Corporate Compliance Policy & Technical Governance Framework
At OneHealthGrid (engineered and operated by Routeget Technologies Consulting Pvt. Ltd.), regulatory compliance is architected directly into our cloud infrastructure, databases, payment workflows, HL7 FHIR® APIs, and inbuilt Model Context Protocol (MCP) servers. This Corporate Compliance Policy serves as both our public declaration of adherence to national and international standards and our operational blueprint for SecOps, DevOps, and clinical data stewardship.
4 Critical Compliance Pillars Governing OneHealthGrid
1. NHA ABDM & HL7 FHIR® R4
Strict adherence to National Health Authority (NHA) Health Data Management Policy (HDMP), CERT-In empanelled WASA certification, HIP/HIU electronic consent artefacts, and FHIR R4 schemas.
2. DPDP Act 2023 & Database Security
Compliance with India’s Digital Personal Data Protection Act 2023, IT Act 2000 (SPDI Rules), and HIPAA/GDPR principles via AES-256 encryption at rest, TLS 1.3 in transit, and tenant isolation.
3. PCI-DSS v4.0 & RBI Payment Rules
Zero storage of raw credit/debit PAN or CVV data, RBI-compliant card tokenization, HMAC-SHA256 webhook verification, and automated ledger reconciliation with Microsoft Dynamics 365 Finance.
4. ISO 27001, CERT-In & AI/MCP Safety
CIS-hardened container runtimes, <=72h critical CVE patching, RPO <=15m / RTO <=2h disaster recovery, 180-day NTP-synced audit logs, and zero-training guardrails on inbuilt MCP servers.
Policy & Ops Modules
“OneHealthGrid is engineered in strict alignment with India’s DPDP Act 2023, NHA ABDM (CERT-In WASA) standards, HL7 FHIR® R4, ISO/IEC 27001:2022 controls, and PCI-DSS v4.0 payment tokenization. All clinical, institutional, and citizen health records are protected with AES-256 encryption at rest, TLS 1.3 in transit, and immutable RBAC audit trails.”
Request WASA audit summaries, SOC 2 / ISO 27001 control mappings, or report a compliance concern:
✉ compliance@onehealthgrid.com →
01. Document Purpose & Scope
This Corporate Compliance Policy establishes mandatory technical, financial, and regulatory controls across all OneHealthGrid environments, personnel, cloud workloads, APIs, and third-party sub-processors.
1.1 Purpose: This Corporate Compliance Policy (Policy ID: OHG-CCO-POL-2026.4) defines the binding technical, operational, financial, and regulatory governance framework maintained by Routeget Technologies Consulting Pvt. Ltd. for the OneHealthGrid digital health platform (https://onehealthgrid.com). It serves both as an authoritative public assurance to our B2B healthcare institutions, B2G public health authorities, and citizens, and as an enforceable internal standard for our engineering, DevOps, SecOps, and finance teams.
✓ Systems & Environments in Scope
Applies to all production, staging, disaster-recovery, and developer sandbox environments powering OneHealthGrid’s HIS, EHR, LIMS, RIS, Pharmacy, Telemedicine, Public Health Surveillance, NHA ABDM (HIP/HIU/ABHA) connectors, HL7 FHIR® R4 APIs, inbuilt Model Context Protocol (MCP) servers, and Microsoft Dynamics 365 Finance ERP bridges.
✓ Personnel & Entities in Scope
Binding upon all full-time employees, site reliability engineers (SREs), managed services operators, contractors, and vetted cloud/payment sub-processors of Routeget Technologies Consulting Pvt. Ltd., as well as B2B/B2G tenant administrators and API integration partners connecting to our ecosystem.
02. Financial, ERP & Payment Gateway Compliance
OneHealthGrid enforces strict PCI-DSS v4.0 (SAQ-A) and RBI tokenization compliance. We never store, log, or transmit raw credit/debit card numbers (PAN), CVVs, or UPI PINs on our servers, and all enterprise financial postings are cryptographically reconciled with Microsoft Dynamics 365 Finance.
