HealthOS — NavDeep Tech

What it covers

What needs you

One list of what needs action right now — a failed sterile load, an overdue ventilator check, a death waiting past its review window.
Pulled from the same code each module's own screen uses, so the two never disagree.
Nothing can be dismissed. An item clears only when the underlying problem is fixed.
Claim an item to mark yourself on it — it moves below unclaimed items and the claim expires after 4 hours.
Shows only what a person can act on. If a check can't run, it says so rather than showing a false all-clear.

Patients

The register everything else keys off. Search by name, hospital number or phone and get the person before you finish typing. Hospital numbers are allocated by the server and never reused.

The allergy line

Shown first, in red, above the demographics — a clinician opening a record is often about to prescribe. "No history taken" and "recorded: none" are shown as different states, since an empty field isn't a confirmed absence.

Duplicates, merged not deleted

Merging two records for the same patient keeps both, points the duplicate at the surviving record, and combines their allergy lists. Nothing is deleted — the duplicate may be the only place an allergy was ever written down.

Age the way a ward reads it

Displayed in days under a month, months under two years, and years after that. Paediatric dosing is calculated from this figure, so it has to be exact rather than rounded to "0 years old."

ABHA, optional

The Ayushman Bharat health account number is recorded and checked for shape when a patient has one. It's never required — a patient without an ABHA ID can still be registered.

Outpatients

The appointment book and the waiting room on one screen. A slot belongs to one patient, and the clash check runs on the server, so two receptionists booking the same slot can't both succeed.

Walk-ins

Someone already at the desk takes a queue token instead of being given an invented appointment time. They're slotted in between booked patients rather than holding a slot that would clash.

The queue is arrival order

Ordered by when people actually arrived, not by appointment time. A 10:00 who arrives at 11:20 is behind the 10:30 who arrived at 10:25.

Consultations

A consultation covers the clinical note, vitals and the prescription in one screen. A signed note is final — corrections afterwards are addenda with their own author and time.

Allergy checks on prescriptions

A drug that matches a recorded allergy is flagged as it's typed and can't be signed without an explicit acknowledgement. The check runs again on the server at the moment of signing, against the patient's allergies as they stand then — not as they stood when the draft was written.

Vitals

Systolic and diastolic are recorded and range-checked separately. An alarming reading is flagged, not refused — the system doesn't block entry of a real but extreme value.

Pharmacy

Stock is tracked by batch and expiry date, not as a single running total. Expired stock is refused at the point of dispensing, not just flagged.

Dispensing is FEFO

Dispensing works oldest-expiry-first, not oldest-received-first. The batch allocation is recalculated on the server at the moment of dispensing.

Schedule H1 register

Every Schedule H1 and X dispense records the prescriber, patient, quantity and batch, as the Drugs and Cosmetics Rules require. The record is generated by the dispense itself.

Laboratory

Covers orders, samples and results. Sample numbers are allocated by the server and never reused, so a tube can't be mismatched to the wrong patient.

Reference ranges by patient

Reference ranges account for the patient's sex and age. Both are captured on the order itself, so a report reprinted later is interpreted the same way it was on the day it was issued.

Critical value callback

A critical lab result blocks the report from releasing until the callback is logged — who was told, and when.

Wards and beds

A bed board of tiles, not a table, so availability reads at a glance. Free, occupied and out of service are three separate colours.

One bed, one patient

Checked on the server at the moment of admission, so two clerks can't both admit a patient to the same free bed. A patient already admitted can't be admitted again.

Billed by bed-night

A stay is billed in bed-nights, not days — a patient moved to the ICU on night three is billed at the ICU rate for the remaining nights. The rate is captured as it stood on the day, so a later tariff change doesn't reprice a completed stay.

Roster

A week displayed as a grid rather than a list of dates. Three states a day: on, away, or nothing recorded — so an unfilled roster doesn't read as everyone being off.

Leave

Recorded once and read by the outpatient and theatre booking screens, so a consultant on leave isn't quietly booked over. It warns rather than blocks — bookings over leave happen and need a record, not a refusal.

