NABH 6th Edition: The Digital Clauses Hospitals Keep Missing

A quality manager who has been through three NABH cycles opens the 6th edition expecting to recognise most of it, and mostly does. The chapters are familiar, the structure is familiar, the discipline is the same discipline. What is different is quieter and shows up in the wording: a steady shift from asking whether a hospital has a policy to asking whether the hospital can demonstrate what happened, and an assumption running underneath the whole document that the demonstrating will be done from systems rather than from files.

That shift is easy to miss on a first read and expensive to miss on an assessment.

What changed in the 6th edition?

The direction of travel is towards digital records, measurable quality indicators and demonstrable data security, rather than towards new clinical requirements.

Work from the published standard rather than from anyone's summary, this one included, because the objective elements are what an assessor actually scores. But the themes are consistent enough to plan against.

• Greater emphasis on electronic records and on digital health, including alignment with the national digital health framework.
• More weight on quality indicators: not just collecting them, but showing that they were reviewed and acted on.
• Explicit attention to data security and patient privacy, which used to be treated as an IT concern and is now a clinical governance one.
• The same underlying demand as always, sharpened: evidence, contemporaneously created.

Why does the digital emphasis change how you prepare?

A hospital on paper can prepare for an assessment in six weeks. A hospital being assessed on data cannot.

This is the practical consequence, and it is worth stating plainly. Retrospective documentation is detectable — an assessor who asks for three months of a quality indicator and receives a spreadsheet created last Tuesday has learnt something. When the standard leans on digital records, the timestamps come along with them, and a record created at the point of care looks nothing like one entered in a batch the week before the visit.

That cuts both ways, and the favourable direction is the one worth planning for: if your system captures the evidence as a by-product of the work, preparation stops being a project. The file is already there because the work created it.

Which quality indicators cause the most trouble

The ones nobody owns, and the ones whose denominator was never defined.

• Indicators collected by a department for its own use, in its own format, so nothing aggregates.
• Indicators with a numerator everyone agrees on and a denominator nobody wrote down, which means this quarter's figure is not comparable to last quarter's.
• Indicators that are collected faithfully and never reviewed, so there is no record of anyone having acted on them.
• Incident and near-miss reporting, which is under-reported everywhere and where a suspiciously low number invites more scrutiny than an honest one.

An assessor's follow-up question is almost never whether you collect the indicator. It is what you did when it moved. That answer lives in minutes of a meeting, in a corrective action recorded against the finding, and in the next quarter's number — and all three should be findable without a search party.

What do the data security clauses actually ask for?

They ask a hospital to show that access to patient data is controlled, recorded and reviewed, which is a configuration question more than a policy one.

A privacy policy has no effect on who can open a record. What decides that is role configuration, and in most hospitals it has drifted: a single clinical role that sees every patient, shared counter logins during busy hours, vendor support accounts left active from a go-live two years ago, and ex-employees whose accounts outlived their employment because offboarding never reached the HIS.

The specific things worth checking before an assessment, because they are the specific things that get asked about:

• Are user accounts individual, or shared at any point in the day?
• Does the audit trail record reads, not just writes? The commonest privacy complaint is that somebody looked at a record they had no business seeing, and a write-only log cannot answer it.
• Is there a documented access review, and has it happened?
• Are backups tested by restoring them, with the elapsed time recorded?
• Does the DPDP work you have already started line up with this, or are they two separate projects producing two separate binders?

That last point is the free win. The data protection work a hospital has to do anyway covers a large part of what the accreditation standard is asking about, and running them as one programme halves the effort.

Is NABH digital health accreditation a separate programme?

Yes, and conflating the two is the most common mistake in this area. The digital clauses inside the 6th edition hospital standard and NABH's Digital Health Standards are different instruments with different assessments, and a hospital can pass one while holding nothing under the other.

The distinction in practice:

• The 6th edition hospital standard is the accreditation most people mean by "NABH". Its digital content is a thread running through chapters about records, access, quality indicators and information management. You are assessed on the hospital; the digital clauses are part of that assessment.
• The Digital Health Standards are a separate, voluntary programme assessing digital maturity as a subject in its own right — HIS and EMR use, infrastructure, cybersecurity, patient data privacy, decision support, and alignment with national programmes including ABDM and NHCX.

The digital programme is graded rather than pass-or-fail, across Silver, Gold and Platinum maturity levels. Entry-level hospitals and small healthcare organisations begin at Silver and become eligible for the higher levels after a period of holding it, and certification carries a multi-year validity. The Silver standard is a compact document — of the order of eight chapters and under a hundred objective elements in the edition current at the time of writing — and NABH publishes the guidebook free on its own portal. Take the level structure, the counts and the eligibility rules from that document rather than from a consultant's summary, because both editions and thresholds have been revised.

For most hospitals the sequencing question answers itself. The 6th edition is the one with commercial consequences — empanelment, tenders and insurer arrangements reference it — so it comes first. The digital programme is worth pursuing when a hospital has already done the work: if your access control, audit trails and record completeness are genuinely in order, the digital certification largely documents a state you are already in, and the assessment is a good way to find out whether that belief survives contact with an assessor.

Where the 6th edition and ABDM meet

Alignment with the national digital health framework appears in both, and the overlap is real work you only need to do once.

A facility on the Health Facility Registry, with clinicians on the Healthcare Professionals Registry, creating structured records linked to patient identities, is simultaneously making progress against the digital expectations of the standard and against empanelment requirements. Hospitals that run these as three separate initiatives, with three owners and three timelines, do the same work three times and finish none of it.

The overlap between accreditation, data protection and the digital health mission is not a coincidence. They are three regulators asking for the same underlying capability: know what you hold, control who touches it, and be able to show what happened.

How should a hospital prepare without a last-minute scramble?

• Read the actual standard and map each objective element to where its evidence will come from. The ones with no source are your gaps.
• Define every quality indicator once, with its denominator written down, and stop letting departments keep private versions.
• Record corrective actions against the finding that triggered them, so the link survives the meeting.
• Put every expiring record — competency, calibration, licence, credential — on an automatic reminder with an escalation.
• Review user roles and disable dormant and vendor accounts. Confirm the audit trail covers reads.
• Run one restore test and write down how long it took.
• A quarter before the assessment, pull the reports an assessor would ask for, on an ordinary week. Whatever takes two days to produce is the finding, and you have found it yourself.

The hospitals that find accreditation easy are not the ones with better documentation. They are the ones whose systems produce the documentation without anybody being asked to.