Beckn lets any patient app work with any clinic, lab or pharmacy on an open network, with no company or ministry in the middle.

HealthPass today

HealthPass brings a patient’s records together in one place that she controls, without anyone having to build and own a central server for everyone’s records. On an open beckn network it is a consumer node: the app side, which searches, books and orders for the patient. It has four parts.

• The record. A private, secure store for one patient’s health data. It uses FHIR, the international standard that modern clinic, lab and pharmacy systems already use to exchange health data. At its core is the International Patient Summary (IPS), a standard short summary of the patient: allergies, conditions, medicines, vaccinations and recent results.
• WhatsApp as the way in. The patient opens the record from a link in WhatsApp, as a secure page inside the chat. There is no app to download, and it works on the phones people already have.
• An access log. Every time someone opens the record, HealthPass logs who it was and when.
• An assistant. In the same chat, an assistant finds providers, compares prices and times, books and orders for her, and passes on updates. It asks her before it books, pays or shares her records.

How a nurse sees the record today

1. Thandi shows a QR code.She opens HealthPass in WhatsApp and shows the nurse the QR code on her screen.
2. She gives the nurse a one-time PIN.She receives a short PIN in WhatsApp that works once. It shows she agreed to share her record for this visit.
3. The nurse enters their own access code.HealthPass sends each health worker an access code over WhatsApp. The code expires after a few hours, so an old one can’t be reused.
4. The nurse reads the summary and adds the visit.The access is written to the log.

What HealthPass can’t do on its own

• It can’t tell who is a real health worker. The access code proves that someone got a code from HealthPass. It doesn’t prove they are a licensed nurse at a real clinic, because HealthPass has no shared list of licensed providers to check against. Sending and typing codes also adds a step to every visit.
• Every clinic, lab and pharmacy has to be connected one by one. For results to arrive by themselves, HealthPass has to build a link to each provider’s software. A country has hundreds of these systems, so this is slow and costly, and it starts again in every new country.
• So most care never reaches the record. When Thandi has a blood test at a lab HealthPass isn’t connected to, the result reaches her on paper or by SMS. Her record doesn’t change unless someone types it in.

What joining a beckn network fixes

• A shared register of who is licensed. Clinics, labs, pharmacies and health workers are listed in a registry with a digital key, and every message they send is signed with that key. HealthPass checks the signature instead of handing out codes.
• Connect once, be found in every app. A lab connects its system to the network once. From then on, any patient app on the network can find it and order tests from it, HealthPass included. The lab doesn’t need its own app or website.
• Records fill in as care happens. When a lab or pharmacy completes an order placed over the network, the result goes back to the patient’s record as part of the same exchange.

FHIR is the format of the record. Beckn is the set of rules for how independent organisations find each other, agree on a service and trust each other’s messages.

India built national systems this way

Over fifteen years India built a series of shared digital systems that the government provides and any company can build on. They are often called digital public infrastructure (DPI). Each reached national scale. Two of them, ONDC and Namma Yatri, use beckn.

Beckn isn’t tied to one sector. The same rules work for ride-hailing, shopping, food delivery, couriers, public transport, travel and health. Each network adds a description of its own sector, called a domain pack, and its own rules. Networks built on beckn include ONDC, which the Indian government backs so that small shops can sell online on the same terms as large marketplaces, and an open mobility network in Kochi^5,37.

Other countries are adopting the same approach. The G20 endorsed a framework for digital public infrastructure in 2023⁸, and MOSIP, an open-source national ID system, is being rolled out in Uganda and eight other African countries⁹.

How beckn works

Beckn is an open, decentralised protocol: a set of rules that lets independent apps and providers find each other, agree on a service, pay, and follow it through to the end. No single organisation owns or controls it. Providers publish what they offer, apps search it, and the two complete the order by sending messages straight to each other (peer to peer). Any app on a beckn network can place an order with any provider on it, without the two having to build a connection to each other and without a company in the middle.

Beckn handles the order or booking. Each message has two parts: a context, which says who sent it, where to send the reply and which order it belongs to, and the message itself. Every message is digitally signed, so the receiver can check who sent it and that it wasn’t changed, and the receiver sends back a signed receipt. Both sides can later prove who asked for what, and when. FHIR, the international standard for health records, handles the records themselves, and only with the patient’s permission. Health records never travel inside a beckn message.

Every service goes through the same stages:

Payment is agreed in the same messages: how much, who collects it and how. The money itself moves through ordinary payment systems, such as a card, PayShap or a medical aid claim.

In the latest version of beckn (May 2026), each provider publishes its own signed catalogue and search services read those catalogues, so there is no central hub that every message has to pass through¹⁸. No central body sees every order or holds everyone’s data.

Beckn does for orders and bookings what HTTP does for web pages

Any web browser can open any website because both follow the same rules, HTTP. HTTP doesn’t cover buying and selling, so beckn adds what is missing: a fixed set of steps, standard formats for catalogues and orders, a registry of who is who, and signed messages³⁷.

The patient can use any kind of app. The network deals with the consumer node, not the screen in front of the patient. HealthPass uses a WhatsApp chat. Another wallet could use a phone app, a website, a USSD menu for basic phones, a voice assistant, or a computer at a clinic’s front desk, and reach the same providers.

What beckn provides and what each network adds

Beckn’s specification is published openly, along with documentation, test tools and ready-made software for running a node, such as Beckn-ONIX^37,38. Each network then adds three things of its own:

• A domain pack: what can be ordered in its sector and how it is described. For health, that means lab tests, prescriptions and appointments, described with FHIR.
• Rules: who may join, what each participant must do, and how complaints and disputes are handled.
• Certification: a check that an organisation’s software follows the specification and the rules before it is allowed to join.

An organisation joins in five steps: it builds its software to the specification, gets it certified, registers, starts taking or placing orders, and builds the app or service people see on top³⁷. For a South African health network, the domain pack, the rules and the certification process don’t exist yet. Building them is the public-good work described under Our role and business model.

HealthPass does two jobs: it stores the record, and it is the app patients use

These two jobs are easy to mix up. On a beckn network they are separate, and a patient can swap either one.

India’s payments work the same way. Your bank holds your money; that’s the wallet. PhonePe or Google Pay is the app you pay with, and it holds no money. Because the two are separate, you can change apps and still pay the same shops the next day.

A patient can switch in two ways:

• Keep the record, change the app. Another app reads and adds to the same HealthPass record, with the patient’s permission. Nothing moves, just as you can use a different email program on the same email account.
• Move the record. The patient moves her full record to another wallet. South Africa’s data protection law (POPIA) already gives patients the right to get their personal information, including health records, but not yet a right to move it between services¹¹. The network’s rules would need to require that.

Either way she keeps her ID, which is a national ID rather than an app account, and she keeps her providers, who join the network rather than any one app. HealthPass does both jobs but keeps them separate. That is what makes the promise of no lock-in believable to governments and funders, and it lets other apps work with records kept in HealthPass.

Ordering a lab test, filling a prescription and booking an appointment

The same beckn rules handle all three.

A provider that sets up these steps once can serve every patient app on the network, for every service it offers. Patients compare providers by distance, specialty, free times, price and the medical aids they accept, all in one app, instead of using a different app, website or phone number for each. Services around care can join the same way: a courier company can join once and deliver medicines or collect lab samples for every pharmacy and lab on the network.

How India shares health records

India’s Ayushman Bharat Digital Mission (ABDM), launched in September 2021, is the largest working example of a national system for sharing health records. There is no central database of records. Records stay with the hospital, clinic or lab that created them, and are shared only when the patient approves¹⁴.

Where the records are kept

Every hospital, clinic and lab keeps its own records in its own software. To take part, that software must be certified for ABDM, so it can link visits to an ABHA and answer requests for records. Nothing is copied to a national database. The system knows where records are, not what they say.

How a record is shared

1. Records are linked to the ABHA.This happens in one of two ways. The hospital links a visit when it happens, often after the patient scans a QR code at the registration desk²³. Or the patient finds older records from her app: she chooses the hospital, the hospital matches her by name, age and phone number, and she confirms with a one-time code²⁹. Either way, the consent manager learns that this hospital has records for this person. It doesn’t learn what they say.
2. A provider asks.The clinic that wants the records sends a request to the consent manager with the patient’s ABHA address. It says why it wants them, which kinds of record (prescriptions, lab reports, discharge summaries and so on), from which dates, and how long it will keep them.
3. The patient approves.She sees the request in her app and can narrow it to particular hospitals, visits or kinds of record. The consent manager then issues a signed consent artefact for each hospital involved, listing exactly what may be shared and when the permission ends²⁶.
4. The clinic asks the hospital for the records.The request includes the consent artefact, a one-time encryption key, and the address the hospital should send the records to²⁶.
5. The hospital checks and sends.It checks that the consent artefact is genuine, covers this request and hasn’t expired, then takes the approved records from its own system. It converts them into the FHIR format using India’s national standards²⁵, encrypts them with the clinic’s one-time key, and sends them straight to the clinic. It then tells the consent manager the transfer happened, so there is a record of it. The gateway and the consent manager never see the contents.
6. The clinic uses the records, then deletes them.It decrypts the records and shows them to the doctor. Every permission has an end date, after which the clinic must delete the records or remove anything that identifies the patient²⁷.

