A Critical Analysis of Health Data Governance, Interoperability, and the Ayushman Bharat Digital Mission (ABDM): Micro-Level Patient Care and Macro-Level Policy Trajectories
The Ayushman Bharat Digital Mission (ABDM) is spearheading India’s move towards a single digital health system. This paper reviews the structures of India’s digital public infrastructure for health and maps the interdependencies that arise at the macro level (policy making) and the micro level (clinical care) of clinical data governance and interoperability. It examines the consequences of digital fragmentation, namely information asymmetry, redundant clinical testing and flawed policy design, and how these must be addressed to realise the National Digital Health Blueprint of 2019 in conjunction with the National Health Stack proposed by NITI Aayog. Public–private networks, the Ayushman Bharat Health Account (ABHA) unique identifier, the operationalisation of the Health Information Exchange and the legal constraints imposed by the Digital Personal Data Protection (DPDP) Act, 2023 are also analysed. The paper concludes with recommendations for an overall system to overcome federal database silos, a standardised approach to technology procurement, and a fair and privacy-protecting national health system.
Introduction
In public health, data is not only necessary to clinical care; it is also a sovereign asset. Historically, the Indian healthcare system was an extremely decentralised structure, with patients’ records stored on paper, clinical repositories scattered, and legacy IT systems unable to communicate with one another. This digital disintegration undermines evidence-based, long-term patient care and leaves public policy without an empirical basis on which to build effective health interventions. The response is a twenty-first-century public infrastructure model, known as digital public infrastructure (DPI), that differs from the centralised, state-controlled public health systems of the twentieth century. Under the auspices of the National Health Authority (NHA), it had reached the scale of over 94 crore registered Ayushman Bharat Health Accounts (ABHA) and more than 100 crore digitally linked health records by July 2026.1,2 While the structural architecture of the Ayushman Bharat Digital Mission (ABDM) is in line with international standards, especially the World Health Organization’s Global Strategy on Digital Health 2020–2025, which recommends leveraging interoperable digital health technologies to strengthen national healthcare delivery systems,3 many structural and governance issues persist as the digital identity infrastructure scales. This paper critically analyses India’s health data governance frameworks, examining the challenges posed by interoperability failures at the micro level and by policy silos at the macro level in achieving an integrated national healthcare system.
The evolution of the strategic blueprint: from NITI Aayog to the NDHB
The conceptual framework was NITI Aayog’s National Health Stack, a consultation paper released in July 2018 that proposed a shared digital health infrastructure usable by the Centre, the states and the private sector.4 To take that framework to a plan of execution, the Ministry of Health and Family Welfare (MoHFW) constituted an expert committee in 2018, chaired by J. Satyanarayana, former Secretary of the Ministry of Electronics and Information Technology (MeitY) and former Chairman of the Unique Identification Authority of India (UIDAI).5
Instead of a highly centralised government database holding the clinical information of more than a billion citizens, the Satyanarayana Committee recommended a federated, decentralised architecture as the best approach, and this is reflected in its National Digital Health Blueprint (NDHB), submitted to the Ministry in 2019.6
The NDHB identified the concept of a National Digital Health Ecosystem (NDHE) and defined its modular and interoperable building blocks:7
• Interconnection of independent nodes: the interconnection of different independent nodes such as diagnostic laboratories, public and private hospitals, pharmacies, insurers and regulatory authorities.
• A secure federated data exchange platform: enabling the exchange of health information without centralising clinical data, in keeping with the principle of privacy by design.8
• A standardised personal health record (PHR) system: giving citizens easy access to their own longitudinal medical records, and giving medical providers secure, consent-based access to patients’ clinical records.
Micro-level interoperability failures: implications for patient care and evidence-based medicine
A. The lack of a single health profile
The lack of data interoperability has an impact at the clinical level, directly affecting patient health outcomes. Without a comprehensive, longitudinal digital health profile, patients in India often deal with a disjointed healthcare system, navigating multiple records for each interaction with a healthcare provider.
