Digital Health Infrastructure and Patient Privacy: Is Consent Under the Ayushman Bharat Digital Mission Sufficient to Protect Medical Data?
Year: 2026
Type: article
Abstract: India has built one of the world’s largest digital health systems in about six years. By mid-2026 the Ayushman Bharat Digital Mission (ABDM) had issued over 93 crore Ayushman Bharat Health Account (ABHA) numbers and linked more than 104 crore health records. Its privacy promise rests largely on a single idea: that patients consent to every flow of their data. This article asks whether consent, as the ABDM operationalises it, is sufficient to protect medical data. Through doctrinal analysis of the constitutional, statutory and policy framework, supported by comparative reference to England and the European Union, it argues that consent is necessary but structurally insufficient. Four weaknesses are identified. Consent is often not fully voluntary at enrolment; it is rarely informed in any meaningful sense; its reach is limited by non-consensual pathways and by the persistence of copies; and it cannot answer harms from security failure, re-identification and misuse. The article concludes that the ABDM needs a statutory footing, enforceable duties on those who hold data, independent oversight and design rules that do not depend on patient vigilance, and it shows how the Digital Personal Data Protection Act 2023 could help supply them.
Author: Bhagat, Manveer Singh
Institution: National Law Institute University
Language: English
Subfield: Law
Field: Social Sciences
Domain: Social Sciences
Open Access status: green
OpenAlex ID: W7221516023
FWCI:
Cites:
Cited by:
Related to: