Digital public infrastructure for health: what India's ABDM is building, and what it still needs

Analysis · Published 2026-10-05

A black stethoscope lying coiled on a dark table — Photo: Tama998, CC0, via Wikimedia Commons.

Health is where the promise of digital public infrastructure is easiest to state and hardest to deliver. A patient's records should follow them from a village clinic to a city hospital; a doctor should see past prescriptions and test results with the patient's permission. India's Ayushman Bharat Digital Mission (ABDM) is one of the most ambitious attempts to build those rails at national scale.

From blueprint to mission

The Ministry of Health and Family Welfare published a National Digital Health Blueprint in 2019, setting out an architecture of registries, standards and federated health records. The National Digital Health Mission was announced in August 2020 and piloted in six union territories. It was launched nationally, under the name Ayushman Bharat Digital Mission, on 27 September 2021. The National Health Authority, which also runs the PM-JAY public health insurance scheme, is the implementing agency.

ABDM follows the logic of other Indian DPI: build shared registries, identifiers and exchange protocols, and let public and private providers build applications on top.

The building blocks

ABHA (Ayushman Bharat Health Account): A 14-digit health identifier, plus an optional human-readable ABHA address, used to link a person's records across providers. Creating one is described by the government as voluntary.
Health Facility Registry: A national directory of public and private facilities, from hospitals and clinics to laboratories and pharmacies.
Healthcare Professionals Registry: A registry of doctors, nurses and other professionals, used to verify who is providing care.
Health Information Exchange and Consent Manager: Records stay with the providers that created them. When a patient wants to share records with a new doctor or app, a consent manager records a consent artefact specifying what is shared, with whom, for what purpose and for how long, and the data is exchanged directly between the systems.
Unified Health Interface (UHI): An open network protocol, modelled on the logic of UPI, intended to let any compliant app discover and book services such as teleconsultations or appointments from any compliant provider.

Technically, ABDM relies on published standards. Health record exchange is based on HL7 FHIR, with Indian profiles published by the National Resource Centre for EHR Standards. We explain why such standards matter in interoperability and open standards.

Why the federated, consent-based design matters

The central design choice is that ABDM does not create a national database of medical records. Records are held by the hospitals, labs and clinics that create them, and the mission's role is to provide identifiers, registries and the consent and exchange layer between them. This follows the same federated logic as Estonia's X-Road and India's financial Account Aggregator framework, both discussed in data exchange layers explained.

In principle, this limits the damage of any single breach and keeps the patient in control of who sees what. In practice, the protection depends on how consent is collected, how long data is retained by recipients, and how well the system is secured end to end.

The open questions

Is consent meaningful?

Consent is only a safeguard if it is informed and freely given. In 2021, media reports described people discovering that a health identifier had been generated when they registered for COVID-19 vaccination using Aadhaar, which raised questions about how "voluntary" enrolment is in practice. Consent screens presented at a hospital counter, to a patient in pain or with low digital literacy, are a weak basis for control over sensitive data.

Will providers adopt the standards?

A federated system only works if facilities digitise their records in standard formats and connect to the exchange. Large private hospitals have IT departments; small clinics and many public facilities do not. Incentive schemes have been used to encourage adoption, but sustained use depends on whether digitisation makes clinicians' work easier, not only on targets for linked records.

Which law protects health data?

India's Digital Personal Data Protection Act was passed in 2023, and its implementing rules were notified on 13 November 2025, with most substantive obligations phased in over 18 months. Health data does not have a separate statutory regime, and observers have argued that sector-specific rules, for example on secondary use for research or by insurers, are needed. Until the general framework is fully in force and enforced, much rests on policy documents such as the mission's health data management policy.

What about the people not online?

Millions of patients rely on frontline health workers, public facilities and paper records. A digital health ecosystem must work for them through assisted channels, and must not make access to care conditional on having a health account.

Lessons beyond India

Federate health records; keep them with the providers who create them, and build the exchange and consent layer instead of a national repository.
Adopt international standards (HL7 FHIR, standard terminologies) with national profiles, rather than inventing formats.
Invest in the supply side: digitising small facilities and making systems useful for clinicians is harder than issuing identifiers.
Make consent real: separate enrolment from access to care, and give patients a clear record of who accessed their data.
Legislate first, or at least in parallel: health data needs specific, enforceable protection.

Sources

National Health Authority, Ayushman Bharat Digital Mission (official site and sandbox documentation).
Ministry of Health and Family Welfare, press information on the launch of ABDM (27 September 2021).
National Resource Centre for EHR Standards, FHIR implementation guide for ABDM.
Press Information Bureau, Digital Personal Data Protection Rules, 2025 (November 2025).