A patient’s clinical history, including diagnostic reports, previous prescriptions, allergy information and discharge summaries, is lost in the transition from a primary health centre (PHC) to a tertiary hospital, or between different public and private providers, leaving it stranded in paper folders or in separate, proprietary electronic medical record (EMR) systems.
Without data continuity, it is particularly difficult for clinicians to practise comprehensive, evidence-based medicine, since they must make diagnostic and treatment decisions from an incomplete medical record, which can lead to adverse drug interactions, misdiagnosis and sub-optimal treatment.
The absence of robust and consistent health IT has also made it difficult to scale the increasingly effective clinical decision-support systems that depend on a continuous timeline of patient information, systems whose adoption the NDHB itself set out as an objective.9
B. Personal health records and unified registries
To close this clinical information gap, the NDHB recommended a standardised approach to building a system of personal health records (PHR), based on international health-information standards and anchored to a unique health identifier, which is now issued as the 14-digit ABHA number and enables individuals to link their medical documents across providers.10,11
The PHR system works alongside the registries and the service layer run by the National Health Authority:12
• The Health Facility Registry (HFR): a national, verified register of healthcare facilities, public and private.
• The Healthcare Professionals Registry (HPR): a verified database of state-registered healthcare professionals, including doctors, nurses and allied health providers.
• The Unified Health Interface (UHI): an open protocol and network, launched in June 2026, that allows patients and providers to discover and deliver digital health services, including teleconsultation, across different applications.13
This architecture enables the integration of clinical data from laboratories, hospitals and clinics, so that a patient’s entire health history is securely available to authorised medical staff in one place and in longitudinal form.
C. The Health Information Exchange and Consent Manager
The Health Information Exchange and Consent Manager (HIE-CM) is the clinical implementation of the ABDM: a real-time middleware layer that dynamically routes clinical documents without storing the actual health data in a central registry.14
When a doctor requests a patient’s historical laboratory reports, the Consent Manager forwards the request to the patient. The patient gives digital consent, and the HIE-CM retrieves the structured document directly from the source repository (such as the issuing laboratory) and presents it to the clinician.
In the classic healthcare system, where paper records cannot easily be accessed or shared between providers, costly blood tests, CT scans and X-rays have to be repeated unnecessarily. This duplication of testing burdens patients, increases out-of-pocket healthcare expenditure and wastes public funds.
The HIE-CM makes historical reports available in a few clicks while ensuring their security, which optimises clinical workflow and reduces unnecessary diagnostic expense.
D. Telemedicine and remote consultation
The COVID-19 pandemic accelerated the use of telemedicine in India, with the Telemedicine Practice Guidelines of March 2020 giving registered medical practitioners a clear regulatory basis for remote consultation for the first time,15 and the ABDM has accentuated the need to connect such applications directly to the ABHA architecture.
The Unified Health Interface enables remote clinicians to access a patient’s verified, real-time health history during a video or voice consultation,16 helping them deliver evidence-based care in remote villages without forcing patients to travel long distances for primary and diagnostic consultations.
Macro-level interoperability failures: policy making, federal conflicts and institutional fragmentation
If a policy is not formulated in the light, it is formulated in the dark.
At the macro level, the absence of uniform, unified health data has historically constrained the effectiveness of public health policy in India. It is common for national health programmes, disease-control programmes and budgets to be designed on very few data points.
In the absence of a real-time, consolidated stream of public health evidence, state and central authorities have had to rely on periodic surveys such as the National Family Health Survey (NFHS),17 together with localised or incomplete administrative reports, and have lacked survey-level data on all aspects of public health, including the historical data that is essential to informed decision making.
This information gap often produces public health policies that are inconsistent with the epidemiological situation. In the allocation of resources between chronic non-communicable diseases such as hypertension and diabetes on the one hand and infectious diseases on the other, for example, accurate and current epidemiological information is lacking.