How far adoption has got

India measures adoption in three stages. The first two have reached very large numbers. The third, which needs the patient to approve a request, is where it is stuck¹⁶.

India keeps records and services separate, as we propose

ABDM shares records, using FHIR. A separate network called UHI uses beckn to find and book services such as doctors, ambulances and blood banks^14,20. India kept the two apart, which is the same split we propose for South Africa.

Lessons for HealthPass

• Use the national systems that exist; don’t rebuild them. IDs and registries are public goods. In South Africa, HealthPass should use the Department of Health’s Health Patient Registration System and Master Health Facility List¹², and the public registers of the Health Professions Council and the Pharmacy Council.
• The approval step needs an app people already use. ABDM is weakest at the stage where the patient has to act. HealthPass is on WhatsApp, which people already open every day.
• Keep the patient’s own copy. In ABDM terms, HealthPass is a health-record app that keeps a copy of each record as it is created. That gives the patient the complete history the ABDM model leaves out, and a summary she can show at any clinic, including one that isn’t connected.

Why an open network

The prescription shows the difference most clearly.

Problems a beckn network solves

Three ways to build a health record system

Being able to switch doesn’t mean people will. On UPI, two apps handle about 79% of payments¹⁰. But those apps win by being better, and they can’t hold people’s money or shops hostage, so leaving stays easy. The same will be true for health only if the network’s rules require every wallet to hand over the record in a standard format. Setting that rule is the government’s job.

Patients aren’t tied to HealthPass

HealthPass is one place a patient can keep her record. We call such a place a wallet. HealthPass shouldn’t be the only one. On a beckn network any company, hospital or NGO can run a wallet, and every wallet reaches every clinic, lab and pharmacy on the same terms. A patient can change wallet and take their record with them, the way people in India change payment app without changing bank.

How a wallet joins

A wallet joins the network once, the same way a lab does. It builds its software to the beckn specification and the health domain pack, and gets it certified. It then registers in the network registry, which lists every organisation on the network and its digital keys, and is approved under the network’s rules, including the rule that it must hand records over when asked. From then on it can search, order and receive results for all of its patients. Patients don’t join one by one; their wallet acts for them. There are three ways to run a wallet:

• Run your own node, as HealthPass does.
• Use a hosted node run by someone else. This suits a hospital or NGO that wants its own wallet without running servers.
• Build an app with no storage of its own, working on top of a wallet that someone else runs.

Finding a patient’s wallet

Usually no lookup is needed, because the wallet starts nearly every order or booking. When HealthPass orders a lab test, the order carries HealthPass’s network address, so the lab sends the result straight back to it. Any other wallet works the same way.

A lookup only matters when the provider starts the contact and has nothing but the patient’s ID. For example, she walks into a clinic without booking through her wallet, or a doctor sends a prescription a week after the visit. There are two ways to handle that:

These are two registries with two jobs. The network registry lists organisations, and every beckn network needs one. The patient registry lists people, and it is optional. A central list of who uses which health wallet is sensitive, so if one exists it should be opt-in and held by the government. India’s ABHA works this way (see How India did it): the ID is voluntary and issued by a national registry, and a consent manager tracks which hospitals hold each person’s records without seeing what they say.

South Africa’s Department of Health already runs a national patient register, the Health Patient Registration System. It is used in 3,265 public facilities and holds 37.2 million verified registrations¹². The network could add an optional note of each patient’s wallet to that register rather than building a new one. Where a country has no national register, one can be built as part of the network, as a public good.

Switching wallets

1. She asks the new wallet to take over.It confirms her identity with a one-time PIN sent to her phone.
2. HealthPass hands over her full record.It sends it to the new wallet in the standard format: FHIR, with her International Patient Summary.
3. Results find the new wallet.If she is listed in the patient registry, the registry records her new wallet, and providers find it from her ID. If she isn’t, HealthPass forwards anything sent to her old address for a set period, and she gives providers her new address at her next visit.

Using more than one app or wallet

What keeps patients free to switch

• The patient’s ID belongs to the patient. It is a national ID, not an account with any wallet.
• The record is in a standard format. Every wallet stores FHIR and must hand the record over when the patient asks. That is a network rule, not a promise from any one company, including us.
• Providers join the network, not a wallet. A lab connects once and serves patients from every wallet.
• The rules are open. The health domain pack and the adapters we build are published for anyone to use, including competing wallets.

