Consent Artefacts and Time-Limited Access: How Modern Health Sharing Should Work
The way health records were shared for decades — a photocopy handed over, an email attachment sent, a WhatsApp forward — was fundamentally unscoped. Once shared, the record was out of the patient's control. Modern consent architecture, built into India's ABDM framework and offered by good personal record apps, replaces the photocopy with something more powerful: an artefact that specifies who can see what, for how long, and for what purpose.
What a consent artefact contains
- Field: Requester · What it means: Who is asking for access · Example: Dr. Ramesh, XYZ Cardiology Clinic
- Field: Purpose · What it means: Why the access is needed · Example: Consultation on 12 September 2025
- Field: Info types · What it means: What categories of records · Example: Prescription; Lab reports; Discharge summary
- Field: Time range of records · What it means: Which records within the categories · Example: Records from Jan 2024 onwards
- Field: Access period · What it means: How long the access lasts · Example: 48 hours from grant
- Field: Fetch frequency · What it means: One-time or ongoing · Example: One-time
The four dimensions you should control
- Who: the specific requester, not 'the clinic' broadly.
- What: specific info types and specific time range within them.
- When: how long access lasts.
- How often: one fetch or ongoing pulls.
A good app's grant screen shows all four with sensible defaults you can tighten. A poor app defaults to 'everything, forever, for anyone at the clinic'. The defaults matter — most users accept them.
The default that works for most consultations
- Requester: the specific doctor, not the whole clinic.
- What: only the info types directly relevant. A cardiology visit needs prescription and cardiac reports, not psychiatric history.
- Time range: last 24 months, unless a specific older document is needed.
- Access period: 48 hours.
- Fetch frequency: one-time.
This is the 'narrow consent' pattern. It gives the doctor what they need for the visit and nothing more. Broader is easy; narrower is deliberate and safer.
The revocation you should actually use
Revoking access after the visit is a habit worth building. Reasons:
- It removes a copy of your data from live circulation.
- It builds discipline — grants that are left open accumulate silently.
- It gives you the audit — 'these are the grants currently active' should be a small number, not a long list.
What revocation does not do: pull back data that has already been downloaded by the requester. Anything they saved to their local system stays. This is why narrow consent at grant time is more valuable than aggressive revocation later — the narrower the initial grant, the less there is to preserve.
Long-term care relationships
For a doctor who cares for you continuously — your primary care physician, the specialist you see quarterly — a longer-term grant makes sense. The pattern:
- Quarterly consent, renewed at each visit.
- Access to relevant info types, not all.
- Notification when the grant is used, so you know when they accessed.
- Automatic expiry if not renewed.
What ABDM adds
India's ABDM framework standardises the consent artefact across providers. A consent granted through the ABHA app is honoured by any ABDM-connected hospital or lab. This means:
- The same consent workflow works across different providers.
- You have one place — the ABHA app — to see all your active consents.
- You have one place to revoke any of them.
- The audit log of who fetched what is centrally visible.
The design is one of the more thoughtful parts of India's digital health infrastructure. Not every part of the ecosystem uses it yet, but where it does, the patient's control is real and unusually strong compared to global comparisons.
Why this matters
A shared record is only as safe as the sharing mechanism. Unscoped sharing produced the old world of leaked medical data. Consent artefacts, done well, produce a new world where sharing is scoped, revocable, and logged. As a patient, insisting on tools that offer this — and using them thoughtfully — is what makes your record something worth trusting.
References
Free for 90 days, no card needed. After that, keeping the record costs ₹349 for the year.
General information, not medical advice. Always talk to a qualified doctor about your own care. Where this and your doctor disagree, your doctor is right.