHA operates the primary consent manager (the @abdm / sandbox @sbx suffix on ABHA addresses identifies it). The architecture allows multiple CMs — the suffix routes requests to the right one, which is why APIs carry an X-CM-ID header.

What the HIE-CM does

  • Holds consent artefacts — creation, grant, deny, expiry, revocation.
  • Manages linked care contexts — the patient's map of "which facility holds which episodes of my data".
  • Orchestrates discovery & linking — routes HIP-initiated and patient-initiated linking flows.
  • Notifies all parties — HIPs learn about consents relevant to them; HIUs learn when consents are granted or revoked.
  • Serves PHR apps — patient-facing apps talk to the CM to list records, approve consents, and manage subscriptions.

Patient-facing surface

Patients interact with the HIE-CM through the ABHA app (or third-party PHR apps) to:

  1. View facilities where their records are linked
  2. Approve or reject consent requests, with full detail of purpose, date range, and data types
  3. Revoke previously granted consents at any time
  4. Set up auto-approval policies / subscriptions for trusted apps

Developer-facing surface

Your HIP/HIU never talks to the patient directly for consent — always through the CM via the gateway:

sequenceDiagram
  participant HIU
  participant GW as Gateway
  participant CM as HIE-CM
  participant P as Patient (PHR app)
  HIU->>GW: consent request
  GW->>CM: route
  CM->>P: notify pending consent
  P->>CM: grant (signs artefact)
  CM->>GW: consent granted
  GW->>HIU: on-notify (artefact id)

See the Consent Framework for artefact structure and lifecycle details.

Key behaviours to design for

  • Consents expire — artefacts carry a data-erasure date; you must purge fetched data when it passes.
  • Revocation is immediate — handle revoke notifications and stop using the data.
  • The CM is authoritative — never cache consent state longer than the notification stream justifies.
PreviousABHANext HPR & HFR Registries