All B2B SaaS subscription billing, hospital patient billing collections, and public health grant disbursements processed through OneHealthGrid adhere to strict financial security controls:
- Zero Raw Card Data Storage (PCI-DSS v4.0 Isolation): OneHealthGrid operates under a strict cardholder-data-avoidance architecture. Raw Primary Account Numbers (PAN), magnetic stripe data, CAV2/CVC2/CVV2 security codes, and banking PINs never touch OneHealthGrid application memory, databases, or log files. All payment capture occurs via isolated, TLS 1.3 hosted checkouts or sandboxed iframes operated by RBI-authorized, PCI-DSS v4.0 Level 1 certified payment gateways.
- RBI Card-on-File Tokenization & Idempotency: Recurring B2B SaaS subscriptions and institutional auto-debits utilize strictly scoped cryptographic gateway tokens in compliance with Reserve Bank of India (RBI) Card-on-File (CoF) Tokenization Directives. Every payment API request includes a unique UUID v4
Idempotency-Keyto prevent duplicate charges during network retries. - Cryptographic Webhook Verification: Asynchronous payment confirmation callbacks from payment gateways are validated at the API gateway layer using HMAC-SHA256 signature verification, strict timestamp replay-window checks (≤300 seconds), and IP allowlisting before any invoice status is updated.
- Microsoft Dynamics 365 Finance Audit & Tax Integrity: Operational billing events (patient invoicing, pharmacy sales, inventory procurement, and SaaS receivables) synchronized with Microsoft Dynamics 365 Finance enforce double-entry General Ledger (GL) validation, immutable voucher numbering, GSTIN/HSN/SAC tax verification, and segregation of duties (SoD) between billing creators and financial approvers.
03. Data Governance, Cryptography & Database Security
All databases enforce AES-256-GCM encryption at rest with KMS/HSM key rotation, TLS 1.3 in transit, strict multi-tenant Row-Level Security (RLS), India data residency, and zero-training isolation for inbuilt MCP AI servers.
To comply with India’s DPDP Act, 2023, the IT Act, 2000 (SPDI Rules, 2011), the NHA ABDM Health Data Management Policy, and international HIPAA/GDPR security rules, OneHealthGrid enforces defense-in-depth database governance:
A. Cryptographic Standards (At-Rest & In-Transit)
- Data-at-Rest: All relational databases, FHIR document stores, object storage buckets (radiology PACS/lab PDFs), and backup snapshots are encrypted using AES-256-GCM. Encryption keys are managed via FIPS 140-2/140-3 compliant Cloud KMS/HSM with automated 90-day key rotation.
- Data-in-Transit: All external web, mobile, HL7 FHIR API, and MCP server traffic enforces TLS 1.3 (with TLS 1.2 Perfect Forward Secrecy fallback minimum). Service-to-service microservice and ABDM gateway traffic utilizes mutual TLS (mTLS) and FIDH (Financial/Health Information Data Encryption) Elliptic Curve Diffie-Hellman (ECDH Curve25519) payload encryption.
B. Database Isolation, Access & Residency
- Multi-Tenant Isolation: B2B/B2G tenants are logically isolated via mandatory
tenant_idRow-Level Security (RLS) policies at the database engine layer, or dedicated schema/VPC instances for statewide public health deployments. - Zero Public DB Exposure: Database clusters reside exclusively in private VPC subnets with no public IP addresses, accessible only via bastardized Zero-Trust ephemeral bastion sessions with MFA and short-lived IAM certificates.
- India Data Residency: All primary and disaster-recovery data centers storing Indian citizen health records and ABHA-linked artefacts are physically located within the Republic of India (MeitY-empanelled / Tier-IV cloud regions).
04. System Continuity, Patch Management & Infrastructure Compliance
Our cloud infrastructure runs on CIS-hardened, immutable container runtimes with automated vulnerability scanning, =99.9% target uptime), and quarterly validated Disaster Recovery drills (RPO <= 15 mins, RTO <= 2 hours).
Healthcare delivery requires resilient, always-on infrastructure. OneHealthGrid maintains strict operational continuity controls:
- Hardened Configurations & Runtime Isolation: All application workloads execute inside non-root, read-only root-filesystem containers hardened against CIS Benchmark Level 1/2 profiles. Production, staging, and developer sandbox workloads run in strictly segregated VPCs with independent IAM roles and network security groups (NSGs). Inbuilt MCP servers execute in stateless, sandboxed worker pods with strict memory/CPU quotas and outbound egress filtering.
