Telemedicine App Development Company: 2026 ABDM, Prescribing Rules and Build Scope

Summary. India had linked more than 100 crore health records to Ayushman Bharat Health Accounts by 22 May 2026, doubling from 50 crore in February 2025 in fifteen months, with roughly 10 crore records now linked every two to three months and more than 450 public and private health technology solutions integrated with the Ayushman Bharat Digital Mission ecosystem. An ABHA number is a 14-digit system-generated identifier, and it is not the same thing as the user-generated PHR address. For the app itself, three documents set the scope: the Telemedicine Practice Guidelines of 25 March 2020, whose four drug lists and mode-of-consultation matrix belong in your prescribing logic rather than in a policy PDF; the ABDM Health Information Exchange and Consent Manager, which is explicitly a data-blind gateway; and the Digital Personal Data Protection Act, 2023, which does something to health data that most compliance summaries get wrong.

The prescribing matrix is product logic, not policy

The Telemedicine Practice Guidelines permit three modes of consultation: video, audio and text, the last covering chat, images, messaging, email and fax. They then tie what a Registered Medical Practitioner may prescribe to which mode was used and whether the consultation was a first or a follow-up.

Drug list	Permitted mode	Nature of consultation	What it covers
List O	Any	Any	Medicines safe to prescribe through any mode of tele-consultation, plus medicines deemed necessary during public health emergencies
List A	Video only	First consultation, and follow-up for continuation of medications	Relatively safe medicines with low potential for abuse, where diagnosis is possible only by video
List B	Any	Follow-up only	Add-on medication for a patient already prescribed for the same condition in person
Prohibited	Cannot be prescribed	Cannot be prescribed	Schedule X of the Drugs and Cosmetics Act and Rules, and narcotic and psychotropic substances under the NDPS Act, 1985

That table is a state machine. An app that lets a doctor write any prescription from any consultation type has pushed a regulatory obligation onto the clinician's memory, which is where compliance failures come from. The correct build encodes the matrix: the prescribing screen knows the consultation mode and whether the encounter is a first or follow-up, and the available formulary changes accordingly. The guidelines give the worked reasoning for List A directly, citing antifungal medication for tinea cruris and ciprofloxacin eye drops for conjunctivitis as cases where video is what makes the diagnosis possible, alongside refills for chronic conditions.

One popular summary of these rules says chronic-disease prescriptions must strictly use video. That sentence does not appear in the guidelines. What the guidelines actually establish is the List A and video coupling above, and getting the distinction right matters when you are writing validation rules.

Identity, consent and the credential display

Four requirements from the guidelines land directly on screens.

Registration numbers are not optional metadata. Every RMP must display the registration number accorded by the State Medical Council or MCI on prescriptions, website, electronic communication and receipts. Separately, the platform must provide the name, qualification, registration number and contact details of every RMP listed on it. Two obligations, two different surfaces, both of which have to be built.

Consultations cannot be anonymous. The guidelines state that both patient and RMP need to know each other's identity, that the RMP should verify the patient by name, age, address, email, phone number or other appropriate identification, and that a mechanism must exist for the patient to verify the RMP's credentials. The RMP opens the consultation by giving name and qualifications.

Age is a gate, not a field. Before issuing a prescription the RMP must explicitly ask the patient's age and seek age proof if in doubt. Where the patient is a minor, teleconsultation is allowed only if the minor is consulting alongside an adult whose identity is ascertained. That is an adult-presence check in the consultation flow, and it sits on top of the separate parental-consent duty in the DPDP Act.

Consent is implied or explicit depending on who started it. If the patient initiates the consultation, consent is implied. If a health worker, RMP or caregiver initiates it, explicit consent is required. It can be recorded in any form, including a text or an audio or video message or a statement on the call, and the RMP must record it in the patient record. So the consent artefact your app stores has to capture who initiated, which changes the required evidence.

Practitioner eligibility is defined against the Indian Medical Council Act, 1956: an RMP is a person enrolled in the State Medical Register or the Indian Medical Register, entitled to consult patients anywhere in India, with consultations outside Indian jurisdiction excluded. The guidelines also contemplate a mandatory online course for practitioners intending to consult online. Verify the current status of that requirement with your medical advisory board rather than assuming it from the 2020 text, because the guidelines are written in MCI and IMC Act vocabulary that predates the National Medical Commission Act, 2019.

