One codebase, two sovereignty regimes.
Building one platform that runs under India's ABDM and DPDP Act and under US HIPAA, without forking the product.
Two rulebooks, one product
India's DPDP Act centers on consent, purpose limitation and the rights of the data principal. HIPAA centers on covered entities, business associates and the minimum-necessary standard. They overlap more than they differ, but forking the codebase to satisfy each turns every feature into two features.
Isolate deployments, share code
Each region runs as its own isolated deployment with its own keys, storage and model endpoints. The code is identical. Region-specific behavior (consent flows, retention periods, breach-notification routes) lives in versioned policy configuration, not in branches.
Isolation inside a deployment
Within a deployment, each hospital is a tenant enforced at the database layer with row-level security, so isolation does not depend on every query being written correctly. Each tenant has its own encryption keys.
Minimum necessary, by construction
When an AI task needs patient context, retrieval returns only the fields that task requires. A claims agent sees billing codes and dates, not psychiatric notes. This meets HIPAA's minimum-necessary standard and DPDP purpose limitation with one mechanism.
Key takeaways
- 1Put regulatory differences in versioned policy, not in code branches.
- 2Enforce tenant isolation in the database, not only in application code.
- 3Scope AI context to the task: it satisfies both regimes at once.