Our role and business model

What South Africa already has

The Department of Health already runs much of what a network needs. Its Health Patient Registration System has 68.6 million registrations, 37.2 million of them verified, across 3,265 public facilities, and its Master Health Facility List covers more than 55,000 public and private facilities¹². Both are being made available through a national exchange that uses FHIR¹⁹. Doctors can already sign prescriptions electronically, as long as they use an advanced electronic signature¹³.

People already use health services on WhatsApp at national scale. MomConnect, the Department of Health’s service for pregnant women and new mothers, has 5.2 million users³¹, and the department describes WhatsApp as a “game-changer” for it¹².

The government has also committed to shared digital systems. Its Digital Transformation Roadmap, launched in May 2025, covers digital ID, data sharing between systems and payments, and names health for its second phase, from mid-2027³⁰. PayShap, the instant payment system launched in 2023, passed one billion payments in June 2026³².

What’s missing is a shared way for patient apps, clinics, labs and pharmacies to find each other, place orders and send results. A beckn network adds that, and HealthPass is one of the wallets on it. It would work alongside the national exchange rather than replace it. It also has to serve public clinics as well as private providers: 15.5% of South Africans belong to a medical aid³³.

Who does what

How we make money

• The network is not the business. We build it with government and donors as a public good, and no one owns it, including us. That is what lets a government adopt it and other companies build on it.
• Helping organisations join. Clinics, labs, pharmacies, medical aids and health software companies need help with each step of joining: building their software to the specification, getting it certified, registering, running a hosted node for those who don’t want to run their own, and support afterwards. We charge for this work.
• Services through HealthPass. HealthPass competes as one wallet among several. Because every provider on the network can be reached without building a separate connection, HealthPass can offer services on top of the record, such as booking, lab tests and medicine delivery. It earns from these by being the easiest to use, not by holding patients’ data.
• Open networks make room for new businesses. No platform can keep providers or patients to itself, so companies compete on service, and new services become possible: an app for one condition, a medicine delivery service, or a medical aid’s own app, each reaching every provider on the network from day one.
• Who pays for what. Government and donors pay for the shared parts: the domain pack, the open adapters, links to national registers, and pilots. Our income comes from helping organisations join and from HealthPass services.
• Examples from India. Moving Tech built Namma Yatri, a commercial app on an open beckn network, to 150 million trips⁶. On UPI, two apps handle about 79% of all payments¹⁰. Open networks still leave room for successful businesses.

What gets built first

1. A draft health domain pack covering lab orders, prescriptions and appointments, with tests that certify software against it.
2. FHIR-to-beckn adapters, so clinics, labs and pharmacies with modern (FHIR-based) software can join without rebuilding it.
3. An optional link from the network to the Health Patient Registration System, so a patient who chooses to can be found from her ID.
4. A pilot in South Africa with one group of clinics, one lab and a few pharmacies.

Risks

• Health networks have been slow to start. India’s health network on beckn, UHI, was first proposed in 2021 and formally launched in June 2026, with five services live^14,20. It sends every message through a central government hub and has published no usage figures. The latest version of beckn doesn’t need a central hub.
• Subsidies don’t create demand. On ONDC, shopping orders fell from 6.5 million to 4.6 million a month after incentives were cut. Ride-hailing, where a commission-free app met real demand, grew to 56% of all orders¹⁵.
• Getting patients to approve requests is the hard part. In India’s ABDM, providers still rarely share records with the patient’s approval, because patients don’t complete the approval step¹⁶. An app patients already use, on WhatsApp, is the missing piece. That’s where HealthPass fits.
• Other wallets can join the same network. That is intended. HealthPass has to win on WhatsApp’s reach, its assistant and being first, and the business of helping organisations join doesn’t depend on HealthPass winning.
• The health domain pack, rules and certification don’t exist yet. We found no published guide to using beckn and FHIR together for health, and South Africa has no rules or certification process for a health network. Writing them is real work.
• The rules are still changing. POPIA treats health information as specially protected, and new rules for health information took effect in March 2026³⁴. Because HealthPass reaches patients through WhatsApp, it has to show how it meets POPIA when messages pass through Meta’s service. The National Health Insurance Act, signed in May 2024, is before the Constitutional Court, which reserved judgment in May 2026, and none of its sections is in force¹⁷. The network has to work whatever the outcome. The national digital health strategy expired in 2024 and its replacement has not been published³⁵.