Leave doesn't double-count

Overlapping leave entries for the same person merge into one, so deleting one doesn't leave a duplicate warning behind. Leave that starts the day after another ends stays as two separate entries.

Insurance, and what the family pays

On admission, the system works out what the family will actually owe against the sum insured — four deductions applied in order: non-payable items, the proportionate deduction, the co-payment, then what's left of the sum insured after earlier claims this year. Each figure comes with the reason behind it, on a sheet meant to be printed and handed over.

The proportionate deduction

When a room costs more than the policy's room-rent limit, associated medical expenses are paid at a reduced proportion — a ₹10,000 room against a ₹5,000 limit pays associated expenses at half. IRDAI-defined exemptions (medicines and consumables, implants and devices, diagnostics) are excluded from that reduction and applied correctly.

Approvals running out

Every cashless admission is checked daily against its insurer approval — what's been claimed, what's left, and where the bill is heading. The desk is alerted before the approved amount runs out, not after. The family is told only once the bill has actually exceeded the approval, with the figure as it stands and a note that nothing has been decided. PM-JAY and Aarogyasri patients are never sent this notice — that gap is the hospital's, not the beneficiary's.

Pre-authorisation

Requests include the diagnosis and the cost estimate, since a request without them typically comes back queried. A query can still be approved; a denial is final and needs a fresh request rather than reopening the old one. Emergency requests are flagged and don't wait behind routine ones.

Ambulance — response times are timestamped, not typed

Each dispatch milestone is a single button press, timestamped by the server — not a field filled in later. Nothing can be rounded or backdated, and the order is enforced: a crew can't record arriving before being sent.
A separate check flags trips where a crew's times all arrive within the same minute — a sign they were filled in afterwards rather than recorded live. That figure is shown as a proportion, explicitly not a target: it exists to say whether the response times above it were measured or recollected.
The clock starts when the call is answered, not when a vehicle is assigned. Both figures are shown, since assignment time hides the minutes a call spent queued.
A vehicle counts as available only once four separate facts are recorded — crew signed on, oxygen changed, cleaned since the last patient, and not in the workshop — each entered by the person who did it.
A call needing advanced life support can't be dispatched a vehicle without the required equipment on its kit list (per the AIS-125 construction standard), or one whose paramedic is off-shift.

Feedback

A complaint naming a staff member can't be closed by that same person — checked against their own sign-in identity, not against what the form says.
An anonymous complaint stores nothing identifying at all: not hidden, never written. The server checks the finished record against a named list of identifying fields before it saves. The trade-off is real and shown: an anonymous complaint can only be answered publicly, on the waiting-area board, not by letter.
A complaint alleging harm is treated as an incident, not feedback — it leaves this queue and can't be closed with just a response. Three plain questions decide it: was anybody hurt, did somebody die, was treatment delayed.
A satisfaction score is always calculated but only publishable above a minimum response-rate floor, worked out automatically from actual discharges rather than typed in.
The screen opens on the complaints themselves, not the score.

Medical records — retention

The statutory floor is three years (Regulation 1.3.1, Indian Medical Council Regulations 2002). A record is destroyed only once that date has passed and every hold against it is clear — litigation, an open medico-legal case, a pending claim, an inquiry, or a patient records request under Regulation 1.3.2. Holds are lifted only by a named person.
A child's retention period is computed from their eighteenth birthday, not from the date of treatment — often twenty years of storage, since limitation runs from majority.
The retention date is computed live from the episode, not stored, so flagging a record medico-legal today moves its destruction date immediately.
Destruction leaves an audit stub: who the patient was, what the episode was, when it was destroyed, and who authorised it. A file still out with someone can't be destroyed.
The proportion of unspecified ICD-10 codes is tracked and shown, explicitly not as a target to reduce.
A file is either with a named person or marked missing — there's no third state.

