Picture a pharmacist running a busy counter who has this question: "My software vendor says CDSCO doesn't touch billing software. My CA says it might. Who is right?" Suppose they have been using the same Windows desktop software for nine years, have never received an audit notice, and have assumed that meant everything was fine.
The honest answer is: it depends on what your software does, not just what your vendor calls it. CDSCO's Medical Devices Rules, 2017 define a medical device by function — and if your software processes clinical data, generates dosage suggestions, or interfaces with diagnostic equipment, it may fall under that definition regardless of whether the vendor markets it as "pharmacy billing software." The line is not always obvious, and many pharmacy owners in India have never had it explained to them in plain language.
If your vendor cannot give you a clear written answer on this, and you are operating under a drug licence, you are carrying a compliance question you cannot see on your balance sheet. That is the problem this post will help you understand.
The CDSCO Classification Question Most Vendors Avoid Answering
Walk into any pharmacy software sales conversation and ask: "Is your product classified as a medical device under CDSCO Medical Devices Rules, 2017?" Watch how the salesperson responds.
Many will say "no" without being able to explain why. That answer may be correct — pure billing and inventory software typically does not meet the functional threshold for medical device classification. But the word "typically" is doing a lot of work there. The Medical Devices Rules, 2017 define software as a medical device when it is "intended to be used for one or more medical purposes" — including analysis of patient data to aid clinical decisions. If your current software has a drug interaction checker, a dosage calculator tied to patient weight or age, or any feature that generates a clinical recommendation, it may fall within that definition, and it is the vendor's job to know which side of the line its product sits.
The practical risk is uncertainty: if the question is ever raised, you want your vendor's answer on file, not a guess made at the counter.
- Software that only handles billing, inventory, expiry tracking, and GST is generally outside CDSCO's medical device scope.
- Software that generates clinical recommendations — even generic ones — may require CDSCO registration under Class A (lowest risk) or higher.
- Ask your vendor for their CDSCO registration certificate or a written legal opinion that their product does not meet the medical device definition. Keep that document on file.
The cost of not having that document: if an inspector ever raises the question and you have no answer, the burden of proof sits with you, not your vendor.
Schedule H and H1 Register Compliance — Where Software Failure Costs Real Money
Under Rule 65 of the Drugs and Cosmetics Rules, 1945, every Schedule H and H1 supply must be recorded, and Schedule H1 supplies go in a separate register giving the prescriber's name and address, the patient's name, and the drug and quantity, kept for three years (Rule 65(3)(h)). Selling a Schedule H1 drug without a prescription is punishable under Section 27(d) of the Drugs and Cosmetics Act, 1940, with imprisonment of one to two years and a fine of not less than ₹20,000.
Most older desktop billing systems log Schedule H sales — but they rely entirely on the billing operator to flag a medicine as Schedule H at the time of entry. If the operator is racing through a Saturday afternoon queue, that flag gets missed. Picture an owner who only discovers the gap when a state inspector asks for the H1 register and three months of entries are missing for a high-volume antibiotic.
Reconstructing missing register entries after the fact is nearly impossible without complete prescription records. A three-month gap in the H1 register is not a paperwork problem — it is a licence-threatening problem.
The cost of this exposure is difficult to calculate precisely, but it is not only the penalty. It is the legal fees and the days of owner time consumed by an inspection response.
Patient Data Liability Under DPDPA 2023
The Digital Personal Data Protection Act, 2023 (DPDPA 2023) and its Rules are being brought into force in phases. Pharmacy owners are data fiduciaries under this framework: you collect names, phone numbers, and prescription histories. If that data is stored on an unencrypted local hard drive, or in a cloud system where your vendor has not published a data processing agreement, you are holding personal data without a defensible compliance position.
This is not a theoretical risk. Picture a pharmacy that stores years of customer prescription records on a desktop machine that was never encrypted — it has no way to demonstrate DPDPA compliance if a regulator asks. The Act provides for penalties that scale with the nature and volume of the breach.
