A patient walks into a government hospital in Pune. She’s been referred from a clinic in Chennai — a clinic she visited two years ago after a difficult pregnancy. The registration desk attendant asks for her ABHA number. She recites it. The attendant types it in. Within seconds, a doctor she has never met is looking at her discharge summary from Chennai and her follow-up lab reports. He can also see a prescription for a condition she has told almost nobody about.
This is not a breach. This is the system working exactly as designed.
The Ayushman Bharat Digital Mission is building something extraordinary: a unified health record system for 1.4 billion people. It is designed so your medical history follows you everywhere in the Indian healthcare system. Whether that sounds like progress or surveillance depends heavily on whether you understood what you agreed to when you created your ABHA ID.
The short answer: Your ABHA is a 14-digit health ID that links your medical records across participating providers. It is an address, not a store: records stay with the hospitals and labs, and access runs through a consent system. The main privacy gaps are weak consent in busy government hospitals, the Aadhaar linkage, no published independent security audit, and enforcement of the DPDPA that is still ramping up. Your best protection is to create your ABHA deliberately and manage your consent log in the ABHA app.
What are ABDM and ABHA?
The Ayushman Bharat Digital Mission (ABDM) launched in September 2021. It is administered by the National Health Authority (NHA), which sits under the Ministry of Health and Family Welfare. The ambition is large. It aims to replace the fragmented, paper-heavy records system that has defined Indian healthcare for decades. In its place: a federated digital infrastructure that links every provider, every patient, and every record.
The patient-facing piece of that infrastructure is the ABHA — the Ayushman Bharat Health Account. It is a 14-digit unique health identifier, created either through Aadhaar-based verification or through a mobile number. Once created, it becomes the linking key that ties your medical records across all healthcare providers participating in the ABDM network.
ABHA is not a health record. It is an address. The records themselves stay with the hospitals, labs, and pharmacies that generated them. What ABHA does is make those records findable, retrievable, and shareable — across providers, across cities, and across time — through a consent-based access system.
That distinction — ABHA as address, not store — matters when thinking about privacy. It also creates its own complications, as we’ll get to.
Participation in ABDM is not mandated for most providers, but the government has been pushing hospitals, especially public ones, to integrate. As of early 2026, tens of thousands of healthcare facilities are registered on the ABDM network, along with thousands of labs and pharmacies.
What gets linked to your ABHA ID
When a participating provider links a health interaction to your ABHA number, these are the categories of records that can be associated:
Discharge summaries. Any inpatient stay at a registered hospital — the summary prepared on discharge, including diagnosis, procedures, and follow-up instructions.
Prescriptions. Digital prescriptions issued by registered doctors. Pharmacy dispensing records from participating pharmacies can also be linked.
Diagnostic reports. Blood tests, urine analysis, imaging reports (X-rays, MRIs, ultrasound), pathology findings — anything generated by a lab or diagnostics center registered on the ABDM network.
Immunization records. Vaccine records, including those linked through the CoWIN platform, which was integrated with ABDM infrastructure.
Chronic condition management records. If you’re being managed for diabetes, hypertension, or another ongoing condition and your provider participates, those longitudinal records can be linked and tracked over time.
The storage model is federated. The NHA does not hold a central copy of your MRI or your discharge summary. Those stay with the Health Information Provider — HIP — that created them. What is centralized is the consent log and your ABHA identity — the registry that knows which providers hold records tagged to your ID and what consents are currently active.
This model was a deliberate design choice. It reduces the catastrophic-breach risk of a single central repository. It also means that if a hospital’s own systems are compromised, your records there are exposed — that is a provider-side risk, not an ABDM-specific one.
The consent architecture — and where it breaks down
The ABDM framework is built on what the NHA describes as consent-based health data sharing. Here is how it’s supposed to work.
Healthcare providers on the ABDM network fall into two roles. Health Information Providers (HIPs) generate and hold records. Health Information Users (HIUs) are entities that want to access records. A doctor at a new hospital, for example, acts as a HIU when they want to pull your records from a previous provider.
When a HIU wants to access records linked to your ABHA ID, they must submit a consent request. You receive that request through a PHR — Personal Health Record — application. The consent request specifies which categories of records are being requested, the purpose, and the time window for which access is being sought. You approve or deny it. If you approve, the requesting HIU gets time-limited, purpose-specific access.
PHR applications that participate in this system include the government’s own ABHA app (previously integrated with Aarogya Setu). Others include Practo, PharmEasy, and private health platforms that have joined the ABDM ecosystem. The consent mechanism in these apps is reasonably well-designed. You can see pending requests, review active consents, and revoke access.
The problem is not the app. The problem is what happens before anyone opens the app.
Busy government hospitals are the ones integrating with ABDM most aggressively. There, registration often goes like this. A patient arrives. A desk attendant asks for their ABHA number, or helps them create one on the spot, links their records, and moves on to the next patient. Time-limited consent, purpose-specific access, the ability to revoke: none of these are explained. In many cases, patients don’t know a PHR app is involved at all, or that consents can be managed through it.
This is the real consent gap in the ABDM architecture. The system provides the tools for meaningful consent management. The implementation, particularly in public health settings serving patients with low digital literacy, frequently doesn’t use them.
Who can actually see your records
Within the ABDM framework, access to records linked to your ABHA ID falls into several categories.
Providers you explicitly consent to. This is the intended primary use case — a doctor at a new hospital requests access, you approve it, they can see relevant records for the duration you specified.
