Consent by Design: How ABDM Puts Patients in Control of Their Health Data

India’s ABDM network now counts over 93.95 crore Ayushman Bharat Health Accounts, or ABHAs [1] and over 105 crore health records linked to them [18]. Behind those numbers is a consent architecture that the National Digital Health Blueprint and the Health Data Management Policy (HDMP) were designed to produce: one where patients control how their health data moves [3].

The previous article in this series, How Clinical Data Actually Flows Under ABDM: A Guide for Health IT Teams, examined the engineering side of that architecture: the HIE-CM consent flow, FHIR document profiles, and the Fidelius encryption that secures records in transit. It answered the implementation question: once consent is granted, what happens mechanically?

The policy reasoning behind that mechanism is a separate question: why does the system require consent in this particular form? The answer sits not in the code but in the policy decisions that preceded it. This article examines that governance layer: why ABDM’s consent architecture was designed the way it was, what patient data sovereignty actually means in an Indian context, and how India’s approach compares to frameworks like the EU’s General Data Protection Regulation (GDPR).

The Policy Choice That Came Before the Technology

When the National Health Authority (NHA) designed ABDM, it faced a structural question central to any large-scale health data initiative: where should the data live, and who should control access?

The answer was a departure from the centralised model that many government data systems have used. ABDM implements a federated data model: patient health records remain at the source where they were generated, while the NHA provides central registries (ABHA, HFR, HPR) and consent-management gateways (the HIE-CM) to enable interoperability across the system [2]. The National Digital Health Blueprint, 2019, which preceded ABDM, explicitly recommended a federated architecture over a centralised one on grounds of interoperability, technological flexibility, and independence, a design principle carried forward into the HDMP [3]. How the HFR and HPR function as a trust layer within that architecture is covered in Article 3 of this series.

Policymakers chose the federated model knowing it carried greater implementation complexity. The trade-off was deliberate: distributing data storage and access control meant the responsibility for consent decisions would sit with the patient rather than with any central system.

The foundational document governing this choice is the Health Data Management Policy (HDMP), first published in December 2020 and revised in a second draft released for public consultation in April 2022 [3]. As of this writing, HDMP is still being refined, and the NHA continues to treat it as a living policy document rather than a fully codified statute; no formal superseding instrument has yet been notified. Compliance teams should verify the latest version on NHA’s publications page before treating any specific HDMP provision as final.

Under the HDMP, consent is required for data sharing — explicit, informed, granular across purpose, duration, and data type — revocable, and auditable via cryptographically signed, immutable consent artefacts. Under the DPDPA and the DPDP Rules, 2025, ABDM consent artefacts function as a key part of the evidentiary trail data fiduciaries rely on to demonstrate lawful processing and consent compliance. Data principals (patients) also hold rights to access, correction, erasure, portability, and grievance redressal; several of these rights are associated with defined response periods (often around 30 days), though exact timelines vary by right and instrument under the HDMP and the DPDPA [3].

This is not a vague aspiration. Each of these properties has a corresponding operational mechanism.

The technical component through which these policy principles operate is the Health Information Exchange and Consent Manager, or HIE-CM, the definitive label used in NHA’s own architecture documentation, though some secondary sources shorten it to simply “Consent Manager.” Article 4 of this series walked through its mechanics in detail for an implementation audience; what follows is a policy-level recap of what the HIE-CM does and why it matters.

There is an important distinction between two entities that share similar names. The NHA’s HIE-CM is a domain-specific digital public infrastructure gateway that routes health records between registered HIPs and HIUs without storing actual data, and is funded publicly as part of the ABDM [2]. The “Consent Manager” defined under Rule 4 of the DPDP Rules, 2025 is an entirely separate legal construct, a sector-agnostic commercial or public intermediary registered with the Data Protection Board of India (DPBI), required to be incorporated in India with a minimum net worth of INR 2 crore, operating across any sector from healthcare to banking to e-commerce. Rule 4 obligations for Consent Managers are scheduled to be enforced from November 2026, with entities required to register with the Data Protection Board of India and meet the minimum net-worth and incorporation criteria by that date [22]. Product teams building ABDM-compliant systems may need to interface with both: the HIE-CM for healthcare data routing, and a DPDPA Consent Manager for broader cross-sector consent governance, depending on their use case.

ABDM’s design aims to safeguard the autonomy and privacy of personal health information by using the HIE-CM to mediate record exchange and consent, enabling an open, interoperable, secure, and standards-based digital health system [4].

In practical terms, the HIE-CM sits between the two main actor types in the ABDM ecosystem: Health Information Providers (HIPs) — the hospitals, laboratories, and clinics that hold records — and Health Information Users (HIUs) — the doctors, insurers, or other providers who need to access those records for a specific purpose. Both sides of that exchange participate in the ABDM ecosystem through registration in the HFR and HPR. The HIE-CM gateway routes record exchanges between providers and consumers based on patient consent [2].

The HIE-CM operationalises explicit, purpose-limited, time-bound, and revocable consent via machine-readable consent artefacts and audit trails. Every data-sharing request must be actively approved by the patient with clear details of the data category and the duration of the access [5].

The resulting digital record of each approval is known as a consent artefact: a structured, machine-readable document that specifies who can access what data, for what purpose, and for how long. HIE-CM-compliant consent artefacts specify purpose, data categories, frequency, duration, and expiry, with patient-accessible consent dashboards and audit trails maintained throughout [6].

Consent artefacts can also be revoked. ABDM-compliant systems are required to honour revocations as recorded in the consent artefact; in practice, how quickly that revocation takes effect across the ecosystem depends on timely propagation and on individual providers’ system compliance, rather than happening instantaneously everywhere at once [7]. The design intent, nonetheless, is that the patient retains ongoing control over their medical information.

What Data Sovereignty Means in an Indian Healthcare Context

The phrase “data sovereignty” appears frequently in digital health policy discourse. In the context of ABDM, it has a specific, practical definition.

As NHA officials have described in media interactions, ABHA can be compared to a bank account: instead of storing wealth, it stores health records that can only be accessed with the individual’s consent. Over time, these records create a longitudinal health history with significant clinical and personal benefits [8].

This framing captures what data sovereignty means in the Indian context: not simply legal ownership of records, but functional control over access, exercised through a consent mechanism that is designed to be patient-facing rather than requiring technical knowledge to operate.

The analogy also points to a structural distinction that policymakers made explicit. ABDM’s federated architecture ensures data always resides at the source where it was generated, or in a health application of the user’s choice as per their consent [2]. There is no single central repository of clinical data; records stay distributed with HIPs and authorised applications, and any access at scale must still pass through the consent layer [2].

That said, the statutory framework also recognises limited circumstances where processing without consent is permitted. Under Section 7 of the DPDPA, these are strictly defined as “Certain Legitimate Uses”, an exhaustive, closed list of public and institutional interests that includes active medical emergencies where there is a threat to the life of the individual, for instance an unconscious patient arriving at an emergency department, or specific public health mandates such as disease surveillance during an epidemic. Commercial interests and administrative convenience are entirely excluded from this non-consensual framework. Once the specific legitimate use ceases, the lawful basis must revert to explicit, affirmative consent [9]. These are not open-ended exceptions analogous to the GDPR’s “legitimate interests” balancing test; the DPDPA’s list is fixed and cannot be expanded by the data fiduciary.

Legal and policy analyses of ABDM regularly draw comparisons with the European Union’s General Data Protection Regulation (GDPR). The comparison is instructive, both for the similarities and for the differences.

Under the GDPR, health data qualifies as “special category data” under Article 9, generally requiring explicit consent, with limited additional grounds such as vital interests and specified public-health bases also available [10]. ABDM’s HDMP is structurally similar in centring explicit consent as the default and primary lawful basis for processing sensitive health data, while DPDPA separately defines narrow non-consensual grounds in Section 7 (“Certain Legitimate Uses”) for emergencies and specific public functions [11].

Both frameworks also share a principle of purpose limitation: data collected for one purpose cannot be repurposed without separate consent, and both require that patients have mechanisms to withdraw consent and request corrections.

The structural differences, however, matter. Unlike GDPR, which designates health data as “special category data” requiring heightened safeguards, India’s DPDP Act, 2023 applies uniform rules to all digital personal data and creates no equivalent special category for health information. This means that in India, health-specific consent standards are governed primarily through ABDM’s HDMP rather than through a statutory special-category designation, which is a structurally different approach from GDPR Article 9. India has approached health data governance through a combination of ABDM’s operational policy framework (the HDMP) and the DPDPA’s broader data protection provisions, rather than through a sector-specific health data statute of the kind HIPAA represents in the United States. Enforcement, grievance redressal, and fiduciary accountability under this framework are areas that legal and policy commentators continue to examine as the ecosystem matures [12].