- Vulnerability & Patch Management SLA: Automated container image scanning (SAST/DAST/SCA) runs on every CI/CD build. Infrastructure and OS patches follow a strict remediation SLA: Critical CVEs (CVSS ≥ 9.0) within 72 hours; High CVEs (CVSS 7.0–8.9) within 7 days; and Medium CVEs within 30 days, deployed via zero-downtime rolling or blue/green releases.
- Backup Architecture & Disaster Recovery (RPO / RTO): Production databases utilize continuous write-ahead log (WAL) archiving plus automated daily snapshots replicated across geographically separated Indian availability zones (3-2-1 Backup Rule) with Object Lock (immutability against ransomware). Our committed recovery targets are Recovery Point Objective (RPO) ≤ 15 minutes and Recovery Time Objective (RTO) ≤ 2 hours.
- Quarterly Backup Restoration Validation: Backups are never assumed valid until tested. Every quarter, our SRE team executes an automated restoration drill into an isolated recovery VPC, verifying cryptographic checksums, relational integrity, and FHIR API responsiveness.
05. Immutable Audit Trails & Statutory Incident Reporting
Every clinical record view, ABDM consent transaction, API call, and admin action is recorded in append-only WORM audit logs synchronized via NTP and retained for at least 180 days (CERT-In directive). Security incidents follow a strict statutory escalation clock (6 hours for CERT-In).
Complete observability and rapid regulatory escalation are mandatory across our platform:
- Immutable WORM Audit Logging: Every CRUD operation on patient health records (EHR/HIS/LIMS), ABDM consent artefact creation/revocation, MCP tool invocation, privilege elevation, and payment webhook event is written in real time to an append-only, tamper-evident Write-Once-Read-Many (WORM) log store with cryptographic hash chaining. Each log entry captures
timestamp_utc,actor_user_id,hpr_id,tenant_id,source_ip,action_type,resource_id, andhttp_status. - CERT-In Time Synchronization & 180-Day Retention: In compliance with the Indian Computer Emergency Response Team (CERT-In) Directions of April 28, 2022 under Section 70B(6) of the IT Act, 2000, all servers, containers, and database nodes synchronize system clocks via Network Time Protocol (NTP) tied to National Physical Laboratory (NPL) / NIC stratum servers, and ICT security logs are retained securely within India for a minimum of 180 rolling days (and up to 7+ years for statutory clinical/financial audit trails).
- Statutory Incident Response & Escalation Clock: Upon detection of a confirmed security breach, unauthorized clinical data access, or compliance exception, our Incident Response Team (IRT) and Chief Compliance Officer execute the following mandatory notification timeline:
- Within 1 Hour: Internal containment, compromised credential/token revocation, and notification to the Chief Compliance Officer (CCO) and Data Protection Officer (DPO).
- Within 6 Hours (CERT-In Mandate): Formal incident report submitted to CERT-In for qualifying cyber incidents as mandated under the IT Act, 2000.
- Within 24 Hours: Detailed incident notification and forensic mitigation brief delivered to affected B2B/B2G Healthcare Institution Data Fiduciaries.
- Within Statutory Window (DPDP Act / NHA): Notification to the Data Protection Board of India (DPBI), the National Health Authority (NHA) (if ABDM gateways are impacted), and affected Data Principals.
06. Phase 3 Blueprint — Dev/Ops Operational Compliance Checklists
Actionable Daily, Monthly, and Quarterly engineering and SecOps verification checklists executed by OneHealthGrid systems administrators to maintain continuous audit readiness.
To translate policy into daily engineering discipline, our SRE, DevOps, and SecOps teams execute and log the following operational checklists:
Daily SecOps & SRE Checks
- ☑ Verify automated encrypted DB snapshots & WAL replication health across primary/DR zones.
- ☑ Review SIEM high-severity alerts (failed MFA bursts, WAF blocks, anomalous HIU/ABDM queries).
- ☑ Confirm NTP clock-drift (<50ms) across all production nodes against NPL/NIC time servers.
- ☑ Reconcile payment gateway webhook queues & Dynamics 365 Finance posting dead-letter queues.
- ☑ Verify zero critical CVEs in CI/CD container builds prior to production promotion.