ABDM: a consent broker, not a record store

The architectural fact that changes designs is in the Health Information Exchange and Consent Manager brochure: it acts as a data-blind gateway for digital health transactions, facilitating information sharing without data access. The consent manager does not hold records. It holds links and consent artefacts.

ABDM component	What it is	What your app has to do
ABHA number	A 14-digit system-generated unique number for accessing health records digitally	Store it as an identifier distinct from your own patient ID; do not conflate with the ABHA card or PMJAY
PHR address	A user-generated address in the xyz@abdm form, used to access the personal health record app	Support it as a separate handle; the guide also encourages supporting email, mobile, QR and biometrics
Health Information Provider	Any healthcare provider that creates health information while providing care	Publish and link the records you generate so they can be discovered
Health Information User	Any entity that wants to access an individual's health records	Raise consent requests and pull records only against a granted consent
HIE-CM	The consent gateway, one of three digital gateways under ABDM	Integrate the consent request and grant flow; it brokers, it does not store

The user journey the brochure describes is worth building against directly: the patient scans the facility's QR code in an ABDM-enabled app to register, meets the doctor, the doctor raises a consent request for previous records, the patient grants it, records are shared, and the prescription is written and sent back digitally into the patient's app, accumulating longitudinal history.

The scale argument for doing this properly is now straightforward. Records linked to ABHA went from fewer than 1,000 in the initial phase to over 100 crore by May 2026, with Uttar Pradesh alone above 15.03 crore and Andhra Pradesh above 11.95 crore. An app that cannot participate in that exchange is building a record silo at the exact moment the rest of the system stopped being one.

One practical warning for anyone scoping the integration work: the ABDM public site renders as a JavaScript shell and the sandbox documentation host was returning errors when we checked in August 2026. Budget time for the milestone documentation to be intermittently unreachable, and do not take an integration checklist from a third-party summary.

India-specific considerations under the DPDP Act

Most compliance summaries assert that the Digital Personal Data Protection Act, 2023 treats health data as sensitive personal data. It does not. The word "sensitive" does not appear anywhere in the Act. There is no special category, no elevated tier for medical information, and no equivalent of the GDPR's Article 9. The only operative distinction the Act draws is between a Data Fiduciary and a Significant Data Fiduciary under section 10, and that designation attaches to the entity rather than to the data type. India's superseded 2011 rules did list health data as sensitive; the Act that replaced them did not carry the category forward.

This is worth being precise about, because a compliance programme built on a category that does not exist will miss the duties that do.

Section 8(4) requires appropriate technical and organisational measures, and section 8(5) reasonable security safeguards. Section 8(6) requires intimation of a personal data breach to both the Board and each affected data principal, and the statute sets no materiality threshold and no deadline of its own, leaving the form and manner to be prescribed. Section 8(7) requires erasure once consent is withdrawn or the purpose is served, and requires the fiduciary to cause its processor to erase too, unless retention is necessary for compliance with any law. That last clause is the hook that lets clinical-record retention obligations override the erasure duty, and your retention policy has to name the law it relies on rather than defaulting to keeping everything.

Section 9 is where telemedicine gets its second age gate. Verifiable consent of the parent or lawful guardian is required before processing the personal data of a child or of a person with a disability who has a lawful guardian. Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children. Read that alongside the guidelines' requirement that a minor consults alongside an identified adult and the design becomes clear: an app serving paediatric consultations needs a guardian-consent record and an adult-presence check, and they are different things satisfying different instruments.

How we scope a teleconsultation build

1. Encode the prescribing matrix first. Consultation mode, first-versus-follow-up state and the four drug lists are the core domain model, and everything else attaches to it.
2. Design the consent artefact around who initiated. Implied and explicit consent carry different evidence requirements, and the distinction has to survive an audit years later.
3. Decide the ABDM position early. Whether you are a Health Information Provider, a Health Information User or both changes the integration scope substantially, and the milestone certification work is not a sprint you can append.
4. Separate identity from identifiers. ABHA number, PHR address, your own patient ID and the clinician's registration number are four distinct fields with four distinct lifecycles.
5. Write the retention policy against a named law. Section 8(7) erasure yields only to a legal retention requirement, so the requirement has to be identified per record type.
6. Build the audit trail as a product feature. Consent grants, mode of consultation, prescription issuance and record access are the four events you will be asked to reproduce.

