Skip to main content

M3 Health Information User: Fetch data with consent

Milestone 3 (M3) enables a Health Information User (HIU) to request, receive and view a patient's health records from Health Information Providers (HIPs) in a secure and consent-based manner. The HIU initiates a consent request, and upon approval by the patient, the requested health records are securely transferred in the prescribed FHIR format for access by the authorised healthcare professional.

Try the M3 APIs
Every call in M3, one page each: the headers it needs, the payload it takes, the callback it triggers, and a request builder you can fire at the sandbox.
Error codes
What each code M3 returns actually means, and the first thing to check when you see one.

In short​

The HIU initiates a consent request using the patient's ABHA Address. The HIE-CM notifies the patient and communicates the consent status to the HIU through the ABDM Gateway. Upon approval, the HIU fetches the generated consent artefact(s) and initiates a request for the authorised health information. The concerned HIP validates the request, encrypts the authorised health information and transfers it to the data-push URL specified by the HIU. The HIU receives and decrypts the information and submits the prescribed receipt-status notification.

M3 functionality​

  • Consent Request: Enables the HIU to initiate a consent request using the patient's ABHA Address. The patient may approve or deny the request through the PHR application.
  • Status of Consent: Enables the HIU to track the consent status as Requested, Granted, Denied, Revoked or Expired and fetch the consent artefact(s) generated upon approval.
  • Request Data: Enables the HIU to request health information against a valid consent artefact, receive and decrypt the FHIR bundle, and display the authorised records in a readable format.

Use cases​

Use caseWhat it does
Patient record shareA patient scans the QR code at your counter and pushes chosen records from their PHR app to your system. You raise no consent request: you reply with a data push URL and a key, receive the records, and report what arrived.

All use cases, and the milestone each belongs to: Use cases.

Applicable for​

Milestone 3 applies to entities or applications performing the Health Information User (HIU) role and requiring access to health information held by one or more Health Information Providers. These may include healthcare facilities, insurers, referral-service providers, clinical decision-support applications and PHR applications acting on behalf of the patient.

Prerequisites​

Before implementing Milestone 3, the healthcare facility must complete Milestone 1 requirements and should be registered as an HIU.

The Consent Management Flow facilitates the secure and consent-based exchange of a patient's health information between the HIU and the concerned HIP through the HIE-CM.

  • Health-Information Request: The HIU initiates a request for the patient's health information through the HIE-CM.
  • Patient Notification: The HIE-CM generates a Consent Request ID and notifies the patient regarding the consent request through the PHR application.
  • Consent Approval: The patient grants consent through the PHR application.
  • Consent Artefact Generation: The HIE-CM generates the consent artefact ID(s) and communicates them to the HIU. Separate consent artefacts are generated where data is requested from multiple HIPs.
  • Data-Push URL: A data-push URL is generated for receiving the requested health information.
  • Request Validation: The concerned HIP validates the consent status, applicable date-time range and encryption parameters.
  • Data Transfer: The requested health information is transferred to the HIU against the Transaction ID assigned by the HIE-CM.
  • Transfer and Receipt Notification: Upon completion of the transfer, the HIP notifies the HIE-CM that the requested information has been transmitted, and the HIU notifies the HIE-CM regarding successful receipt or failure of the request.

Build M3 with an AI coding assistant​

The M3 skill gives an AI coding assistant this milestone as one file: every M3 call and callback with its error codes. Install it, or open it in your assistant in one click.

  • An HIU requests access to a patient's health data by sending a consent request with the patient's ABHA address via the HIE-CM.
  • The HIE-CM acknowledges the request and returns a Consent Request ID through the Gateway.
  • The patient is notified by the HIE-CM and can review, approve, or deny the consent request.
  • The HIE-CM then communicates the patient's consent status back to the HIU through the Gateway.

The consent request ID is the handle for everything that follows. Store it against the requester and the patient.

Journey 2: the patient grants or denies​

  • If the request is approved, the HIE-CM shares the consent artefact IDs generated for that request with the HIU.
  • If the request is denied, the HIE-CM notifies the HIU that the consent request has been rejected.
  • A consent grant is valid for a specific period decided by the patient.
  • One consent grant may generate multiple consent artefacts, so all consent artefact IDs should be stored.
  • If the patient revokes consent or it expires, access to the health information must be stopped.

Journey 3: fetching the records​

Using the consent artefact ID, the HIU fetches the consent artefact and requests the health information covered under that consent. The requested health data is then securely delivered to the data push URL provided by the HIU.

Next​

Last updated on