Emergency access. ABDM has provisions for situations where a patient cannot provide consent — emergencies, unconsciousness. In these cases, certain emergency access mechanisms can be activated. The specifics of what can be accessed, and by whom, without prior consent are defined in the ABDM framework documents. That scope is deliberately broad enough to be useful in genuine emergencies. Whether it is narrow enough to prevent misuse is a separate question.
Research and public health. The ABDM framework includes provisions for the use of de-identified health data for public health research and epidemiological surveillance. The NHA has described this as a significant potential benefit — and it is. Population-level insights from unified health records could transform India’s public health response capacity. The privacy concern here is whether de-identification is robust enough, and under what conditions identified data could be accessed by government agencies for public health surveillance purposes. The framework language on this is broad.
Government agencies. This is where the architecture meets India’s broader governance context. Health data collected through systems integrated with Aadhaar-based identity sits in a regulatory environment where data protection enforcement is still ramping up. The Digital Personal Data Protection Act passed in 2023 and applies a unified personal data framework. Health data is personal data under the DPDPA, with heightened obligations applying to Significant Data Fiduciaries designated by the central government, not tiered by data category. Its rules were notified in November 2025, but most substantive duties phase in through 2027, and full penalty-backed enforcement is not yet active. Until it is, the practical protections against government access to ABDM-linked data are primarily architectural and procedural, not legal.
The privacy concerns worth taking seriously
There are a few issues that deserve more attention than they typically get in coverage of ABDM.
The Aadhaar linkage. ABHA linked to Aadhaar is not just a convenient identity layer. Aadhaar also connects to your bank accounts through Aadhaar-enabled payments, your tax identity, and your telecom SIM through eKYC. It can even reach your location data through devices tied to Aadhaar-authenticated services. When your health record is connected to the same 12-digit number that connects all of those, the theoretical surface of any breach or unauthorized access becomes significantly larger. A compromise of your ABHA-linked health data is, in principle, one step away from a much more complete profile.
No published independent audit. As of early 2026, no independent security audit of the ABDM infrastructure had been published. The NHA has described internal security standards, referenced compliance with ISO 27001 frameworks, and noted that the federated model limits central-store risk. These are legitimate points. They are not a substitute for a published third-party audit of the kind that would allow independent assessment of whether the architecture is actually secure in practice.
Consent UI versus consent understanding. The PHR apps participating in ABDM present consent in reasonably clear language. But “reasonably clear” and “meaningfully informed” are different standards. A consent dialog that lists categories of records and a time window is legible to a digitally literate patient who is not in a hurry. It is often not meaningfully understood at a government hospital counter. Picture a patient who speaks a language other than Hindi or English, has limited smartphone literacy, and is focused on getting care rather than reading consent disclosures.
The insurance question. India’s health insurance market is growing rapidly. Health insurers could gain access to longitudinal ABHA-linked records, through consent, affiliated PHR apps, or future regulatory changes. If they do, the implications for premium pricing, claim denials, and underwriting are significant. The current ABDM framework does not explicitly prohibit this pathway. It is worth watching.
What you can do right now
These are concrete steps, not general advice.
Create your ABHA ID deliberately, not by default. ABHA is not automatically generated for all Indians. You create it voluntarily. If you want one, go to the official ABHA app or abdm.gov.in and create it on your own terms. Do not let it happen at a hospital registration desk where the process may not be explained clearly.
Open the ABHA app and review your consent log. If you already have an ABHA ID, open the ABHA app (or Aarogya Setu, which integrates with it) and look at the consents currently active. You may find consents you don’t remember granting, or consents for providers you no longer use. Revoke anything you didn’t knowingly authorize.
Limit the time window on future consents. When granting a provider access to your records, the consent interface allows you to specify a time period. Use it. A doctor treating you for a specific condition does not need six months of access — choose the shortest window that covers your treatment.
Check which PHR apps have your consent. Practo, PharmEasy, and other participating apps are HIUs that may hold active consents to access your records. If you’ve used any of these apps and granted access, verify whether that consent is still active and revoke it if you’ve stopped using the service.
If records were linked without a clear explanation, you can withdraw. If a hospital worker linked your records at a registration desk without explaining what consent means, that link is not permanent. You can revoke the consent through the ABHA app. The records themselves stay with the provider — but access to them through the ABDM network can be cut.
Think through the trade-off honestly. ABHA genuinely helps patients with complex medical histories. If you’ve been managing a chronic condition across multiple providers, or if you’ve needed emergency care away from your home city, having your records accessible is not a small benefit. The privacy calculus is real on both sides. Opting out entirely because of privacy concerns is a legitimate choice. So is opting in carefully, understanding what you’re consenting to.
The bigger picture
India is building health data infrastructure that most developed countries are still trying to put together. The NHS in the UK took the better part of two decades to partially connect its health records system. The US healthcare system remains fragmented in ways that cause measurable patient harm every year. ABDM, if it reaches scale and maintains architectural integrity, could genuinely be one of the more significant public health infrastructure achievements of this decade.
That potential is real. So are the risks.
The main protection gap is not the ABDM architecture itself — the federated model, the consent framework, and the HIU/HIP structure are reasonable design choices. The gap is in three places: meaningful consent enforcement in the field, independent security auditing that goes beyond internal compliance attestations, and a functioning data protection law with active enforcement. Until all three are in place, the system asks patients to trust that the architecture will be implemented as designed, and that access will be limited to what’s disclosed.
Trust is not nothing. It is also not sufficient.
Watch the DPDPA enforcement timeline. Watch whether the NHA commissions and publishes independent audits. Watch whether insurance industry lobbying succeeds in opening ABDM data to underwriting. And in the meantime, manage your own consent log — it’s one of the few tools you actually control.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.