How to Grant Temporary Access to Doctors Using Your Digital Health Record
A permanent grant of access to your medical record is almost never what you want. It sounds convenient — the specialist can look at anything, whenever — but it means every future doctor in that clinic can look at anything, without you being asked. Temporary, scoped access is the sensible default, and it takes almost no more effort.
The four properties of a good grant
- Property: Scoped · Why it matters: Only the folder or category the specialist actually needs — not the whole record
- Property: Time-limited · Why it matters: Auto-expires without needing you to remember to revoke
- Property: View-only · Why it matters: The doctor reads, but the file does not leave
- Property: Logged · Why it matters: You can see whether and when it was opened
Any digital record worth using offers all four. If yours does not, you are handing over more than you meant to.
The specific durations to set
Match the grant duration to the appointment shape:
- One-time consultation: 24-48 hours. Long enough for the specialist to review before the appointment and follow up the next morning if needed.
- Ongoing chronic care with a regular doctor: 90 days, renewed at each visit. Automatic renewal is a bad idea — the review keeps you in the loop.
- Second opinion: 48-72 hours. The specialist reads, decides, writes back, and access closes.
- Emergency access: 24 hours. Just long enough for the immediate care.
- Long-term GP: quarterly renewal. GPs need continuity but not permanent unmonitored access.
Revoking, deliberately
When the visit is over, close the grant even if it has time left. Two reasons:
- It removes a copy of your data from live circulation. What the clinic already downloaded stays; what they can still fetch does not.
- It builds the habit. A locker where old grants accumulate is one where any clinic on the list can pull anything, any time.
The consent artefact
Under India's DPDP framework, and under ABDM's own consent architecture, a grant is not just a checkbox — it is an artefact naming the requester, the info type, the purpose, the time range of records and the duration of access. Every one of those fields is a limit, and every one is a lever the record owner controls. A prompt that asks you to grant 'everything, forever, for any purpose' is a prompt to refuse.
What happens after you revoke
Revoking prevents new fetches. It does not delete what the clinic already has — nothing you consent to sharing outside your app can be pulled back once it has been downloaded. This is why the initial scope matters more than the eventual revoke. A doctor who needs a lab report gets a lab report; they do not need your discharge summary from 2019 as well.
Every time you approve a share, ask yourself whether the request is the smallest one that answers the question. It usually is not; the request usually asks for more than the situation warrants, because that is the default the requesting system offers. Narrowing it is your job.
References
Free for 90 days, no card needed. After that, keeping the record costs ₹349 for the year.
General information, not medical advice. Always talk to a qualified doctor about your own care. Where this and your doctor disagree, your doctor is right.