The Digital Personal Data Protection Act (DPDPA), passed in August 2023, provides a broader statutory foundation [13]. Key provisions of the DPDPA include the requirement to obtain explicit consent before using patient data, granting patients the right to access, correct, and delete their data, and maintaining transparency between healthcare providers and patients.

The DPDP Rules, 2025 were notified on 13 November 2025. Per the Act’s own commencement schedule, the institutional provisions establishing the Data Protection Board took effect immediately, while most substantive compliance obligations, including the Section 33 penalty framework, are set to take full effect eighteen months later, on 13 May 2027 [14].

Once in force, penalties are administrative and discretionary. The Schedule sets maximum caps, with the Data Protection Board empowered to assess administrative penalties up to INR 250 crore for failures under Section 8(5) (reasonable security safeguards), and up to INR 200 crore for breach-notification failures under Section 8(6), allowing combined exposure up to INR 450 crore for a single incident [14].

What this policy framework looks like as a citizen-facing product became concrete on 29 June 2026, when Union Health Minister JP Nadda launched Aarogya Setu 2.0, a transformation of the original pandemic contact-tracing application into a full Personal Health Record (PHR) gateway under ABDM. The revamped application enables citizens to generate and manage their ABHA, share digitised medical histories via HIE-CM-mediated consent artefacts in real time, and use a Scan and Share QR interface to bypass manual registration queues at empanelled hospitals [21]. The launch is a concrete demonstration that the consent architecture described in this article is operational, not aspirational.

One interpretive question that arises from reading ABDM’s consent framework alongside the DPDPA concerns Section 7 (“Certain Legitimate Uses”), the DPDPA’s closed list of scenarios where processing without consent is permitted, such as active medical emergencies or public health mandates. Whether these statutory grounds can apply to a situation where a patient has previously revoked consent under ABDM is an open question [15]. Current legal commentaries note that Section 7 grounds are narrow and time-bound; how they interact with ABDM-recorded revocations in specific clinical scenarios is likely to be clarified through Data Protection Board practice and sectoral guidance as enforcement matures from May 2027 onward.

The Governance Philosophy Behind the Architecture

What distinguishes ABDM’s consent framework from a purely technical specification is the governance philosophy that motivated it.

The mission was designed around a principle that patient data should be accessible when needed but only on the patient’s terms. Under ABDM’s design, access to patient records is gated by the patient’s consent decision rather than by institutional agreements between providers and payers alone.

The HDMP lays down guiding principles for security and privacy by design, providing detailed guidelines for data minimisation, purpose limitation, collection, use, and storage limitation, and informed and free consent for data sharing. It mandates data fiduciaries to maintain accurate and up-to-date records documenting the important operations in the data lifecycle, including collection, transfers, and erasure, so that the complete journey of a record can be tracked from its original source through all subsequent modifications [16].

Consent under this framework must be clear and specific: the patient must know exactly what data is being requested, why it is needed, and for how long [17]. The consent mechanism is designed to be reversible at any stage, and access without valid consent constitutes a policy violation.

This philosophy has a structural consequence for all participants in the ecosystem. Hospitals, insurers, and health technology companies that want to access patient records through ABDM must build their systems around the patient’s consent decision as the primary gate for data access.

The Current State: Scale and Ongoing Development

ABDM’s consent infrastructure has grown substantially alongside the mission’s overall adoption.

According to NHA data, the number of health records linked to ABHA accounts doubled from 50 crore in February 2025 to over 100 crore by May 2026, a span of roughly 15 months, and has since grown further to over 105 crore, as confirmed at the 3rd Mission Steering Group meeting chaired by Health Minister JP Nadda on 10 July 2026 [18].

The pace of linkage has remained high throughout this period; the overall trajectory implies several crore additional records linked every two to three months, making ABDM one of the world’s largest digital health ecosystems by this measure [18]. Beyond the record count, the ecosystem’s participant base has also scaled: 5.33 lakh health facilities are now registered on the HFR, and 9.85 lakh healthcare professionals on the HPR, the trust-layer registries through which entities participate as HIPs and HIUs under the HIE-CM consent gateway [18].