Referrals out

A referral has three states, and only two are endings: it stays open until someone records the patient arrived, returned, or couldn't be traced. The window before it's flagged overdue depends on how ill the patient was — four hours for an emergency referral.
Acceptance needs a name and a time, except for emergencies, which proceed unaccepted but stay flagged at the top of the board until confirmed.
The recommended escort level is computed from the patient's own chart — airway, oxygen, Glasgow score, systolic pressure, inotropes, active bleeding, age under one — never typed in manually, and can only be raised, never lowered, by whoever sends the request.
Every drug given before transfer is timestamped; an entry without a time is refused.
Tracks the proportion of referrals that come back, and the proportion of closures recorded same-day by the referring doctor.

Equipment

Status is computed from maintenance and check dates, not stored as a field — a machine overdue its check shows as unverified, not "working" or "faulty."
For life-support equipment, unverified means unavailable. No grace period.
Calibration is tracked separately from maintenance, and a "passed" calibration must carry the reading it was compared against.
An expired AERB licence (required for X-ray, CT and mammography units under the Atomic Energy (Radiation Protection) Rules 2004) blocks the machine from use and names who is liable for renewal.
Uptime is computed from logged downtime, never typed in, with the longest single outage shown beside the total.
The proportion of machines checked within their own interval is shown too, explicitly not as a target.

Births and deaths

The hospital is the legal informant under Section 8(1)(b) of the Registration of Births and Deaths Act 1969. The screen counts down days remaining rather than showing a done/not-done list, following Section 13's tiers: free within 21 days, a late fee from 22–30, written authority needed from a month to a year, a magistrate's order beyond a year.
A stillbirth is recorded as its own category, not a birth or a death — the 28-week gestation threshold is checked in both directions.
A cause of death, not just a mode like "cardiac arrest," is required on Form 4, matching what the registrar's form needs.
The registration number comes back from the registrar rather than being self-allocated. Corrections keep the original entry alongside the correction and its reason — nothing is deleted.

Dialysis

A hepatitis B positive patient is dialysed only on a machine dedicated to that purpose — enforced as a refusal in both directions, not a warning. Removing a machine's dedication requires a typed reason that stays on the record.
Hepatitis C and HIV are handled through universal precautions on shared machines, deliberately not segregated.
Serology older than 90 days doesn't clear a session; the refusal names the date the last sample was taken. Results expiring within a fortnight are flagged early.
A reprocessed dialyser is capped at six uses against one named patient, with the counter incremented in the same transaction as the session record. An unlabelled dialyser can't be reused.
The ultrafiltration rate is calculated from the entered weights before the session starts, and flags anything over 13 ml/kg/hr with the hours it would take to bring it under that. The urea reduction ratio is computed the same way.
Hepatitis C and HIV results are kept off the ward board — shown only to the person about to dialyse that patient, per Section 8 of the HIV and AIDS (Prevention and Control) Act 2017.

Mortality review

The committee's own finding rate is tracked against the published range for preventable in-hospital death (3–10%) and shown alongside the grades — explicitly not a target to move, and hidden below 20 reviews.
An action naming only a person (e.g. "counselled the registrar") is refused — an action has to name something about the system: a protocol, a pathway, a rota, a checklist. Naming a person and changing a protocol is fine.
Review triggers are computed automatically: death within 24 hours of admission, within 48 hours of an operation, an unplanned return to theatre, a maternal death, a child's death, or a death nobody expected.
A triggered death nobody has reviewed is the top row on the board, followed by the backlog, oldest first.
A review is written once; a correction is a further entry naming what it corrects rather than an edit. An action closes only with evidence, not an assurance.

Diet

Pre-anaesthetic fasting times are calculated from the scheduled operation time — clear fluids 2 hours out, breast milk 4, a light meal 6, a fatty meal 8 — and shown as clock times, not durations.
Prolonged fasting is flagged, since nothing else in a hospital record tracks it.
Nil-by-mouth patients have their oral medicines routed to their own list — insulin and hypoglycaemics separated out, since a missed dose there is urgent in a way a missed antibiotic isn't. An enteral feed is handled differently again: a drug can go down the tube, and that's a decision someone records.
Allergies are copied onto the diet order as a snapshot; the ward round re-checks against the current patient record in case one was added afterwards.
The kitchen works to a headcount with a cut-off time, and the list shows how many orders changed after that cut-off.
A patient has one active diet order at a time — placing a new one stops the old one.

