India’s Health Data Faces Growing Threat of Breaches and Cyber Attacks, Raising Concerns for Public Privacy and Security

Recent data leaks in India, including sensitive information such as names, Aadhaar national IDs, mobile numbers, voter IDs, passports, and COVID vaccination status, have put millions of individuals at risk and highlighted the vulnerability of health data security in the country. These breaches have raised alarm among digital experts, as they leave individuals susceptible to scams, harassment, and discrimination, while the absence of a robust data protection law exacerbates the situation.

The breaches have also cast a shadow over India’s efforts to develop and export its digital public infrastructure model, comprising Aadhaar, the mobile payment system UPI, and the National Health Stack data platform. These initiatives aim to improve access and efficiency in public services but may unwittingly expose people to data collection and overreach risks.

Raman Jit Singh Chima, Asia Policy Director at digital rights group Access Now, warned, “Push for greater digitization of health data is happening without adequate data protection, placing individuals in harm’s way. In November, the All India Institute of Medical Sciences (AIIMS) suffered a cyber-attack compromising up to 40 million patient records.” He asserted that India’s approach to data breaches and reluctance to hold institutions accountable is reckless.

Experts highlighted the need for discussions and adequate data protection in the nation’s pursuit of digital public infrastructure. India’s ambitious Digital India program, including the national digital health mission linking individual health records to a unique ID, raises concerns about data security and potential misuse.

While India introduced legislation to improve cyber security and data breach reporting, its national cyber security policy has not been updated since 2013, exposing the expanding digital infrastructure to new threats. Moreover, the long-delayed data protection bill, anticipated to pass soon, faces scrutiny regarding the protection of sensitive health data and the accountability of government agencies in case of breaches.

As data breaches threaten privacy and security, there is an urgent need for robust data protection measures to safeguard sensitive health information and strengthen India’s digital public infrastructure.