Decoding India’s Digital Health Framework

The NDHM, ABDM and the Health Data Management Policy, 202024 Oct 2026  AgreyaLegal Data Protection Team

Introduction: From a Policy Vision to a Digital Mission

India’s health sector is moving from paper files to a connected digital system. The engine of this change is the National Digital Health Mission (NDHM), conceived by the Ministry of Health and Family Welfare (MoHFW) and now known as the Ayushman Bharat Digital Mission (ABDM).

The seed of the mission lies in the National Health Policy, 2017. That policy envisaged (imagined and planned) the digitisation of the entire healthcare ecosystem from patients’ health records to databases of hospitals, clinics and other facilities.

The core idea is interoperability (the ability of different systems to talk to each other and exchange data). A patient’s record created in one hospital should be usable, with consent, by a doctor in another. For businesses handling health information, this creates opportunity and a matching duty of care. As the maxim goes, Salus populi suprema lex esto (the welfare of the people shall be the supreme law).

The Architecture of ABDM: Registries, Not a Central Vault

ABDM rests on three foundational registries:

• ABHA (Ayushman Bharat Health Account): a unique health identity for each participating individual.
• HPR (Healthcare Professionals Registry): a verified directory of doctors, nurses and other professionals.
• HFR (Health Facility Registry): a verified directory of hospitals, clinics, laboratories and pharmacies.

The National Digital Health Blueprint (NDHB), 2019 gives this ecosystem its design. It proposes a federated architecture (a structure where data stays with the many bodies that create it, rather than in one central store). Its building blocks are a Unique Health Identifier, registries for patients, providers and facilities, privacy and consent management, national portability, Electronic Health Record (EHR) standards, and delivery of services through multiple access channels.

Public confidence in these platforms including the Integrated Health Information Platform (IHIP), a real-time, web-based disease surveillance system of the MoHFW is now reinforced by the Digital Personal Data Protection Act, 2023 (DPDPA).

The Guiding Principles of the NDHB

The NDHB recommends principles meant to let the ecosystem evolve organically, rather than be built once and frozen.

Sectoral principles	Technology principles
Universal health coverage	Building blocks
Inclusiveness	Interoperability
Security and privacy by design	Registries as single sources of truth
Education and empowerment of citizens	Open standards and open APIs
	A minimalistic approach

The minimalistic approach (collecting and building only what is truly necessary) is regarded as the most important principle of all. It mirrors the data-minimisation logic of modern privacy law: what is never collected can never be leaked.

Voluntary Participation, the Health ID and Aadhaar

Participation in the National Digital Health Ecosystem (NDHE) is voluntary. An individual who opts in is issued a Health ID, as defined under the Health Data Management Policy, 2020 (HDMP).

When availing health services, the individual’s ID may be verified through Aadhaar or any other method of identification specified by the NDHM. Crucially, failure or refusal to use Aadhaar for authentication cannot result in denial of access to any health facility or service.

This safeguard reflects the maxim Consensus facit legem (consent makes the law). Participation must flow from free choice, not compulsion.

Scope and Applicability: Who Does the Policy Cover?

The HDMP has an expansive (wide-reaching) scope. It applies not just to hospitals and doctors but to every participant in the NDHE that collects, accesses, shares, stores or otherwise processes personal health information. Its aim is simple: privacy must be protected across the entire data lifecycle, whoever holds the data.

Participant	How they handle health data	Key obligation or limit
Registered individuals	Create an ABHA and link their records	Decide, through consent, whether records are shared with other providers
Healthcare professionals and facilities	Collect histories, diagnostic reports and treatment records	Confidentiality, appropriate access and secure handling; also covers any entity transmitting personal data electronically in such transactions
Government bodies and regulators (MoHFW, NHA, professional bodies)	Govern, implement and regulate the ecosystem	Set standards, oversee participation, support compliance within their legal mandates
Insurers and healthcare payers	Process data to settle claims and decide eligibility	Access must be tied to a specific purpose and legal authority
Pharmaceutical and medical device companies	Clinical research, product safety monitoring, device services	No automatic right to patient records merely for belonging to the health industry
Researchers and public health institutions	Surveillance, statistics, epidemiological studies	Use must be tested against permissions, confidentiality and safeguards
Technology providers and ecosystem partners	Host, administer and process data for healthcare organisations	Act on behalf of, and within the instructions of, those organisations

The position of pharmaceutical companies deserves emphasis. Industry membership is not a licence to access records — a point every compliance team should internalise (absorb and accept fully).