Consent

Modelled on Samira Kohli v Dr Prabha Manchanda (2008) 2 SCC 1: consent must be real, specific, and given by the patient themselves.

A relative can't consent for a capable adult — there's no guardian field offered for one at all.
Consent is scoped to the specific procedure. A consent for a diagnostic procedure doesn't cover a more extensive one found during it; a mismatch is flagged before the case starts.
Five separate facts have to be recorded, not one checkbox: the procedure, the risks, the alternatives (including doing nothing), the consequences of declining, and the anaesthetic. The language it was taken in is recorded too.
Under the MTP Act, only the woman's consent is required — a husband's is legally irrelevant. A minor's guardian consents in addition to her, never instead. Her identity is withheld per Section 5A. Sterilisation, HIV testing and organ donation follow the same personal-consent-only rule.
Consent is withdrawable at any time, including on the table — it's never edited, only replaced. The age used comes from the patient record, not the form.
The working screen lists tomorrow's cases with no valid consent on file, and why — including operations still missing a marked side.

Sterile supply

Only the biological indicator — a spore vial incubated after the cycle — proves sterility. A chemical indicator only shows the pack reached temperature.
A load that hasn't read yet is its own state: neither passed nor failed.
Early release, before the indicator reads, is allowed but recorded as a named decision with a reason — the load stays on a watch list until the result comes in.
A failed indicator immediately generates a recall list of the patients who received a pack from that load, earliest exposure first, plus the packs still on the shelf.
A test result is write-once — a failed indicator can't be overwritten with a pass.
Cycle parameters are checked against the sterilisation method rather than one global number, and ethylene oxide cycles carry a required aeration time.
A pack can't be opened from a load that hasn't been released — enforced on the server.

Infection control

Infection rates use device-days as the denominator — e.g. catheter-associated UTI is infections per 1,000 catheter-days, not per admission or bed-day. Every line, catheter and ventilator is tracked as its own record with a start and end.
Each infection is tied to a specific device type on the server, so a rate can't be attributed to the wrong device.
Rates on a small denominator are suppressed, with the underlying count and an explicit reason shown instead of a misleading number.
A device-day counts as a calendar day, matching the national comparison standard. Surgical site infections are followed for 30 days, 90 where an implant was placed.
The device review list prompts a daily "does this still need to be in?" check — the single most effective catheter-infection intervention.
Hand hygiene is tracked against the WHO Five Moments, each reported separately, using moments actually observed rather than product usage.
Resistance patterns are recorded exactly as the lab reported them, never inferred from an organism's name.

Notifiable diseases

The board sorts by hours and days remaining, not a done/not-done list.
TB notification is mandatory within 7 days to Nikshay for every provider, including private ones (2012/2018 government notification; failure is punishable under IPC sections 269–270) — it gets its own flagged list.
The clock starts from diagnosis, not from when the form was opened.
A suspected case is notifiable immediately under the IDSP's S/P/L form structure, and confirming it doesn't restart the clock.
HIV status can't be disclosed in a notification without consent (Sections 8–9, HIV and AIDS Act 2017) — checked against free text too, not just the diagnosis field. The same protection applies to MTP terminations and cases under Section 228A IPC.
Clusters (3+ cases of one disease in one locality within an epidemiological week) are flagged by name and location, not folded into a citywide total. Weeks use the ISO numbering standard.

Casualty

Modelled on Parmanand Katara v Union of India (1989): the medico-legal case record never blocks or delays clinical treatment. A patient is triaged and treated with the MLC record chased afterwards, on a list of its own.
The board sorts by triage category, not arrival order — untriaged patients are shown first, then red, yellow, green, longest wait at the top within each colour.
Vital signs can raise a triage category automatically (oxygen saturation below 90, systolic below 90, pulse outside 40–130, Glasgow score below 9 force red) but can't lower one a nurse has set by judgement.
Anyone can raise a patient's category immediately; only a doctor can lower one, with a reason recorded. The category history is kept, so an upgrade from green to red is visible for review.
For sexual assault cases: treatment is free and never conditional on a police report (Section 357C CrPC, Section 166B IPC); identity is protected under Section 228A; reporting is mandatory for a minor under POCSO Section 19, and an adult may decline it. Where age is unknown, the system asks rather than assumes.
Arrival, triage and first-contact times are all server-stamped, and department performance — including breaches and patients who left before being seen — is tracked from them.
An "expectant" triage category exists only inside a declared major incident; it can't be selected otherwise.