Further, non-governmental organisations (NGOs) and academic researchers who can implement interventions at the local level often cannot map local disease hotspots or assess the effectiveness of their interventions, because high-quality, de-identified public health datasets are unavailable.
A. Fragmented, isolated and siloed information
The public health system in India is highly decentralised, and its databases run in parallel and in isolation across different programmes and activities at the central and state levels. The parallel state-sponsored health schemes, the central and state insurance schemes, and the Pradhan Mantri Jan Arogya Yojana (PM-JAY), described by the government as the world’s largest health assurance scheme,18 have worked in isolation, neither sharing data nor coordinating claim registries.
This separation has created substantial information asymmetry, which has opened the door to billing fraud, duplicate claims and administrative inefficiency. To address these vulnerabilities, the National Health Authority has moved to require hospitals empanelled under the PM-JAY network to integrate with the ABDM, and has made deeper integration between the two programmes a stated goal of the mission’s next phase.19
Within this framework, hospitals process claims through the PM-JAY Transaction Management System (TMS), and claims information is linked to the ABDM network, which benefits the state in the following ways:
• confirming the patient’s identity at the point of claim, so that no duplicate or fraudulent claims are made;
• electronically tracking clinical outcomes and hospital admissions; and
• reducing over-billing and incorrect treatment.
B. Heterogeneous IT procurement and technological disparities
One key obstacle to national interoperability is the absence of a single technology procurement process across the states. India’s federal set-up means that healthcare is mainly a state subject, and states procure and roll out their own digital solutions.
States have thus built highly specific and mutually incompatible platforms, such as Uttar Pradesh’s eKavach platform and Gujarat’s TeCHO platform,20 based on different data storage and messaging requirements.
Even a very sophisticated state platform cannot natively exchange data with a neighbouring state’s platform, or with a central registry, without meeting the ABDM’s rigorous requirements for semantic and technical integration.21
This technical mismatch obstructs the real possibility of a national healthcare system in which a person from Uttar Pradesh with a long healthcare history can easily obtain their historical health records at a local clinic in Gujarat.
Legal, ethical and security dimensions of health data governance
A. The consent architecture
The ABDM’s Consent Manager system is designed to give patients full control of their digital health records, through informed and dynamic consent over sharing and access, giving effect to the informational privacy recognised by the Supreme Court in Puttaswamy.22 Consent is not a ‘one size fits all’ general waiver; it is intended to be:23
• Purpose-bound: the patient agrees to share certain types of information (such as laboratory reports) for a specific use (such as a diagnostic consultation).
• Time-limited: the patient sets the period for which a clinician may access the records, after which access lapses.
• Granular and revocable: the patient may decide which documents to share, and may revoke consent for any clinical document at any time during treatment.
B. The Digital Personal Data Protection Act, 2023
The ABDM’s consent architecture must now operate within the Digital Personal Data Protection (DPDP) Act, 2023, which lays down the obligations of Data Fiduciaries (such as hospitals, diagnostic laboratories and digital health platforms) in handling personal data, including health data.24
The Act permits personal data to be processed only on the basis of free, specific, informed, unconditional and unambiguous consent, which the data principal may withdraw at any time and which must be preceded by a detailed privacy notice, or for the narrow ‘legitimate uses’ listed in the Act, which include responding to a medical emergency and providing treatment during an epidemic.25
This regulatory regime, however, poses a significant operational compliance challenge for the healthcare industry:
• Legacy systems that lack compliance features such as granular consent, data deletion and real-time audit logs are exposed to regulatory non-compliance.
• The Act draws no ‘sensitive data’ distinction of the kind found in other privacy laws, such as the General Data Protection Regulation (GDPR) in the European Union, which imposes more specific compliance requirements and penalties for handling highly sensitive information such as health records and biometric data.26 Privacy advocates argue that such sensitive information should be better protected and that the penalties for violations should be more substantial.
