HIE-CM
The Health Information Exchange & Consent Manager — the patient's agent in every data exchange.
The HIE-CM (Health Information Exchange & Consent Manager) is the service that acts on the patient's behalf. Every ABHA address belongs to exactly one consent manager, and every consent artefact is issued and enforced by it.
In the current ecosystem NHA operates the primary consent manager (the
@abdm / sandbox @sbx suffix on ABHA addresses identifies it). The
architecture allows multiple CMs — the suffix routes requests to the right
one, which is why APIs carry an X-CM-ID header.
What the HIE-CM does
- Holds consent artefacts — creation, grant, deny, expiry, revocation.
- Manages linked care contexts — the patient's map of "which facility holds which episodes of my data".
- Orchestrates discovery & linking — routes HIP-initiated and patient-initiated linking flows.
- Notifies all parties — HIPs learn about consents relevant to them; HIUs learn when consents are granted or revoked.
- Serves PHR apps — patient-facing apps talk to the CM to list records, approve consents, and manage subscriptions.
Patient-facing surface
Patients interact with the HIE-CM through the ABHA app (or third-party PHR apps) to:
- View facilities where their records are linked
- Approve or reject consent requests, with full detail of purpose, date range, and data types
- Revoke previously granted consents at any time
- Set up auto-approval policies / subscriptions for trusted apps
Developer-facing surface
Your HIP/HIU never talks to the patient directly for consent — always through the CM via the gateway:
sequenceDiagram participant HIU participant GW as Gateway participant CM as HIE-CM participant P as Patient (PHR app) HIU->>GW: consent request GW->>CM: route CM->>P: notify pending consent P->>CM: grant (signs artefact) CM->>GW: consent granted GW->>HIU: on-notify (artefact id)
See the Consent Framework for artefact structure and lifecycle details.
Key behaviours to design for
- Consents expire — artefacts carry a data-erasure date; you must purge fetched data when it passes.
- Revocation is immediate — handle revoke notifications and stop using the data.
- The CM is authoritative — never cache consent state longer than the notification stream justifies.