Who has been sent for

Sends an automatic call before a patient's wait-time target is breached — five minutes ahead, not at the deadline.
A target of zero (red, resuscitation) triggers an immediate call, not a timed one.
If nobody responds, escalation widens rather than hands over — the nurse in charge is added after the first call, then hospital leadership after that, without cancelling the earlier calls.
A promise to come ("two minutes") buys five minutes once — it can't be renewed, and isn't offered at all for a zero-target patient.
An untriaged patient (no category assigned) triggers a call to the triage nurse specifically.
A patient clears from the list only when first contact is recorded, from the server's clock — not by recording that someone was called.
The same indicator appears on every screen, filtered to what that person's role can act on.

The drug chart

Six states for every dose: given, refused, withheld, not available, due, and not recorded — distinct from "given" or "not given," since "nobody knows" needs its own response.
The chart never invents a missed dose before a drug was prescribed, and as-needed medicines don't generate scheduled rounds at all.
Doses are split into three lists — due, late, missed — with a shorter window for high-risk drugs: 15 minutes for levodopa, insulin, anticonvulsants and interval-dependent antibiotics, an hour for everything else.
The time recorded is the server's, not the browser's — a round can't be signed for before it happens, though a previous shift's paperwork can still be entered late.
Allergies are re-checked at the bedside against the current record, in case one was added after the drug was prescribed.
High-alert medicines (insulin, heparin, concentrated potassium, opioids, neuromuscular blockers, chemotherapy, vasoactive infusions) require a second named person to verify, not a checkbox.
As-needed doses are tracked against actual doses given and their minimum interval, not against a fixed schedule.
Nothing is deletable — an order is stopped, never removed, and a correction is a further entry naming what it corrects.

Imaging

Built around the PC-PNDT Act 1994. Form F is required inside the ordering flow, before a scan can be booked — written in the same transaction as the order, not filled in afterwards.
Section 4(3)'s lawful indications are offered as a list rather than free text; anything outside them is recorded under 4(3)(vi) as the Act requires. The Rule 10 disclosure — that the sex won't be revealed — is recorded as having happened.
The Section 5(2) sex-disclosure check runs as the report is typed and again on the server when it's filed, without blocking a routine scan of a male patient.
An unlicensed or unregistered machine is blocked from use; licences expiring within a month appear on a separate warning list.
The PC-PNDT register is a single button, retained for the two years Rule 9(4) requires, and records can't be deleted.

Waste

Built around the Bio-Medical Waste Management Rules 2016. Every category maps to exactly one of the four colour-coded bins — there's no default, and an unrecognised category is flagged for lookup rather than guessed.
A wrong-bin entry names the correct bin and what the mistake would do to that stream.
The 48-hour Schedule I clock stops at handover or treatment, not when a bag is moved to storage. Overdue bags are listed with the ward they came from.
Every bag is weighed, since Form IV requires category weights for the annual return.
The return shows whether it can be filed and names exactly what's blocking it. Pre-treatment of microbiology waste is recorded as a fact rather than assumed.

Blood bank

Two separate compatibility tables — red cells and plasma work in opposite directions — with all 16 combinations checked individually rather than derived from one rule, so the two can't be silently merged into one.
Five tests are required before release under Schedule F Part XII-B: HIV, hepatitis B, hepatitis C, syphilis and malaria. A reactive unit is discarded the moment the result is entered — never shelved.
A cross-match is a separate, scoped test from a compatible group match, and expires after 72 hours.
The shelf count shows only units that are actually issuable today, not total inventory. Units are offered closest-to-expiry first, and a unit out of the cold chain for more than 30 minutes is discarded rather than reshelved.