Monthly Governance & Patching
- ☑ Apply non-emergency OS, Kubernetes, and runtime security patches across staging & production.
- ☑ Audit IAM roles, SSH/bastion certificates, and revoke dormant B2B/developer API tokens (>60 days idle).
- ☑ Verify WORM audit log hash-chain integrity and confirm 180-day hot/warm storage capacity.
- ☑ Inspect frontend DOM & Tag Manager containers to ensure GA4/Meta Pixel fire strictly on public marketing routes (never inside authenticated EHR/HIS screens).
- ☑ Review MCP server tool-invocation logs for prompt-injection or cross-tenant boundary anomalies.
Quarterly Audits & DR Drills
- ☑ Execute full Disaster Recovery (DR) simulation & backup restoration drill validating RPO ≤15m and RTO ≤2h.
- ☑ Conduct internal/external VAPT & CERT-In empanelled WASA regression testing on APIs & web endpoints.
- ☑ Verify automated KMS/HSM encryption key rotation and OAuth2/JWT signing secret rotation.
- ☑ Complete PCI-DSS v4.0 SAQ-A self-assessment & third-party payment gateway AOC verification.
- ☑ Run tabletop Breach & CERT-In 6-Hour Escalation simulation with CCO, DPO, and engineering leads.
07. Phase 3 Blueprint — Monitoring & Log Verification Guide
Automated SIEM correlation rules and real-time alerting triggers configured across authentication, database RLS, ABDM consent gateways, payment webhooks, and inbuilt MCP servers.
Our centralized Security Information and Event Management (SIEM) pipeline ingests structured JSON logs across all layers and triggers automated PagerDuty/SecOps alerts on the following event signatures:
Expandable Compliance Control Schedules & Storefront Trust Statements
Click any schedule below to review our NHA ABDM WASA security checklist, Marketing Analytics Privacy Isolation rules, and ready-to-use Public Compliance Statements.
1. ABDM Milestone Alignment: OneHealthGrid’s ABHA creation/verification (M1), Health Information Provider — HIP (M2), and Health Information User — HIU (M3) connectors strictly implement the National Health Authority’s asynchronous webhook specification, X.509 gateway certificate pinning, and Curve25519 ECDH key exchange.
2. CERT-In Empanelled WASA Audit: Prior to production gateway promotion and upon major architectural releases, OneHealthGrid undergoes comprehensive Web Application Security Auditing (WASA) against OWASP Top 10 and API Security Top 10 vulnerabilities.
1. Strict Route Segregation: Google Analytics 4 (GA4) and Meta (Facebook) Pixel scripts are restricted exclusively to public informational and marketing pages on onehealthgrid.com.
2. Zero Clinical Telemetry Leakage: Marketing tags are architecturally blocked via Content Security Policy (CSP) and route guards from loading inside authenticated hospital HIS/EHR workspaces, patient portals, ABHA registration screens, or payment checkout frames. No Protected Health Information (PHI) or Sensitive Personal Data is ever transmitted to ad-tech endpoints.
Short Storefront / Footer Boilerplate:
“OneHealthGrid is engineered in strict compliance with India’s DPDP Act 2023, NHA ABDM (CERT-In WASA) standards, HL7 FHIR® R4 interoperability, ISO/IEC 27001:2022 security controls, and PCI-DSS v4.0 payment tokenization. All health records are protected with AES-256 encryption at rest, TLS 1.3 in transit, and immutable India-resident audit trails.”
Enterprise RFP / About Page Boilerplate:
“Operated by Routeget Technologies Consulting Pvt. Ltd., OneHealthGrid maintains a defense-in-depth compliance architecture across clinical, financial, and public health operations—combining multi-tenant database isolation, zero raw card data storage (PCI-DSS v4.0), CERT-In 180-day NTP-synchronized security logging, RPO ≤15m / RTO ≤2h disaster recovery, and human-in-the-loop governance for inbuilt Model Context Protocol (MCP) AI servers.”
Need Our Enterprise Compliance Dossier, WASA Audit Summary, or B2G Security Pack?
Our Chief Compliance Officer and Security Architecture team support hospital CISO reviews, government e-Governance tenders, and partner security due diligence with complete documentation.