The pace of ABHA creation has accelerated consistently since launch, with cumulative accounts rising from 14.7 crore in 2021 to 30.4 crore in 2022, 50.6 crore in 2023, 72.2 crore in 2024, 84.5 crore in 2025, surpassing 90 crore in mid-2026, and reaching 93.95 crore by July 2026 [1].

Each of those records is, by design, accessible only through a consent artefact. How consistently that operates across the ecosystem’s full range of participants across facility types, geographies, and software implementations is a question the NHA continues to monitor as the mission scales [23].

Researchers and legal commentators have proposed a regulatory reform roadmap that includes classification of health data as sensitive personal data, strengthening the consent infrastructure within ABDM, harmonising telemedicine standards with statutory privacy obligations, and establishing sector-specific health data protection norms consistent with global best practices [19]. The proposals address the ongoing work of aligning policy intent, technical implementation, and enforcement at this scale.

What This Means for Compliance Teams and Strategists

For compliance teams at hospitals, insurers, and health technology companies, the consent framework has direct operational implications.

Every data-sharing transaction within the ABDM ecosystem must trace to a valid consent artefact. Systems that cannot demonstrate this traceability through audit trails, timestamped records, and revocation handling fall short of HDMP expectations, and non-compliance could attract penalties under the DPDPA and regulatory action by the relevant authorities as enforcement mechanisms mature. ABDM compliance involves passing a CERT-In empanelled security audit and completing a sandbox-to-production migration. The full registration and onboarding sequence for hospitals and credentialing teams is detailed in Article 3 of this series. Consent traceability, revocation handling, and DPDPA alignment are accordingly standing audit considerations rather than point-in-time checks [20].

Two 2026 developments have expanded the compliance perimeter. First, HFR registration became mandatory in 2026 for NABH-accredited and state-empanelled facilities, meaning that for accredited hospitals, entry into the HFR and by extension the HIE-CM consent ecosystem is no longer voluntary [23]. Second, C-DAC launched eSushrut@Clinic in June 2026, a lightweight hospital management system for smaller clinics that generates FHIR-compliant records linked to ABHA by design, with over 2,200 facilities onboarded by July 2026 [23]. Together, these developments are expanding the base of ABDM-capable HIPs beyond the large-hospital tier, growing the pool of patient records reachable through the HIE-CM consent gateway at both ends of the provider spectrum.

For senior strategists, the implication is structural. Platforms built on top of ABDM infrastructure, whether for care delivery, insurance, or revenue cycle management, inherit a patient-centric architecture. The consent layer is a core operating condition of the ecosystem, not a peripheral compliance requirement.

Three areas warrant attention for teams working within the ABDM ecosystem: consent traceability visible end-to-end in audit logs, revocation requests that propagate and take effect rather than only updating a status flag, and a mapping of current data flows against both the HDMP and the DPDPA to identify where the two frameworks’ requirements differ.

The Architecture as a Statement of Values

The HIE-CM is, among other things, a statement about what kind of digital health system India chose to build. The National Digital Health Blueprint considered both centralised and federated approaches; the federated, consent-first model was the approach adopted [3].

The architecture’s practical reach continues to expand as implementation matures, the DPDPA’s enforcement provisions come into effect, and the participant base grows across facility types and geographies.

What the architecture itself represents is a governance philosophy: that access to health data, even for legitimate clinical and administrative purposes, requires the individual’s explicit, informed, and reversible permission.

Consent is not a checkbox in ABDM. It is the foundation.

Next in this series: Article 6 turns from policy design to geography, examining why ABDM adoption looks markedly different across Kerala, Uttar Pradesh, and Tamil Nadu. State-level variation in uptake is real and significant, driven by differences in existing health IT infrastructure, state government priorities, and provider density. The consent architecture this article has described only functions where the underlying registries and gateways are actually in place and that varies sharply by state.

CaladriusHealth.AI covers India’s health technology landscape with a focus on ABDM, NHCX, medical billing, and AI in healthcare. This article is part of a series on India’s digital health infrastructure.

Laws, policies, and commencement timelines referenced in this article can change. For the most current legal and operational status, readers should consult the National Health Authority (abdm.gov.in), the official statutory text on India Code (indiacode.nic.in), and Gazette notifications directly.