Government schemes pay a package

PM-JAY and Aarogyasri pay a fixed rate for the procedure, not a share of the bill — so none of the four standard insurance reductions apply. The beneficiary pays nothing. Balance billing is prohibited, and the system doesn't compute a patient share for these schemes.

What the hospital absorbs

Where the bill exceeds the package rate, the difference is shown as its own figure on the estimate — visible to the hospital, never on the patient's side of the sheet.

A shortfall, undecided until somebody decides

When a payer settles for less than it approved, the gap is tracked as an open dispute — not automatically billed to the patient — until someone with the authority writes it off, bills it, or appeals it. Claims needing an answer are sorted by how long they've waited, not by value.

Theatre

One list per theatre, ordered emergency first, then urgent, then by scheduled time. Utilisation is measured against the staffed session, not against 24 hours. Both the room and the patient are checked for double-booking on the server.

The WHO surgical safety checklist

Sign in, time out and sign out are enforced in order — a case with an incomplete sign-in can't start, and one without a time-out can't be closed. The checklist fills the whole screen, since a time-out is meant to be read aloud with the whole team listening.

The count stops the case

Every other checklist answer can be recorded as "no." The instrument, swab and needle count can't — a count that doesn't reconcile blocks the case from closing.

Theatre time and implants reach the bill

Room time is charged from wheels-in to wheels-out, in the hospital's own billing blocks, rounded up. Implants come through as their own line items, following the same exempt-inside/taxable-outside-an-admission rule as medicines. Charges are offered to billing for review rather than posted automatically.

Device recalls

A single lot number from a manufacturer's notice surfaces the whole list at once: boxes to quarantine, patients to call, and units that left the building years ago — oldest implant first. There's no notify-all button. What it produces instead is a call list with the batch and serial number ready for each patient before the call is made.

Recall severity can't be downgraded

Severity is set from the manufacturer's notice, and the device category (a coronary stent or pacemaker lead, for example) sets a floor that can't be entered below, though it can always be raised. A row closes only on a recorded outcome — spoken to, seen, device removed — or a documented account of which numbers were tried and when. A patient who has died stays on the list for medical review rather than being dropped.

The implant register

Every implant is tracked from the shelf to the patient it went into, by serial number or UDI where available, by lot where it isn't. Coronary stents and knee implants carry their NPPA price ceiling, checked before GST — pricing above the ceiling is refused at entry, not caught later on audit.

Today

The screen the day starts on: who's waiting and for how long, free beds, what's on the lab bench, what's expired on the pharmacy shelf, and what's owed. Every figure is produced by the same code as the module it links to. A figure that can't be read says so — it never shows a false zero.

Billing

Opens on who owes money, largest debt first. A bill is built from the underlying record rather than re-entered — bed nights from the admission trail, medicines from dispenses, tests from lab orders.

GST, handled correctly

Healthcare is GST-exempt, with one exception: room rent above ₹5,000 a day is taxable — but intensive care is exempt at any rate. The ₹5,000 threshold is a daily rate, not a stay total, so ten nights at ₹4,000 stays exempt. Every taxed line shows the reason.

The same medicine, two tax answers

A medicine dispensed to an admitted patient is exempt as part of treatment; sold over the counter, it's an ordinary taxable sale. The system decides which applies from whether there's a real admission behind the bill — never from a box someone ticks.

A bill nobody rewrites

A draft is editable; an issued bill isn't. A line is removed by voiding it with a reason, and stays visible struck through. Nothing is stored pre-computed — the total, tax and balance are recalculated from the line items every time.

Part payments

A payment larger than the remaining balance is refused. A bill settles itself automatically once the balance reaches zero. Voiding a line that's already been paid against surfaces a refund due, rather than hiding it as a negative balance.

The group

An administrator granted access at the group level reaches every facility under it, including ones added later — no re-inviting anyone.

Staff & access

Three access tiers, so a receptionist can register a patient without editing a clinical record, and a nurse can read the register without being able to close it.