Our engagement model reflects that sequence. A fixed-scope discovery produces the prescribing state machine, the consent and identity model, the ABDM integration scope and the retention map before application code starts. The build then runs on milestones tied to those artefacts, with a retained senior team afterwards, because both the ABDM specifications and the DPDP rules are still moving.

eCorpIT builds healthcare and teleconsultation platforms from Gurugram with senior-led, multi-disciplinary teams and CMMI Level 5 assessed processes. For related reading, our healthcare app development service page covers the wider clinical product scope, healthcare AI India CDSCO and DPDP deployment steps covers the regulatory path for clinical AI, and mobile app development company in India covers partner selection generally.

FAQ

What can a doctor prescribe over a telemedicine consultation?

It depends on the mode and whether it is a first or follow-up consult. List O medicines can be prescribed through any mode, List A requires a video consultation, List B is follow-up only, and prohibited medicines include Schedule X drugs and narcotic and psychotropic substances under the NDPS Act.

Does a telemedicine app need to show the doctor's registration number?

Yes, in two places. Every practitioner must display their State Medical Council or MCI registration number on prescriptions, website, electronic communication and receipts. Separately, the platform must show the name, qualification, registration number and contact details of every practitioner listed on it.

When is explicit patient consent required rather than implied?

Consent is implied when the patient initiates the consultation. It becomes explicit when a health worker, practitioner or caregiver initiates it. Explicit consent can be recorded in any form, including a text message, an audio or video message, or a spoken statement, and must be recorded in the patient record.

What is an ABHA number and how does it differ from a PHR address?

An ABHA number is a 14-digit system-generated unique number for accessing health records digitally. A PHR address is user-generated, in the form xyz@abdm, and is used to access the personal health record app. They are different fields and should not be conflated in your data model.

What does becoming an ABDM Health Information Provider involve?

A Health Information Provider is any healthcare provider that creates health information while delivering care, and it must publish and link records so they are discoverable. Access happens only through the Health Information Exchange and Consent Manager, which is a data-blind gateway that brokers consent rather than storing records.

Does the DPDP Act treat health data as sensitive personal data?

No. The word "sensitive" does not appear anywhere in the Act, and it creates no special category for health information. The only operative distinction is between a Data Fiduciary and a Significant Data Fiduciary under section 10, which attaches to the entity rather than to the data.

How do we handle consultations for children?

Two separate requirements apply. The telemedicine guidelines allow a minor to consult only alongside an adult whose identity is ascertained, and section 9 of the DPDP Act requires verifiable consent of the parent or lawful guardian before processing a child's personal data, plus a prohibition on behavioural monitoring and targeted advertising.

Can we delete patient records when someone withdraws consent?

Section 8(7) requires erasure on withdrawal or once the purpose is served, and requires you to cause your processor to erase too, unless retention is necessary for compliance with any law. So your retention policy must name the specific legal requirement it relies on for each record type.

How eCorpIT can help

eCorpIT is a Gurugram-based engineering organisation, founded in 2021, that builds teleconsultation and clinical platforms for Indian healthcare providers. We start with the parts that are expensive to retrofit: the prescribing state machine drawn from the Telemedicine Practice Guidelines, the consent and identity model, the ABDM integration scope, and a retention map that names its legal basis per record type. We design systems aligned with Digital Personal Data Protection Act, 2023 requirements and deliver with senior-led, multi-disciplinary teams under CMMI Level 5 assessed processes. Talk to our team if you are scoping a teleconsultation build or preparing an existing one for ABDM.

References

1. Telemedicine Practice Guidelines, Board of Governors in supersession of the Medical Council of India, 25 March 2020
2. A brief guide on Ayushman Bharat Digital Mission and its building blocks, National Health Authority
3. Health Information Exchange and Consent Manager, Ayushman Bharat Digital Mission
4. Over 100 crore health records linked with ABHA, Press Information Bureau, 22 May 2026
5. Explainer on Ayushman Bharat Health Accounts, Press Information Bureau, 4 April 2024
6. The Digital Personal Data Protection Act, 2023, India Code
7. Ayushman Bharat Digital Mission, National Health Authority
8. ABDM sandbox and integration environment, National Health Authority
9. eSanjeevani national teleconsultation service, Ministry of Health and Family Welfare
10. National Resource Centre for EHR Standards, India FHIR profiles
11. Ministry of Health and Family Welfare
12. ABDM public dashboard, National Health Authority

Last updated: 16 August 2026.