Hospital Due Diligence Checklist: The Data-Room Index

The term sheet arrives, and a week later so does the request list: 300 lines from the buyer's financial, legal, tax and technical advisers. The promoter of a 120-bed hospital who thought the hard part was negotiating the multiple discovers that the hard part is producing three years of revenue by payer, a current list of every licence with its expiry date, and a clear answer to "who owns the data in your hospital software?"

This article is for promoters and CFOs of Indian hospitals preparing for a sale, a merger or a private equity investment. It explains why data readiness affects the deal, what buyers ask for in each area, and gives a data-room index you can start filling now. It is general information, not legal, tax or investment advice. Work with your own advisers.

Why data readiness affects the deal

Buyers do not pay for what they cannot verify. During diligence, the buyer's advisers try to rebuild your earnings from source records: bills, receipts, claims, doctor payouts. Where the numbers reconcile, they accept them. Where they do not, buyers commonly respond in one of a few ways:

• Adjust the earnings they are willing to pay a multiple on.
• Hold back part of the price in escrow until a question is resolved.
• Ask for specific indemnities, for example on a lapsed licence or an open tax position.
• Slow down, which costs you management time and, sometimes, the deal.

None of these are about whether your hospital is good. They are about whether its records can prove it. A hospital that can answer each question with a report from its own systems, on the same day, gives the buyer fewer reasons to negotiate.

Financial data

The financial request list is long, but most of it comes down to whether revenue and margins can be traced from the profit and loss statement back to individual patient bills.

• Audited financial statements for three years, plus the current year's monthly MIS.
• Revenue by payer type: cash, TPA and insurer, PM-JAY and state schemes, CGHS, ECHS, corporate, international.
• Revenue by specialty and by inpatient, outpatient, day care, pharmacy and diagnostics.
• Doctor agreements and payouts: fixed, fee-for-service or revenue share, with the logic used to calculate each month's payout.
• Receivables ageing by payer, with disallowance and rejection rates. Our article on payer-wise receivables ageing shows a format buyers recognise.
• Scheme dues and the oldest unpaid claims, with correspondence.
• Related-party transactions: leases from promoters, purchases from group firms, management fees.
• Capital expenditure register and the equipment list, with purchase dates and finance.
• Borrowings, guarantees and any covenants.
• Tax filings and open assessments, including GST and TDS on doctor payments.

The reconciliation buyers will try

Expect the buyer to pick a month and ask you to tie three numbers together: revenue in the books, revenue in the hospital information system (HIS) billing report, and cash and claims received. If those three cannot be reconciled with a short explanation of timing differences, the buyer will widen the sample. Do this reconciliation yourself, for at least six months, before the data room opens.

Operational KPIs

Operational numbers explain the financial ones. Buyers will want monthly figures for at least 24 months:

• Licensed beds, operational beds and ICU beds, and any difference between them.
• Occupancy, average length of stay (ALOS) and average revenue per occupied bed (ARPOB).
• Admissions and surgeries by specialty, and operation theatre utilisation.
• Revenue concentration by doctor. If the top three consultants bring 40% of inpatient revenue, expect questions about their contracts and notice periods.
• Payer mix trend, and average realisation per bed-day by payer.
• Staff headcount by category, nurse-to-bed ratios and attrition.
• Quality indicators you already track for accreditation, such as the monthly key performance indicators in the NABH standards.

Define every KPI once, in a short glossary in the data room. Buyers lose confidence fast when occupancy means midnight census in one report and bed-days in another.

Compliance and licences

This is where gaps turn into indemnities. List every registration, licence and consent with its number, issuing authority, date and expiry, and put the current copy next to it. A typical Indian hospital list includes:

• Registration under the Clinical Establishments Act, 2010 in states that have adopted it, or under the state's own law. The Central Government Rules of 2012 also require registered establishments to display the rates they charge.
• Bio-medical waste authorisation from the State Pollution Control Board, the annual reports filed, and the BMW register the rules require to be maintained and updated daily.
• Fire NOC from the state fire service, with its renewal date and the last inspection.
• AERB licences. The Atomic Energy (Radiation Protection) Rules, 2004 list CT units and interventional radiology X-ray units among the practices that need a licence; other X-ray equipment has its own registration, all handled on AERB's eLORA system.
• PCPNDT registration for each ultrasound and imaging site. Under the PNDT Rules, registration is applied for in Form A, the certificate is issued in Form B and must be displayed, and renewal is due before expiry.
• Drug licences for the pharmacy (retail licences are issued in Forms 20 and 21 under the Drugs Rules, 1945), plus narcotic drug permissions where morphine is stocked.
• Blood centre licence, if the hospital runs one.
• Consents to establish and operate under the Water and Air Acts, lift licences, and generator approvals, depending on the state.
• Accreditation certificates (NABH, NABL) with surveillance dates. NABH's 6th edition has applied to all new, renewal and surveillance assessments since 2025.
• Empanelment agreements: PM-JAY and state schemes, insurers and TPAs, CGHS and ECHS. ECHS asked all empanelled hospitals to sign fresh memoranda of agreement after its revised rates took effect on 15 December 2025, so check that yours is current.
• Labour compliance under the four Labour Codes, now in force, including contractor compliance for outsourced staff.