If neither the pharmacy nor its software vendor has revisited how patient data is stored since DPDPA 2023 passed, that combination is where the liability lives.
What Compliant, Day-to-Day Operations Actually Look Like
The goal is not to spend your mornings worrying about CDSCO classifications and DPDPA notices. The goal is to operate in a way where these questions have clear, documented answers and require zero daily effort to maintain.
Here is what the before and after looks like for a busy pharmacy:
| Situation | Before | After |
|---|
| Schedule H1 register | Manually flagged, gaps common | Logged at billing; pharmacist adds the prescriber's address |
| Patient data storage | Local hard drive, no encryption policy | Cloud with documented data processing |
| Software CDSCO status | Unknown, verbal assurance from vendor | Written vendor statement on file |
| GST filing (5% on most medicines, HSN 3004) | Reconciled manually each month | Exported from the billing records |
| Expiry returns | Discovered during manual stock checks | Flagged 30+ days before expiry |
The pharmacist's time that was going to manual reconciliation is redirected to the counter. Even a small reduction in billing errors and missed Schedule H flags protects real margin over a year for a pharmacy running this volume. That is before accounting for the avoided fine exposure.
How Nesayo Handles This in Practice
On Nesayo, a Schedule H1 sale is logged at billing, not as a separate step: the date, medicine, batch, quantity and bill number, with the patient and prescriber names entered on the bill. Nesayo does not record the prescriber's address yet, so the pharmacist adds it to complete the Rule 65(3)(h) register. Schedule flags come from a catalogue of 2,54,034 medicines, whose schedule data is advisory, and from rules that recognise H1 salts; a medicine no rule can place is treated as prescription-only (Schedule H) until the pharmacist says otherwise.
The Expiry Guard agent — one of five AI agents on the AI Employee plan — sorts stock nearing expiry into 30, 60 and 90-day groups with a discount or return suggestion for each, and the Morning Briefing puts it in front of the pharmacist. Picture what that changes day to day: the return decision is waiting before the shutter is open for the day. The distributor call happens at 9 AM instead of being discovered during a quarterly stock count when the return window has already closed.
Voice billing in Hindi and English (beta, on paid plans) means the operator entering bills does not need to slow down to type medicine names — they say the name, and the entry is matched to a product on the pharmacy's own shelf, with its schedule. On a busy counter, that removes a category of entry error that generates compliance gaps.
Billing on Nesayo is free, permanently. Paid plans start at ₹399 per month (as of September 2026) on Starter (voice billing, prescription scanning and Refill Radar); all five AI agents — Morning Briefing, Expiry Guard, Refill Radar, Stock Sense, and Payment Advisor — come on the AI Employee plan at ₹999 per month (as of September 2026), which also adds a Tally export; GSTR-1 and GSTR-3B summaries for your CA come with every plan. Chain pharmacies with multiple stores use the Chain plan at ₹2,999 per month plus ₹999 per extra pharmacy (as of September 2026, per nesayo.com/pricing).
On the CDSCO question: Nesayo is billing and inventory software. Its drug-interaction warnings, on the counter's save screen and on bills drafted in chat, are informational only and do not replace the pharmacist's judgement. If you want any vendor's position on CDSCO scope in writing — ours included — ask for it.
The Choice in Front of You Right Now
If you continue running software where the Schedule H1 register depends on an operator remembering to flag a medicine at 6 PM on a Saturday, that gap compounds every day. If your vendor cannot tell you in writing whether their software requires CDSCO registration, that uncertainty is sitting next to your drug licence. The pharmacies that get through inspections cleanly are the ones whose records are complete and whose software questions have documented answers.
The pharmacies that don't are the ones that spend the next six months dealing with the aftermath.
Spend 2 minutes at nesayo.com/demo — a sample pharmacy is pre-loaded, no signup required. Bill a medicine and see the schedule flag and the earliest-expiring batch picked for you, and see what your expiring stock looks like 30 days out.
