India's Digital Health Records Race: Privacy Shield or Cyber Risk?
Context mode is active. Hover over any highlighted term to see its definition. Click a nested term to go deeper.
India is sprinting towards a fully digitised healthcare system, with the Ayushman Bharat Digital Mission (ABDM) hitting major milestones, including over 97.8 crore Ayushman Bharat Health Account (ABHA) and more than 121 crore linked health records by September 2026. This ambitious push, aiming for seamless patient care and data exchange, now operates under the watchful eye of the Digital Personal Data Protection Act (DPDP Act), 2023, which officially came into force in November 2025, setting a critical framework for safeguarding sensitive patient records. But as the digital transformation accelerates, a fundamental question looms large: will India's rapidly expanding digital health infrastructure truly protect our most intimate personal information from growing cyber threats? The DPDP Act mandates explicit consent for handling digital personal data, empowering individuals, known as Data Principal, with significant rights over their health information, including access and erasure. Healthcare providers, designated as Data Fiduciaries, now face stringent obligations for data security, robust cybersecurity measures, and severe penalties of up to ₹250 crore for breaches. This legal shield is more critical than ever, given that India's healthcare and pharmaceutical sectors were among the most targeted by cyberattacks in 2025, with millions of threats detected, ranging from Trojans to ransomware, and thousands of incidents reported by CERT-In in 2025 and the first half of 2026. Looking ahead, the full compliance for the DPDP Act is slated for May 2027, with the crucial introduction of 'Consent Manager' expected by November 13, 2026, which will further empower patients to manage data permissions across various providers. Simultaneously, the government's recent launch of a revamped Aarogya Setu 2.0 as a comprehensive Personal Health Record (PHR) app, alongside the National Health Claims Exchange (NHCX) for streamlined insurance processing, signals an ongoing evolution of the digital health ecosystem. The challenge now lies in rigorous implementation and continuous vigilance to ensure that technological advancements in healthcare don't compromise the privacy and security that patients rightly expect.