DPI Brief — September 14, 2026

Sunday edition, and the news cycle is thinner — but the tail of Global Fintech Fest and follow-through from the BRICS Summit produced substantive movement across four layers of the stack: a workforce push for health records, the money question underneath UPI, open commerce finding a new vertical, AgriStack reaching new states, and a live security incident on a government portal that deserves more attention than it is getting.

1. NHA launches a digital academy to train the health-records workforce [L5 — Sectoral]

The National Health Authority has launched digital health courses through a new digital academy to speed up integration of electronic medical records and hospital information systems nationwide — a first for the agency that runs ABDM. Alongside technical modules on EMR and HIS integration, the learning portal carries open-access baseline courses on ABDM and Ayushman Bharat PM-JAY, and district administrations have been asked to push local healthcare workers through them. States must submit nominations for paid certifications by September 15. The context: over 974.5 million ABHA IDs now exist, but record-linkage quality depends on hospital staff who actually operate the systems. Training is the unglamorous layer between identifiers and usable health records — and it has been the bottleneck.

2. UPI MDR moves closer to a final decision — and banks may pocket the biggest share [L2 — Payments]

The merchant discount rate proposal for UPI is nearing a final call, with a notification detailing the fee structure expected in the next few weeks and modalities now with NPCI. The Economic Times reports banks are positioned to take the largest slice of the MDR. Two guardrails hold for now: Finance Minister Nirmala Sitharaman has said users will face no tax or transaction charge, and small merchants are not to be levied MDR. But note the arithmetic underneath — UPI logged 24.51 billion transactions worth ₹29.82 lakh crore in August, with person-to-merchant payments making up 63% of volume but only 30% of value. Whoever absorbs the cost of processing low-value P2M traffic, the consumer-facing promise of “free UPI” will depend on how transparently the split is designed. Watch the incentive-payout line in the next budget: NPCI had earlier capped UPI merchant charges around 0.30%, and government compensation for the shortfall has declined every year.

3. Visa and ONDC explore tourism discovery on the open network [L4 — Commerce]

At GFF 2026, Visa and ONDC announced an intent to explore collaboration on tourism discovery and digital commerce — how travellers find destinations, itineraries and local businesses on open-network rails. ONDC’s Hrushikesh Mehta noted the network has crossed 500 million lifetime transactions and sees tourism as the next sector after retail, financial services and logistics. It is an intent document, not an integration — but pairing a global card network’s discovery traffic with an open protocol is exactly the pattern that made ONDC’s mobility and agri pilots interesting. The open question, as ever with ONDC: does discovery translate into seller-side economics for the small operators the network is meant to serve?

4. AgriStack rollout reaches Goa as UP crosses 86% farmer registration [L5 — Sectoral]

Goa has begun rolling out AgriStack, issuing its first five Farmer IDs, with CM Pramod Sawant framing the digital identity as a route to transparent agricultural services. Meanwhile Uttar Pradesh reports 2.5 crore farmers registered — 86.88% of target — alongside village geo-referencing and a Dynamic Farmer Registry that updates as land-records change. The contrast is the story: the infrastructure is now being switched on in India’s smallest states years after the big agricultural ones scaled it. What matters next is whether farmer IDs actually shorten the path to credit — credit-mobilisation pilots built on AgriStack data are the use case to watch.

5. A government portal served a fake-Cloudflare malware trap — CERT-In is on it [L7 — Trust]

A subdomain of STPI — the government body that hosts IT-export infrastructure — was found serving a spoofed Cloudflare “verify you are human” page that silently loads a malicious string into visitors’ clipboards and instructs them to paste it into Windows Terminal — the emerging “TerminalFix” pattern. The external script sat on a domain less than a week old, and remained embedded even after the overlay briefly disappeared. Researcher Vibhum Dubey reported it to STPI and CERT-In, which acknowledged it is “in process of taking appropriate action.” The lesson generalises beyond STPI: government domains carry a trust halo that attack kits deliberately exploit, and no verification page should ever ask you to open a terminal. If a CAPTCHA wants shell commands, it is not a CAPTCHA.

Quick hits