Strategic recommendations and the way forward
To overcome these systemic impediments and create a fully interoperable and equitable national digital health system, the following policy interventions are proposed.
A. Security and integrity of the ABHA identifier
One major question about the scalability of the 14-digit ABHA number is how users will be protected. The ABDM follows a federated identity model in which the health account is created against Aadhaar or a mobile number.27
The ABDM features structural guardrails to ensure data integrity and security, which should be preserved and strengthened as the system scales:28
• Health Information Providers (HIPs) and Health Information Users (HIUs): data is never kept in a central repository; the HIP where a record is generated retains it and transmits it securely to the requesting HIU through encrypted channels.
• A minimal-metadata central registry: the central registries store only metadata, such as the verification of an ABHA number and the index of registered health facilities, never the clinical record itself, which moves only on explicit, patient-driven consent.
B. Common national technical standards
All health IT procurement by state health departments should be subject to a standard requirement of integration with the ABDM. Prospective investments under the National Health Mission (NHM)29 should be tied to state compliance with common metadata and terminology standards (for example, FHIR and SNOMED CT),30 to avoid further investment in disjointed and proprietary legacy systems.
C. Interstate and Centre-state data-sharing agreements
The National Health Authority should take the lead in drafting interstate and Centre-state data-sharing agreements to break through institutional barriers. These agreements will need to be legally aligned with the information and treatment databases of the parallel state-sponsored health insurance schemes, so as to eliminate information asymmetry and minimise fraud.
D. Digital health adoption among small private providers
Compared with corporate hospital chains, small private clinics and independent diagnostic laboratories face high integration and compliance costs. The NHA should provide financial support, through micro-subsidies for implementing ABDM-certified software-as-a-service (SaaS) products, to accelerate the digital integration of smaller independent providers.
E. Assisted and offline consent architectures
The ABDM needs to scale up assisted-consent models to narrow the digital divide and the differences in digital literacy among groups in India.31 Community health workers (Accredited Social Health Activists, or ASHAs) should be equipped with secure handheld devices that do not depend on an internet connection and can capture verified verbal or biometric consent, so that offline populations can also benefit from the digital health ecosystem.
Conclusion
The Ayushman Bharat Digital Mission is a significant step towards modernising India’s healthcare infrastructure. By creating a federated, consent-driven digital network, the ABDM has laid the foundation for a patient-centric and evidence-based healthcare delivery system.
Several structural impediments must nevertheless be overcome if this digital transformation is to succeed in the long term: the interoperability failures at the micro level must be corrected so that clinicians can access a full patient profile, and the data and federal silos must be dismantled so that policymakers have the high-quality evidence they need to design effective programmes.
Standardising technology procurement, addressing the institutional barriers to cross-institutional data sharing and integrating the system with the Digital Personal Data Protection Act, 2023 can create a resilient, equitable and privacy-preserving ecosystem that delivers quality healthcare to all Indians.
*****
Footnotes
1. Press Information Bureau, Centre and States Chart Roadmap for the Next Phase of Ayushman Bharat PM-JAY and ABDM at NHA National Review Meeting (Chintan Shivir) (July 17, 2026), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2285825.
2. Press Information Bureau, 100 Crore Health Records Linked with ABHA under ABDM, Marking Major Leap in Digital Healthcare (May 22, 2026), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2264241.
3. World Health Organization, Global Strategy on Digital Health 2020–2025 (2021), https://www.who.int/publications/i/item/9789240020924.
4. NITI Aayog, National Health Stack: Strategy and Approach (July 2018), https://abdm.gov.in/strapicms/uploads/NHS_Strategy_and_Approach_1_89e2dd8f87.pdf.
5. Ministry of Health & Family Welfare, National Digital Health Blueprint (2019), https://abdm.gov.in/strapicms/uploads/ndhb_1_56ec695bc8.pdf.
