Digital Health Infrastructure and Patient Privacy: Is Consent Under the Ayushman Bharat Digital Mission Sufficient to Protect Medical Data?
DOI:
https://doi.org/10.5281/zenodo.23310596Ключевые слова:
Ayushman Bharat Digital Mission, Informed Consent, Health Data PrivacyАннотация
India has built one of the world’s largest digital health systems in about six years. By mid-2026 the Ayushman Bharat Digital Mission (ABDM) had issued over 93 crore Ayushman Bharat Health Account (ABHA) numbers and linked more than 104 crore health records. Its privacy promise rests largely on a single idea: that patients consent to every flow of their data. This article asks whether consent, as the ABDM operationalises it, is sufficient to protect medical data. Through doctrinal analysis of the constitutional, statutory and policy framework, supported by comparative reference to England and the European Union, it argues that consent is necessary but structurally insufficient. Four weaknesses are identified. Consent is often not fully voluntary at enrolment; it is rarely informed in any meaningful sense; its reach is limited by non-consensual pathways and by the persistence of copies; and it cannot answer harms from security failure, re-identification and misuse. The article concludes that the ABDM needs a statutory footing, enforceable duties on those who hold data, independent oversight and design rules that do not depend on patient vigilance, and it shows how the Digital Personal Data Protection Act 2023 could help supply them.
Скачивания
Библиографические ссылки
Acquisti, A., Brandimarte, L. and Loewenstein, G. (2015) ‘Privacy and Human Behavior in the Age of Information’, Science, 347(6221), 509–514.
Balkin, J.M. (2016) ‘Information Fiduciaries and the First Amendment’, UC Davis Law Review, 49(4), 1183–1234.
Barocas, S. and Nissenbaum, H. (2014) ‘Big Data’s End Run around Anonymity and Consent’, in Lane, J. et al. (eds), Privacy, Big Data, and the Public Good. Cambridge: Cambridge University Press, 44–75.
Ben-Shahar, O. and Schneider, C.E. (2011) ‘The Failure of Mandated Disclosure’, University of Pennsylvania Law Review, 159(3), 647–749.
Digital Personal Data Protection Act 2023 (Act No. 22 of 2023) (India).
Digital Personal Data Protection Rules 2025 (Ministry of Electronics and Information Technology, G.S.R. 846(E), 13 November 2025) (India).
European Parliament and Council (2016) Regulation (EU) 2016/679 (General Data Protection Regulation).
European Parliament and Council (2025) Regulation (EU) 2025/327 on the European Health Data Space.
IANS (2023) ‘From AIIMS Delhi to ICMR, data breaches haunt crores of Indians’, 12 November.
Available at: https://greaterkashmir.com/world/from-aiims-delhi-to-icmr-data-breaches-haunt-crores-of-indians
Information Technology Act 2000 (India), s 43A.
Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (G.S.R. 313(E)) (India).
Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1 (Puttaswamy I).
Justice K.S. Puttaswamy (Retd) v Union of India (2019) 1 SCC 1 (Puttaswamy II).
Matthan, R. (2017) Beyond Consent: A New Paradigm for Data Protection, Takshashila Discussion Document 2017-03. Bengaluru: Takshashila Institution.
McDonald, A.M. and Cranor, L.F. (2008) ‘The Cost of Reading Privacy Policies’, I/S: A Journal of Law and Policy for the Information Society, 4(3), 543–568.
MediaNama (2022) Report on the revised Health Data Management Policy, June.
Available at: https://www.medianama.com/2022/06/223-new-health-data-management-policy/
Ministry of Health and Family Welfare (2018) Digital Information Security in Healthcare Act (DISHA) (draft). New Delhi: Government of India.
Mr ‘X’ v Hospital ‘Z’ (1998) 8 SCC 296; Mr ‘X’ v Hospital ‘Z’ (2003) 1 SCC 500.
National Data Guardian (2016) Review of Data Security, Consent and Opt-Outs. London: National Data Guardian.
National Health Authority (2022) Health Data Management Policy, Draft Version 2, April. New Delhi: Government of India.
Nissenbaum, H. (2010) Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford: Stanford University Press.
Press Information Bureau (2026) Ayushman Bharat Digital Mission, Ministry of Health and Family Welfare, 6 July.
Rajya Sabha (2022) Health Data of Patients, Question No. 258, answered 20 December. Ministry of Health and Family Welfare.
Richards, N. and Hartzog, W. (2016) ‘Taking Trust Seriously in Privacy Law’, Stanford Technology Law Review, 19, 431–472.
Rocher, L., Hendrickx, J.M. and de Montjoye, Y.-A. (2019) ‘Estimating the Success of Re-identifications in Incomplete Datasets Using Generative Models’, Nature Communications, 10, 3069.
S.S. Rana & Co. (2025) ‘MeitY Notifies Final Digital Personal Data Protection Rules 2025’.
Available at: https://ssrana.in/articles/meity-notifies-final-digital-personal-data-protection-rules-2025/
Samira Kohli v Dr Prabha Manchanda (2008) 2 SCC 1.
SFLC.in (2022) Comments on the Draft Health Data Management Policy, Version 02.
Available at: https://sflc.in/sflcins-comments-draft-health-data-management-policy-version-02
Solove, D.J. (2013) ‘Privacy Self-Management and the Consent Dilemma’, Harvard Law Review, 126(7), 1880–1903.
Srikrishna Committee (2018) A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians. Report of the Committee of Experts under the Chairmanship of Justice B.N. Srikrishna. New Delhi: Ministry of Electronics and Information Technology.
Загрузки
Опубликован
Заявление о доступности данных
The data used in research for this article is available in public domain but the curated article is nowhere present in the public domain.
Выпуск
Раздел
URN
Лицензия
Copyright (c) 2026 Oxford Law Review
Это произведение доступно по лицензии Creative Commons «Attribution» («Атрибуция») 4.0 Всемирная.
Content published by Oxford Law Review is made available subject to the copyright and licensing terms applicable to the individual article.
Unless otherwise stated on the article page, the following terms apply:
1. Copyright
Copyright in published articles remains subject to the rights and terms specified for the respective publication. Authors and users should respect all applicable copyright and intellectual property laws.
2. Use of Published Material
Published articles may be accessed, read, cited and referenced for legitimate scholarly, educational and research purposes, subject to applicable copyright and licensing restrictions.
3. Reproduction
Reproduction, redistribution, adaptation or commercial use of published material is permitted only where expressly authorised by the applicable licence or by the relevant copyright holder.
4. Citation and Attribution
Any permitted use of material published by Oxford Law Review must provide appropriate bibliographic attribution, including the author, article title, Journal name and publication details, and a persistent link to the original article where available.
5. Third-Party Material
Material belonging to third parties, including photographs, illustrations, tables, datasets or other copyrighted content, may be subject to separate copyright or licensing conditions. Users are responsible for obtaining any permission required for such use.
6. Author Rights
Authors retain such rights as are provided under the applicable publication and licensing agreement. The specific rights applicable to each article are indicated with the published work where appropriate.
7. Changes to Licensing Terms
Oxford Law Review may update its licensing terms from time to time. The terms applicable to a published article will be those stated with or otherwise governing that article.
For the licensing status of a particular article, please refer to the licence information displayed on its publication page.
Как цитировать