Tags: ABDM · ABHA · HDMP · DPDPA · Consent Artefact · HIE-CM · Digital Health India · NHA

Editorial Disclosure: CaladriusHealth.AI builds revenue cycle management and patient engagement technology for hospitals operating within India’s digital health ecosystem. Our commercial interest in ABDM adoption is direct, and readers should weigh our perspective accordingly. The interpretations of law and policy in this article are informational and do not constitute legal advice; compliance teams should consult qualified counsel before making operational or regulatory decisions based on this content.

Sources

All sources are publicly verifiable. Government and statutory sources are listed first; industry and analytical sources are labelled explicitly.

Government and Statutory Sources

[1] Press Information Bureau, Government of India / IndiaMedToday. Ayushman Bharat Digital Mission crosses 90 crore ABHA accounts milestone (includes year-by-year ABHA growth trajectory, 2021–2026). NHA / MoHFW. May–June 2026. https://indiamedtoday.com/ayushman-bharat-digital-mission-crosses-90-crore-abha-accounts-milestone/ (Source: IndiaMedToday citing official NHA data — industry source reporting government statistics. Source headline: “Ayushman Bharat Digital Mission crosses 90 crore ABHA accounts milestone.” Note: figure has since been updated to 93.95 crore ABHAs as of the 3rd Mission Steering Group meeting, 10 July 2026 — see source [23].)

[2] National Health Authority. ABDM FAQ and HIE-CM architecture — official NHA definitions of HIE-CM, federated architecture, and HIP/HIU gateway model.

Primary source:

NHA HIE-CM official brochure (MoHFW/NHA PDF — defines HIE-CM, confirms HIP/HIU gateway architecture, data-blind routing, and consent flow): https://abdm.gov.in/strapicms/uploads/ABDM_HIE_CM_ea5d4c0559.pdf

See also: Frontiers in Digital Health / PMC. A perspective on digital health platform design and its implementation at national level. PubMed Central, 2024. https://pmc.ncbi.nlm.nih.gov/articles/PMC11043488/ (Peer-reviewed academic source — describes ABDM architecture including HIE-CM gateway, federated model, and HIP/HIU data exchange flow, citing NHA’s published ABDM architecture directly)

[3] National Health Authority. Health Data Management Policy (HDMP) — HDMP-I finalized December 2020; HDMP-II (revised draft) released April 2022 for public consultation, closed 21 May 2022. https://abdm.gov.in/strapicms/uploads/health_management_policy_bac9429a79.pdf (Primary government source — HDMP-I full policy text, directly accessible from NHA’s static file server. For the most current version, check NHA’s publications page at abdm.gov.in/publications/policies_regulations/health_data_management_policy.)

[4] PMC / National Institutes of Health. The Ayushman Bharat Digital Mission (ABDM): making of India’s Digital Health Story. PubMed Central, 2023. https://pmc.ncbi.nlm.nih.gov/articles/PMC10064942/ (Peer-reviewed academic source)

[5] Kleeto. Consent Management in Healthcare: Complete Hospital Guide. May 2026. https://www.kleeto.in/blogs/consent-management-healthcare.php (Industry source)

[6] AM Legals. Health Data and the DPDP Act: A Practical Guide. November 2025. https://amlegals.com/health-data-and-the-dpdp-act-a-practical-guide/ (Legal advisory / industry source)

[7] Bahmni / Thoughtworks. Bahmni as Health Information Provider (ABDM/NDHM). Bahmni Wiki, Confluence. https://bahmni.atlassian.net/wiki/spaces/BAH/pages/2901114904/Bahmni+as+Health+Information+Provider (Open-source implementation documentation — technical/industry source)

[8] Digital Health News. Over Half of India Now Has Digital Health Records, Govt Data Shows. https://www.digitalhealthnews.com/over-half-of-india-now-has-digital-health-records-govt-data-shows (Industry news source citing NHA official)

[9] MediaNama. NHA releases new and revised Health Data Management Policy. June 2022. https://www.medianama.com/2022/06/223-new-health-data-management-policy/ (Industry news source)

Peer-Reviewed and Academic Sources

[10] PMC / National Institutes of Health. The Digital Personal Data Protection Act 2023: Implications for Mental Healthcare Practice in India. PubMed Central, 2025. https://pmc.ncbi.nlm.nih.gov/articles/PMC12423081/

