Is ABHA Safe? Privacy, Consent and Who Sees Your Data
Is ABHA safe to use? The system is designed around consent: your 14-digit ABHA links records but doesn't hold them, and no doctor or hospital can view your history unless you approve a request that expires. That design is safer than paper files left at clinics or reports sent over WhatsApp. ABHA isn't risk-free, though. Phishing calls, fake apps and breaches at individual hospitals are genuine threats. The good news is that you control the most important safeguards yourself.
How ABHA privacy actually works
To answer "is ABHA safe" honestly, you need to know where your data sits and who holds the keys.
Records stay with the provider
India's digital health mission uses what's called a federated design. Your lab report stays on the lab's system. Your discharge summary stays with the hospital. ABHA is an index that knows where those records are, not a warehouse that copies them. So a single leak of the ABHA directory doesn't expose everyone's medical files.
The ABDM consent manager
When a doctor wants to see your past records, the request goes through the ABDM consent manager, a system that sits between you and providers. You see who's asking, which record types they want and for how long. You approve, edit or reject. Approved access ends on the date you set, and you can revoke it earlier. Data shared through ABDM is encrypted in transit.
Who can see ABHA health records
Who | What they can see | When |
You | All records linked to your ABHA | Any time, after login |
A hospital or lab that created a record | That record | They already hold it |
A new doctor or hospital | Only records you approve | Until consent expires |
Hospital via Scan and Share | Name, age, gender, address, mobile | When you scan and share |
Someone holding your printed card | Name, ABHA number, QR details | Without consent, but no medical records |
Government | Aggregated, anonymised data for policy | Under NHA's data management policy |
So who can see ABHA health records? You, the providers who made them, and anyone you explicitly allow. That's it.
The real risks, and the myths
ABHA privacy concerns are reasonable. India has seen serious hospital cyberattacks, including the ransomware attack on AIIMS Delhi's servers in November 2022. Let's separate what's real from what isn't.
Myth vs fact
Myth | Fact |
"The government can read all my reports." | Records stay with providers; access needs your consent, except anonymised policy data. |
"Anyone with my ABHA number can open my history." | They need an OTP or app approval from you. |
"ABHA shares my data with insurers automatically." | Insurers see records only if you consent, for example during a claim. |
"Deleting ABHA erases my hospital files." | Hospitals keep their own records under their retention rules. |
Risks that are real
OTP fraud: callers posing as "ABHA officers" ask for an OTP to "update" your card. That OTP can approve access.
Fake apps and websites: lookalikes collect Aadhaar numbers and OTPs.
Breaches at a hospital or lab: ABHA can't protect data the provider stores badly.
Shared family phones: anyone using your unlocked phone can open the ABHA app.
DPDP Act health data rules
India's Digital Personal Data Protection Act, 2023 now applies to digital health data too. The DPDP Rules were notified in November 2025 and roll out in phases. Registration of consent managers starts in November 2026. Core duties on notice, consent, security and breach reporting take effect in May 2027. Health providers get limited exemptions for providing care. NHA's own Health Data Management Policy adds rules specific to ABDM.
IN SIMPLE TERMS In simple terms: ABHA works like a phone book that points to your records, not a big box that holds them. Nobody new can see your reports unless you say yes, and you can take that permission back. The main danger is being tricked into sharing an OTP, so never share one. |
Six ways to keep your family's ABHA safe
So is ABHA safe in day-to-day use? Mostly, it comes down to habits. These six take about ten minutes to set up.
The checklist
Never share an OTP. No official from NHA, a hospital or a bank needs your ABHA OTP over a call.
Use official apps only. Stick to the ABHA app, Aarogya Setu 2.0 or the website abha.abdm.gov.in.
Lock your phone. Use a PIN or fingerprint, especially if relatives borrow it.
Review consents monthly. Open the consent section and revoke anything stale.
Keep your mobile updated. An old SIM in someone else's hands can receive your OTPs.
Store the card PDF safely. After your ABHA card download, keep it in a secure app, not a public cloud folder.
If you think your ABHA was misused
Revoke all active consents immediately. Change the mobile number if it was compromised. Call the ABDM helpline at 1800-11-4477, and report fraud on the national cybercrime helpline 1930 or cybercrime.gov.in. If you decide to step away from ABHA entirely, our guide on how to delete ABHA account explains your options. For the opposite case, our guide on how to link health records to ABHA shows how to add records safely.
WATCH OUT Watch out: A message saying "Your ABHA will be blocked, share OTP to verify" is always a scam. ABHA accounts aren't blocked over a phone call. |
When to see a doctor (and when to report a problem)
Privacy worries shouldn't keep anyone away from care. Get help when:
You're delaying a check-up because you don't want records linked. Go anyway; ABHA is optional.
A doctor's request asks for years of records for a minor visit. Ask why before approving.
Your app shows a consent you never gave. Revoke it and call 1800-11-4477.
You shared an OTP with a caller. Report it to 1930 straight away.
An elderly parent got a suspicious "ABHA update" call. Check their app with them.
In an emergency, go to the nearest hospital or call 112 or 108. Emergency treatment never depends on sharing your ABHA.
FAQs
Is ABHA safe to use for my family?
For most families, yes. ABHA doesn't store your medical files centrally. Records stay with providers and are shared only after you approve a time-limited consent. The biggest risks are OTP scams, fake apps and lost phones, which you can reduce by using official apps, locking your phone and never sharing OTPs with callers.
Is ABHA safe from government access to my reports?
Under ABDM's design, records stay with the hospitals and labs that created them, and access requires your consent. The government can use aggregated, anonymised data for planning under NHA's Health Data Management Policy. Individual reports aren't open to officials just because you have an ABHA. India's DPDP Act also adds legal protections as it rolls out.
Who can see ABHA health records?
You can see all records linked to your ABHA. The hospital or lab that created a record already holds it. A new doctor or hospital sees only the records you approve, for the period you choose. When you use Scan and Share, a hospital receives only basic profile details, not your medical history.
Can someone misuse my ABHA number?
Your ABHA number alone doesn't open your records. Access needs an OTP or app approval from you. Someone with your printed card can see your name, number and QR details, but not your reports. Misuse usually happens when people share OTPs with fraudsters, so treat any call asking for an ABHA OTP as a scam.
What does the DPDP Act mean for health data?
The Digital Personal Data Protection Act, 2023 covers digital health data. Its rules, notified in November 2025, phase in through 2027. They require clear consent notices, security safeguards, breach reporting and consent manager registration. Healthcare providers get some exemptions for delivering care. Together with ABDM's own policy, it strengthens your rights over health data.
Download Seht — free on iOS and Android
Seht gives each family member a private, organised space for reports, prescriptions and ABHA cards, so you share only what's needed, only when it's needed.
Download free:
Sources and references
National Health Authority. Health Data Management Policy, Ayushman Bharat Digital Mission. abdm.gov.in.
Ministry of Electronics and Information Technology. Digital Personal Data Protection Rules, 2025, notified November 2025 (phased commencement). meity.gov.in.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023). Gazette of India.
Press Information Bureau, Ministry of Health and Family Welfare. "Ayushman Bharat Digital Mission" backgrounder, July 2026 (privacy-by-design, consent-based sharing). static.pib.gov.in.
Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs. National Cybercrime Reporting Portal and helpline 1930. cybercrime.gov.in.
Disclaimer: This blog is for informational purposes only and is not medical advice. Seht helps families stay informed, but is not a substitute for professional healthcare guidance.