Applicability Turns on Participation and Processing

The policy does not ask what industry an organisation belongs to. It asks two questions: is the entity or process part of the NDHE, and does it handle personal data within that ecosystem? Function, not label, is determinative (the deciding factor).

The policy also extends to every channel of communication used to share health records, not merely digital ones. Yet not every offline record or conversation attracts every provision; the scope and processing circumstances must still be examined case by case.

The practical lesson is to map every hand that touches health data. Consider one patient journey:

1. A hospital collects the patient’s information.
2. A laboratory generates the diagnostic results.
3. An insurer processes the claim.
4. A technology provider hosts the systems behind all three.

Each participant’s role and obligations must be assessed separately. Responsibility does not rest with one organisation alone. Organisations should know which employees and vendors can access patient data, why that access is necessary, and how data moves between participants.

Where the DPDP Act, 2023 Fits In

The HDMP is a policy framework for the ABDM ecosystem; the DPDPA is binding statute (law enacted by Parliament). Health data is personal data under the DPDPA, so entities in the NDHE must comply with both.

The patient journey above maps neatly onto DPDPA roles. The hospital, laboratory and insurer will usually be Data Fiduciaries (entities that decide why and how personal data is processed). The technology provider will usually be a Data Processor (an entity that processes data on a fiduciary’s behalf). The fiduciary remains accountable for its processor’s conduct.

Three DPDPA obligations stand out for healthcare entities:

• Consent and notice: clear, specific consent before processing, with an easy right to withdraw.
• Reasonable security safeguards: failure to prevent a personal data breach can attract a penalty of up to ₹250 crore.
• Legitimate uses: Section 7 permits processing without consent to respond to a medical emergency involving a threat to life or an immediate threat to health.

The last point embodies the maxim Necessitas non habet legem (necessity knows no law). But it is a narrow gateway, not a general exemption. Ignorantia juris non excusat (ignorance of the law is no excuse) — compliance cannot wait for the first complaint.

Frequently Asked Questions

1. Is it mandatory to create an ABHA ID? No. Creating an ABHA ID and participating in ABDM is entirely voluntary. A person without an ABHA ID can still receive medical treatment.

2. Does the government store all my medical records on a central server? No. ABDM follows a decentralised, federated model. Records stay with the hospital or doctor that created them. The central system only maintains the core registries (ABHA, HPR and HFR) and facilitates consent-based data flow.

3. How do I share my records with a new doctor? Through an ABHA-linked Personal Health Record app, such as the ABHA app or Aarogya Setu. The doctor requests access, and you receive a notification seeking your explicit digital consent before any data is shared. You can revoke this consent at any time.

4. Can I view my insurance claims under PMJAY, CAPF, CGHS and private policies in Aarogya Setu 2.0? Yes. Aarogya Setu 2.0 offers an insurance wallet powered by the National Health Claim Exchange (NHCX). It lets users track entitlements, policy details, coverage, past claims and claim status in one place.

5. Can a healthcare professional access patient records in ABDM without a Healthcare Professional ID? No. A professional must be registered on the HPR, and patient records are accessible only with the patient’s consent.

6. What information does the Healthcare Professionals Registry collect? Only what is needed to verify a professional’s identity and credentials: demographic, contact, registration, academic and place-of-work details. This reflects the minimalistic approach.

7. Why is a Healthcare Professional ID needed to register in the Health Facility Registry? It works as a single authentication mechanism across ABDM services, so users need not enter credentials repeatedly. It also prevents unauthorised persons from accessing facility details.

8. What happens in a medical emergency when the patient cannot consent? Under Section 7 of the DPDPA, processing to respond to a medical emergency involving a threat to life or an immediate threat to health is a legitimate use and does not require prior consent. Good practice is to inform the patient as soon as practicable afterwards.

Conclusion: Compliance as a Competitive Advantage

The ABDM promises a healthcare system that is connected, portable and patient-centric. Its success, however, depends on trust — and trust depends on demonstrable (clearly provable) respect for privacy.

For hospitals, insurers, health-tech firms and pharmaceutical companies, the takeaway is clear. Map your data flows, define each participant’s role, secure consent properly, and build safeguards before regulators or litigants test them. Vigilantibus non dormientibus aequitas subvenit (the law assists the vigilant, not those who sleep on their rights).

How AgreyaLegal can help: AgreyaLegal’s data protection team advises healthcare organisations on ABDM participation, HDMP alignment and DPDPA compliance — from data mapping and consent architecture to vendor contracts and defence against data protection claims. Contact us to assess your readiness.

Disclaimer: This article is for general information only and does not constitute legal advice.

This note is general information and is not legal advice. The law may have changed since it was written, and how it applies depends on the facts of each case.

All posts