[11] Law.asia. How healthcare providers can protect patient data — India. March 2024. https://law.asia/india-healthcare-data-protection-laws/ (Legal industry source)

[12] DPO India. Digital Health Records in India: Privacy, Security, and the Ayushman Bharat Digital Mission. https://www.dpo-india.com/Blogs/digital-health-records/ (Industry / privacy advisory source)

Legal and Policy Analysis Sources (Industry/analytical — labelled)

[13] India Code, Ministry of Law and Justice, Government of India. Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). Notified August 2023. https://www.indiacode.nic.in/handle/123456789/22037?locale=en (Primary government source — official India Code landing page for the Act, including links to Rules, Regulations, and Notifications)

[14] India Code, Government of India / Ministry of Law and Justice. The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), including the Schedule and commencement notifications (as on 19 November 2025). Schedule Item 1 sets the INR 250 crore maximum penalty for breach of the Section 8(5) obligation to implement reasonable security safeguards; commencement footnote confirms Sections 28–34 (including Section 33, Penalties) take effect eighteen months from 13 November 2025, i.e. 13 May 2027, per notification G.S.R. 843(E). https://www.indiacode.nic.in/bitstream/123456789/22037/1/a2023-22.pdf (Primary government source — official statutory text consolidated by the Ministry of Law and Justice)

[15] DataSecure / DPO India. Health Data in the Spotlight: Aligning NDHM, DPDPA, and ABHA Frameworks. July 2025. https://datasecure.ind.in/blogs/health-data-spotlight/ (Industry compliance source)

[16] The Quantum Hub / ABDM Case Study. Ayushman Bharat Digital Mission: India’s Healthcare ODE. August 2022. https://thequantumhub.com/wp-content/uploads/2023/10/ABDM-Case-Study-Final-Aug22.pdf (Policy analysis / think tank source)

[17] Shifamhealth. Digital Health Records & Your Privacy in India: A 2024 Guide. https://shifamhealth.com/digital-health-records-privacy-india-abdm-rights-safety/ (Industry / patient education source)

[18] Press Information Bureau, Government of India. 100 Crore Health Records Linked with ABHA under ABDM. May 2026. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2264241 (Source headline: “100 Crore Health Records Linked with ABHA under ABDM, Marking Major Leap in Digital Healthcare.” PIB text confirms: “the number of linked records doubled from 50 crore in February 2025 to over 100 crore in just 15 months.” Note: figures have since been updated to 105 crore linked records and 93.95 crore ABHAs as of the 3rd Mission Steering Group meeting, 10 July 2026 — see source [23].)

[19] International Journal of Law and Legal Research (IJLLR). Patient Data Protection in India: Constitutional Privacy, Consent Architecture, and Regulatory Gaps After the Digital Personal Data Protection Act, 2023. April 2026. https://www.ijllr.com/post/patient-data-protection-in-india-constitutional-privacy-consent-architecture-and-regulatory-gaps (Peer-reviewed academic source)

[20] VertiComply. ABDM Compliance Guide for Healthcare Apps. April 2026. https://verticomply.com/compliance-info/abdm (Industry compliance source)

[21] MediaNama / GKToday. Aarogya Setu 2.0 launched as ABDM Personal Health Record gateway. 29 June 2026. https://www.medianama.com/2026/06/223-aarogya-setu-2-google-gemma-health-records/ (Industry news source reporting MoHFW launch event; confirmed by GKToday and multiple outlets — see also https://www.gktoday.in/aarogya-setu-2-0-and-abdm-launch/)

[22] Tsaaro. Consent Managers under the DPDP Act and DPDP Rules, 2025: Rule 4 registration requirements, INR 2 crore minimum net worth, obligations, and governance. November 2025. https://tsaaro.com/blogs/consent-managers-under-the-dpdp-act-and-dpdp-rules-2025-functions-obligations-and-governance (Legal industry source)

[23] Digital Health News. Ayushman Bharat Digital Health Mission Crosses 93 Cr Accounts, 105 Cr Health Records Linked. July 2026. https://www.digitalhealthnews.com/ayushman-bharat-digital-health-mission-crosses-93-cr-accounts-105-cr-health-records-linked (Industry news source reporting official MoHFW/NHA figures from the 3rd Mission Steering Group meeting, 10 July 2026, and the NHA fact-sheet of 6 July 2026)