Ayushman Bharat Digital Mission Claims ‘privacy By Design’ Focus, Yet Dashboard Exposes Patient Details

‘Privacy by Design’ is one of the key guiding principles of Ayushman Bharat Digital Mission
(ABDM), said a response from the Ministry of Health and Family Welfare to a Lok Sabha question. The response also stated that there is no centralised data repository for the ABDM and that it prohibits sharing health data without the patient’s explicit consent. The government has also issued a number of strict guidelines and regulations which are in alignment with the Digital Personal Data Protection Act, claimed the answer.

Launched in 2021, the ABDM is an attempt to digitise the health records of citizens, as well as connect different healthcare providers, thus building a unified source of information across India’s health ecosystem.

However, this doesn’t seem to fall in line with what MediaNama has previously discovered about the ABDM. The dashboard of the Pradhan Mantri Jan Arogya Yojna (PMJAY), a health insurance scheme, allows a user to find patients availing treatment under the mission in various states without any login credentials. The dashboard publicly displays the person’s name, the date they were discharged, and the amount they paid out of pocket. This information disclosure appears to be in violation of the Health Data Management Policy, mentioned by the government in the recent parliament answer. Experts MediaNama spoke to also pointed out that it was possible to reason out more information about a person from the limited data provided by the dashboard.

The parliamentary question came from Navaskani K., MP from Ramanathapuram in Tamil Nadu, and enquired about the steps taken by the government to ensure data privacy for individuals registered under the mission. He had also asked for the details of the current status of the mission.

Operational Details For ABDM:

The ABDM consists of several registries including the Ayushman Bharat Health Account (ABHA), a unique 14-digit number connected to a person’s health records, healthcare professional registry (HPR), health facility registry (HFR), and drug registry.

The government provided the following numerical information regarding the ABDM’s current status:

• Around 689.7 million ABHA created
• Around 349.4 thousand health facilities registered on Health Facility Registry (HFR)
• Around 523.6 thousand healthcare professionals have registered on Healthcare Professional Registry (HPR)
• Around 453.7 million health records linked with ABHA
• 121 microsites have registered over 48,000 facilities and linked 32 lakh ABHA health records. Microsites drive ABDM adoption in specific areas, onboarding healthcare providers onto the platform.
• 17,481 facilities across 35 states/UTs have generated 66.47 million tokens for QR-code-based OPD registrations. The system currently creates an average of about 2 lakh registration tokens generated per day.
• Six facilities have operationalised QR-code-based payments, leading to 900 transactions worth over Rs 5 lakh.
• Model ABDM Facility workshops have been conducted in 133 facilities.
• A total of 152.5 thousand healthcare facilities use ABDM-enabled software, including 131 thousand government and 21,479 private facilities.
• ABDM has been provided with a budget allocation of Rs. 200 crores for the year, of which Rs. 92.32 crores have been utilized as of November 20, 2024.

Also Read:

• Summary: Digital Information Security in Healthcare Act (DISHA) to enable electronic health records
• NHA releases new health data guidelines under PMJAY
• Health IDs to be based on KYC, data localisation required: What is the new Health Data Management Policy?

The post Ayushman Bharat Digital Mission Claims ‘Privacy By Design’ Focus, Yet Dashboard Exposes Patient Details appeared first on MEDIANAMA.