Medico-legal and litigation

Put pending consumer cases, civil suits, police matters and regulatory notices in one schedule, with the amount claimed, the stage and the lawyer's view. Add the medico-legal case register, incident and adverse event summaries, and any regulator inspection reports. Buyers expect some litigation in a hospital. They react badly to litigation they discover themselves.

IT systems and data quality

Technical diligence has moved from "do you have software" to "can we trust and move your data". Expect questions on:

• Systems map: which system holds registration, billing, EMR, lab, radiology, pharmacy, inventory, HR and payroll, and how they connect.
• Data ownership: what the vendor contract says about who owns the data, export formats, and what happens if the contract ends. Our article on switching hospital software covers the clauses buyers look for.
• Data quality: duplicate patient records, unbilled services, charges entered after discharge, manual edits to bills. A high duplicate MRN rate tells a buyer that patient-level analysis will be unreliable.
• Audit trails: whether bill edits, discounts and cancellations are logged with user and time.
• Security and incidents: access controls, backups and the last restore test, and any cyber incidents. CERT-In's April 2022 directions require specified incidents to be reported within 6 hours and ICT logs to be kept for a rolling 180 days.
• Privacy readiness: how the hospital is preparing for the DPDP Rules, 2025, most of whose obligations, including security safeguards and breach intimation, come into force in May 2027.

Never put identifiable patient data in a data room. Share aggregates, de-identified samples and process documents. If a buyer needs to test patient-level records, agree a supervised, minimal sample with legal advice.

The data-room index

Use this structure as your starting index. Number the folders so every request can be answered with a reference, and keep a request tracker alongside it.

01 Corporate and legal

• Incorporation documents, shareholding and board minutes for three years.
• Material contracts: leases, doctor agreements, vendor and outsourcing contracts.
• Litigation and regulatory notice schedule.

02 Financial

• Audited accounts, monthly MIS, revenue by payer, specialty and service line.
• Doctor payout workings, related-party schedule, capex register, borrowings.
• Revenue reconciliation: books to HIS to collections, six months minimum.

03 Revenue cycle

• Receivables ageing by payer, scheme dues, disallowance analysis.
• Tariff masters, package rates, and the rates displayed to patients.
• Empanelment agreements and rate lists for each payer.

04 Operations and quality

• Bed census, occupancy, ALOS, ARPOB, OT utilisation, 24 months.
• Quality indicators, incident summaries, accreditation reports.

05 Licences and compliance

• Master licence register with expiry dates and current copies.
• BMW, fire, AERB, PCPNDT, drug, blood centre and pollution documents.

06 People

• Headcount, payroll summary, attrition, contractor list and compliance.
• Key staff contracts and notice periods.

07 Tax

• Income tax and GST filings and assessments, TDS on professional fees.

08 IT and data

• Systems map, vendor contracts and data ownership clauses.
• Security controls, backup tests, incident log, privacy programme.

09 Property and assets

• Title or lease documents, building approvals, equipment list with AMC and CMC status.

10 Q&A log

• Every buyer question, the answer given, the document referenced and the date.

A 60-day preparation plan

• Weeks 1 and 2: build the licence register and renew anything expiring in the next six months.
• Weeks 3 and 4: run the books-to-HIS-to-collections reconciliation for six months and write down every timing difference.
• Weeks 5 and 6: produce 24 months of KPIs from one source with one glossary.
• Weeks 7 and 8: complete the IT and data folder, including data ownership and a restore test.

Where software fits

Most of the effort in diligence goes into rebuilding numbers that should already exist. When billing, clinical, inventory and HR records sit in one system with audit trails, the payer-wise revenue, KPI history and reconciliations in this index become reports rather than projects. Kōami is built on that principle, with one patient account linking clinical events, charges, claims and receipts. See how the modules fit together on our hospital ERP software page.

If you are preparing for an investment or a sale and want to see what a data room looks like when the reports come straight from the system, we can walk you through it on synthetic data. Book a demo: koami.in/book-demo