6. National Digital Health Blueprint, supra note 5; see also National Health Authority, National Digital Health Mission: Health Data Management Policy cl. 1 (2020), https://abdm.gov.in/strapicms/uploads/health_management_policy_bac9429a79.pdf (recording that the Blueprint “recommends that a federated architecture be adopted, instead of a centralised architecture”; the Policy is listed with the Mission’s other policy documents at https://abdm.gov.in/publications/policies).
7. National Digital Health Blueprint, supra note 5, at 2–3.
8. National Health Authority, Health Data Management Policy, supra note 6, cl. 1 (describing the Policy as “the first step in realising the NDHM’s guiding principle of ‘Security and Privacy by Design’”).
9. National Digital Health Blueprint, supra note 5 (listing the promotion of clinical decision support systems among the Blueprint’s objectives).
10. Id. (recommending personal health records based on international standards, together with a Unique Health Identifier).
11. Press Information Bureau, Explainer on Ayushman Bharat Health Accounts (ABHA) (Apr. 4, 2024), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2017129.
12. National Health Authority, A Brief Guide on Ayushman Bharat Digital Mission (ABDM) and Its Various Building Blocks (Version 1.1, Dec. 21, 2021), https://abdm.gov.in/strapicms/uploads/ABDM_Building_Blocks_v8_3_External_Version_eabbc5c0f3_4_a96f40c645_5716a684de_b344369144.pdf.
13. Press Information Bureau, Union Health Minister Jagat Prakash Nadda Launches Unified Health Interface – The Interoperable Network for Digital Health Services (June 29, 2026), https://www.pib.gov.in/PressReleasePage.aspx?PRID=2278987.
14. National Health Authority, Brief Guide, supra note 12, at 46.
15. Board of Governors in Supersession of the Medical Council of India, Telemedicine Practice Guidelines: Enabling Registered Medical Practitioners to Provide Healthcare Using Telemedicine (Mar. 25, 2020), https://esanjeevani.mohfw.gov.in/assets/guidelines/Telemedicine_Practice_Guidelines.pdf.
16. Press Information Bureau, Union Health Minister Launches Unified Health Interface, supra note 13.
17. International Institute for Population Sciences & ICF, National Family Health Survey (NFHS-5), 2019–21: India Report (2022), https://dhsprogram.com/pubs/pdf/FR375/FR375.pdf.
18. Press Information Bureau, Centre and States Chart Roadmap, supra note 1.
19. Id.
20. Press Information Bureau, 100 Crore Health Records, supra note 2 (naming the Government of Uttar Pradesh’s eKavach platform and the Government of Gujarat’s TeCHO platform among the state platforms contributing ABHA-linked records).
21. National Health Authority, Metadata Standards, Ayushman Bharat Digital Mission, https://abdm.gov.in/standards/metadata-standards (last visited Sept. 6, 2026).
22. Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 (India).
23. National Health Authority, Health Data Management Policy, supra note 6, cls. 9.2–9.3.
24. The Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023), §§ 2(i), 8, https://egazette.gov.in/WriteReadData/2023/248045.pdf.
25. Id. §§ 4–7.
26. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), art. 9, 2016 O.J. (L 119) 1, https://eur-lex.europa.eu/eli/reg/2016/679/oj.
27. Press Information Bureau, Explainer on ABHA, supra note 11.
28. National Health Authority, Brief Guide, supra note 12, at 12; see also Press Information Bureau, Explainer on ABHA, supra note 11 (explaining that records remain with the provider that created them and that only registry data is held centrally).
29. Ministry of Health & Family Welfare, National Health Mission: About Us, https://nhm.gov.in/index1.php?lang=1&level=1&sublinkid=969&lid=49 (last visited Sept. 6, 2026).
30. National Health Authority, Metadata Standards, supra note 21.
31. National Health Authority, Brief Guide, supra note 12 (noting that people with feature phones, and those without phones, can enrol through assisted modes).