Compliance
A HIPAA badge on an Indian pathology homepage is a costume. This page is the register: what the law asks, what the software does, what is still later.
The lab is the fiduciary. We are the processor. Itemised notice, separate consents, withdrawal, rights desk, 72-hour Board clock on a breach record. Fiduciary duties in the Rules tighten on 13 May 2027; the screens are already shaped that way.
Logs in India, 180 days, clocks on NIC/NPL NTP, 6-hour incident runbook. Named point of contact in ops.
Bilingual rate card, signatory tiers, specialty-wise report register, qualification on the user profile.
Restricted flag, counselling/consent on the order, split report, no auto-send, no B2B portal values, logged views.
Notifiable tests write a queue. Desk exports the laboratory annexure. Nikshay API is later.
Regulated tests blocked without Genetic Laboratory registration. Sex is never printed on those reports. Form E is later.
Category, time, bag barcode, Form IV quantities. Authorisation from the SPCB is still the occupier’s.
Exempt vs taxable per line, bill of supply vs tax invoice, FY series, credit notes. IRN adapter later.
M1 ABHA OTP and Scan and Share, M2 HIP care-context, M3 HIU under a consent artefact — shipped as a fake adapter, module-gated, production dark. Restricted inbound values stay hidden. We will not write “ABDM ready” until a real NHA environment is on.
An LIS that manages, validates, stores, and communicates results is not a medical device. It becomes one if it adds diagnostic analysis or clinical decision support. Limit flags and lab-configured comments only. Any feature request that interprets results gets a regulatory check first.
We will walk booking, barcodes, machine results, and the signed report. About 20 minutes. GST bill if you start — no card.