---
FAQ
Is pharmacy billing software classified as a medical device by CDSCO in India?
Pure billing and inventory software — software that does not generate clinical recommendations or process diagnostic data — generally does not meet the functional definition of a medical device under CDSCO Medical Devices Rules, 2017. However, if your software includes drug interaction alerts, dosage calculators linked to patient parameters, or any feature intended to aid a clinical decision, it may require CDSCO registration. Ask your vendor for a written statement, not a verbal assurance.
What is the CDSCO Medical Devices Rules 2017 definition of software as a medical device?
Under the Medical Devices Rules, 2017, software qualifies as a medical device when it is "intended to be used for one or more medical purposes" without a physical hardware component. The key word is "intended" — it is determined by the vendor's intended purpose and the software's actual functions, not just by its marketing label. Software intended purely for administrative and billing purposes typically falls outside this definition.
Does Schedule H1 register have to be maintained digitally or can it be a paper register?
The Drugs and Cosmetics Rules do not mandate a digital format — a physical register maintained as per Rule 65 requirements remains legally valid. However, entries recorded by software at the moment of billing are less prone to gaps than a manual register updated by a counter operator during peak hours — as long as every required particular, including the prescriber's address, ends up in the record. Either format must be retained for three years and must be available for inspection on demand.
What happens if a state drug inspector finds gaps in my Schedule H1 register?
Rule 65(3)(h) requires every Schedule H1 supply to be recorded with the prescriber's name and address, the patient's name, and the drug and quantity, and the licensing authority can act against a licence for breaches of the Rules. Selling a Schedule H1 drug without a prescription is punishable under Section 27(d) of the Drugs and Cosmetics Act, 1940: imprisonment of one to two years and a fine of not less than ₹20,000. The inspector's discretion matters, but incomplete records with demonstrable gaps are difficult to defend regardless of the explanation offered.
Does DPDPA 2023 apply to pharmacy patient prescription records?
Yes. Prescription records containing patient names, contact details, and medicine histories constitute personal data under the Digital Personal Data Protection Act, 2023. Pharmacies that collect and store this data are data fiduciaries under the Act and are expected to handle this data with appropriate security safeguards. The Act's Schedule sets the penalty amounts, and the detailed rules decide what applies to your pharmacy and from when — consult a legal advisor familiar with the Act for guidance specific to your pharmacy's data volumes and storage setup.
What does GST at 5% apply to in a pharmacy, and what is the HSN code?
Medicines formulated for human or veterinary use generally fall under HSN 3004 and attract GST at 5%. The old 12% slab was withdrawn from 22 September 2025 (Notification 9/2025-Central Tax (Rate), after the 56th GST Council), and what sat in it moved to 5%. Some items stocked by pharmacies — surgical consumables, cosmetics, health supplements — may attract different rates. Verify the applicable HSN and rate for each product category with your CA, as misclassification affects both your GST liability and your input tax credit claims.
Is FEFO (First Expired First Out) a legal requirement for Indian retail pharmacies?
FEFO is not explicitly mandated by name in the Drugs and Cosmetics Rules for retail pharmacies, but the obligation to not dispense expired medicines is absolute. In practice, FEFO batch selection is the only reliable method to prevent expired stock from being billed ahead of newer stock, particularly in pharmacies stocking medicines across multiple purchase batches. State drug controllers may consider inventory management practices during inspections — following FEFO is a defensible standard even where it is not formally codified.
How do I check if my current pharmacy software vendor has CDSCO registration for their product?
CDSCO maintains a public database of registered medical devices. You can search the CDSCO online portal by manufacturer name or device category. If your vendor claims their software does not require CDSCO registration, ask them to provide a written legal opinion or a copy of the CDSCO classification guidance they relied on. A vendor who cannot produce either document within a reasonable timeframe is not in a position to give you reliable compliance assurance.