Digital Health Records: Giving Privilege to Patients through Data Security

Health data security is the first objection in almost every enterprise, government and CSR health-tech deal, because a screening programme creates a permanent record of a person’s most sensitive information at a moment when that person is standing in a factory corridor or a village hall.

The objection is legitimate and it is usually asked badly. Procurement teams ask whether a vendor is “secure”, which no vendor answers no to. The useful questions are narrower: who can see an individual result, what the sponsoring organisation sees, where the data is stored, what happens when a person withdraws consent, what is deleted and what is retained, and who has tested the system and when.

This article answers those questions for a Clinics On Cloud deployment, and gives you the questions to put to any other vendor.

One framing point first. A Health ATM is a screening station, so the data it creates is screening data, not a diagnosis and not a hospital medical record. The sensitivity is high, the clinical authority is limited, and the record’s purpose is to prompt follow-up.

ABHA, the Ayushman Bharat Health Account, is a health identity issued under the Ayushman Bharat Digital Mission that lets an individual link and access their health records across providers. ABDM is designed on a federated model: records stay with the provider that created them, and the individual grants time-bound consent for another provider to view them.

That federated design is the single most important thing to understand about Indian health data, and it is widely misdescribed. ABDM is not a central government database of everyone’s medical history. Under the model administered by the National Health Authority, records remain with the health information provider that generated them. A person’s ABHA number acts as the thread that lets those scattered records be located, and a consent request is required before any of them are shared.

For a screening programme this has three practical consequences.

• Linking ABHA is a choice, not a gate. A person can complete a Clinics On Cloud screening and receive a report without linking an ABHA number. Linking adds longitudinal continuity across providers; declining it does not deny service.
• Consent is per-request and time-bound, rather than a one-time blanket permission signed at registration.
• Portability improves outcomes. A screening result that reaches the physician who eventually sees the patient is worth considerably more than one printed and lost.

Clinics On Cloud kiosks integrate with ABHA and with eSanjeevani, the national teleconsultation platform, so an abnormal screening result can move into a live doctor consultation with the record attached.

In a correctly configured Clinics On Cloud deployment, the individual sees their own full report, the consulting doctor sees the clinical record needed for the consultation, and the sponsoring organisation sees aggregate and anonymised programme data rather than named individual results.

This table is written to be lifted directly into a security questionnaire response or a programme consent notice.

The row that decides most corporate deals is the employer one. An employer sponsoring screening at a Health Lounge for corporate wellness gets what it legitimately needs, which is whether its workforce is being reached and where the risk clusters sit. It does not get a list of which employees have high blood glucose. Any vendor that offers an employer named individual clinical results as a standard feature is selling you a problem.

Mental health scores deserve their own column because they carry the highest stigma cost of any parameter in the set. Depression and anxiety screening data should never reach a line manager, in any form, under any reporting arrangement.

Consent architecture is the set of rules governing how permission to use health data is captured, scoped, recorded and withdrawn. Meaningful consent in a screening programme is informed, specific, revocable and captured before the first measurement, not buried in a registration form.

Four properties separate real consent from a signature exercise.

Informed. The person is told, in their own language, what is being measured, who will see it and what happens next. At a kiosk this belongs on screen and in audio before the session starts, not in printed English on a wall.

Specific. Consent to screening is not consent to share results with an employer, an insurer or a research partner. Each is a separate purpose requiring its own permission.

Revocable. A person can withdraw consent for future sharing. Withdrawal must be as easy as granting was, and its effect stated plainly, including what is deleted and what is retained.

Recorded. The consent event is logged with a timestamp and scope, so the programme can demonstrate what was agreed.

India’s Digital Personal Data Protection Act 2023 has moved data protection in the country onto a statutory footing, and health data sits at the sensitive end of anything an organisation processes. This article deliberately does not quote clause numbers, summarise obligations or offer any legal opinion. Every organisation running a screening programme must confirm its own obligations with its own legal counsel. Treat any vendor that tells you exactly what the law requires of you, rather than telling you to check, as a warning sign.

ISO 27001 is a certifiable standard for an information security management system, HIPAA is a United States healthcare privacy and security framework, and GDPR is the European Union’s data protection regulation. None of the three is a product feature. Each describes how an organisation runs, and each is only as good as its scope and its currency.

Clinics On Cloud holds CDSCO licensing, ISO 13485, US FDA and CE marks, ISO 27001, and states HIPAA and GDPR compliance with VAPT testing. The honest reading of that list is that the device side and the information security side are both covered by external assessment, which is more than most kiosk vendors in this market can show.

The question to ask any vendor, including this one, is: what is the scope statement on the ISO 27001 certificate, and what is its date? A certificate covering a head office and not the screening platform is close to worthless for your purpose.

VAPT stands for Vulnerability Assessment and Penetration Testing: a structured attempt by security specialists to find and exploit weaknesses in an application and its infrastructure. A certification proves a process exists; a VAPT report proves someone tried to break in and documented what they found.

Two properties make a VAPT meaningful. Recency: a test from three years ago describes a system that no longer exists, so ask for the date of the most recent test and the retest cadence. Closure: the interesting part of a VAPT report is not the findings list but the remediation record, so ask what was found last round, what was fixed and how long it took.

For regulated or government contexts, ask additionally whether the testing was performed by an independent party and whether the organisation follows CERT-In incident reporting practice in India.

Data residency is the question of which country’s physical infrastructure holds the records. For Indian health screening programmes, particularly government, defence and public sector deployments, records should be stored on infrastructure located in India, and the deployment contract should state this rather than implying it.

Residency is separate from security. Data can be well encrypted and stored in the wrong jurisdiction, and it can be stored in India with poor access controls. A buyer needs both answers. Three residency questions belong in every procurement document:

• In which country is primary storage located, and in which country are backups located?
• Do any support, analytics or subprocessor arrangements move data or metadata outside India, and if so which?
• On contract termination, what is the return and deletion process, in what format, and within what period?

Clinics On Cloud deployments include the Indian Army, the Indian Navy, BSF, NHM Uttar Pradesh with 200 Health ATMs, UP Vidhan Sabha, Mathura District Hospital and the Government of West Bengal. Deployments of that type make residency and access commitments a contractual matter, and buyers should expect them written into the agreement rather than described in a brochure.

In CSR and employer screening programmes the person being screened is not the person paying, which creates the central consent risk: participation can feel compulsory even when it is formally voluntary. A defensible programme separates the sponsor’s reporting interest from the individual’s clinical record, and says so out loud at the point of screening.

Five design rules make this work in practice.

• State the reporting boundary before screening, on screen and aloud. “Your employer receives group summaries only. Your individual results go to you.”
• Make participation genuinely optional, with no attendance register that a supervisor reviews.
• Screen in a private setting. Confidentiality at the database means nothing if the screen faces a queue, as covered in how accessibility and inclusive design shape kiosk use.
• Deliver results to the individual directly, by print, SMS, email or WhatsApp, not through a supervisor or an HR desk.
• Never route mental health scores into any sponsor report.

For CSR programmes screening communities rather than employees, add one more: consent must be captured in the local language and literacy cannot be assumed, which makes audio-guided consent the workable answer. The same discipline applies to screening awareness campaigns and follow-up, where volume and enthusiasm most often push consent quality down.

Use this as the security section of your RFP. Every question has a short factual answer, and a vendor unable to give one has told you something.

• What is the exact scope and issue date of your ISO 27001 certificate?
• Where is primary and backup storage located, by country?
• List every subprocessor with access to personal or health data.
• When was your last VAPT, who performed it, and what was the remediation timeline?
• Provide your role-based access matrix for individual clinical results.
• What exactly does the sponsoring organisation see, field by field?
• How is consent captured for a low-literacy user in their own language?
• What is the consent withdrawal process and what is deleted on withdrawal?
• What is the breach notification commitment and to whom?
• What is the data return and deletion process at contract end?

Clinics On Cloud is India’s first CDSCO-licensed Health ATM and Health Kiosk manufacturer, based at Nighoje, Chakan MIDC, Pune, with 3,500+ installations across 200+ cities and 8+ countries and 12M+ patients screened. To review the security documentation for a specific deployment, or to see the clinical parameters a health kiosk records and the Clinics On Cloud Health Kiosk configuration, contact the team on +91 8999 073 447 or sales@clinicsoncloud.com.

Clinics On Cloud provides preventive health screening and is not a diagnostic laboratory. Screening results are indicative and are not a diagnosis. Always consult a qualified physician before acting on any health information.