1. Introduction

Data portability rights in digital health ecosystems refer to the legal rights and mechanisms through which individuals can obtain, transfer, reuse, and, where applicable, transmit their personal health information between healthcare providers, hospitals, laboratories, pharmacies, health-insurance companies, wearable-device platforms, telemedicine services, and digital health applications.

Digital health ecosystems increasingly rely on interconnected systems that collect and process electronic health records (EHRs), diagnostic reports, prescriptions, genomic information, medical images, wearable-generated health measurements, and clinical decision-support data. When these records remain locked within a particular platform, patients may face barriers to changing doctors, obtaining second opinions, accessing affordable treatment, or using competing digital health services.

Data portability therefore serves several legal and policy objectives:

Patient autonomy: enabling individuals to make informed choices about their healthcare.

Continuity of care: ensuring that clinically relevant records can follow a patient between providers.

Privacy and data protection: giving individuals meaningful control over their personal information.

Competition and innovation: reducing technological lock-in and barriers to switching providers.

Accountability: making it easier to identify errors, challenge inaccurate records, and obtain independent review.

However, data portability does not mean that every piece of health-related information must be transferred automatically or without restriction. The right depends on the applicable jurisdiction, the type of data, the legal basis for processing, technical feasibility, third-party confidentiality, and the distinction between personal information and a provider's proprietary analytical material.

2. Meaning and scope of data portability

Data portability is related to, but distinct from, data access, data sharing, interoperability, and data ownership.

A patient may have a right to access a laboratory report without having an unrestricted right to the laboratory's entire database, proprietary algorithms, or internal research documentation. Similarly, a provider may be required to disclose a record even when the provider owns the physical record or controls the system in which it is stored.

Typical categories of portable digital health data

Medip health :: Bienvenidos al hospital 2.0

Electronic health records

Medical histories, diagnoses, clinical notes, discharge summaries, allergies, and treatment records.

FULL LONDON Health Screen Plus X In London – Blood Tests London

Diagnostic information

Blood-test results, pathology reports, radiology images, imaging reports, and laboratory measurements.

Wearpro smartwatch app, record health and sports data

Wearable and app-generated data

Heart-rate measurements, activity records, sleep information, ECG readings, and other health metrics.

Uniwersytet Medyczny w Białymstoku. O Centrum.

Genomic and specialised health data

Sequencing results, genetic reports, and other information requiring heightened confidentiality safeguards.

The portability of each category must be assessed separately. Information directly supplied by a patient, measurements generated by observing the patient, and inferences created by a platform may receive different legal treatment.

3. Legal framework governing data portability

A. European Union: GDPR

The European Union's General Data Protection Regulation (GDPR) provides one of the clearest express legal rights to data portability.

Article 20 — Right to data portability allows an individual to:

Receive personal data concerning them that they have provided to a controller.

Receive that information in a structured, commonly used, machine-readable format.

Transmit the information to another controller without hindrance.

Request direct controller-to-controller transmission where technically feasible.

The right applies where processing is automated and based on consent under Articles 6(1)(a) or 9(2)(a), or on a contract under Article 6(1)(b). Article 20(3) excludes processing necessary for a task carried out in the public interest or in the exercise of official authority. The rights and freedoms of other persons must also be respected.

Legislation.gov.uk+1

Application to digital health

Suppose a patient uses a private telemedicine platform that stores medical records, consultation histories, and connected-device readings. If the relevant processing meets Article 20's requirements, the patient may request a portable copy and, where technically feasible, direct transfer to another service.

However, not all medical records automatically qualify under Article 20. Records processed by a hospital under a legal obligation or a public-interest healthcare function may fall outside this particular portability right, even though the patient may have a separate right of access under Article 15.

Important distinction: GDPR access rights can be broader than portability rights. A patient should not be denied access merely because a record does not qualify for Article 20 portability.

B. India: constitutional privacy, data protection and ABDM

India's framework involves constitutional rights, general data-protection legislation, sector-specific rules, and the operational policies of the Ayushman Bharat Digital Mission (ABDM).

1. Constitutional protection of privacy

In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, a nine-judge bench of the Supreme Court recognised privacy as a fundamental right under the Constitution, grounded in Article 21 and the freedoms protected by Part III.

The judgment provides a constitutional foundation for protecting medical confidentiality, informational autonomy, and control over personal information. It does not, however, expressly establish a general data-portability right equivalent to GDPR Article 20.

2. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data and protecting individuals' data-protection interests. Its provisions must be read with their commencement notifications and applicable rules.

India Code+1

A critical difference from the GDPR is that the DPDP Act does not establish a general, express right to data portability equivalent to Article 20 GDPR.

Accordingly, a patient in India should not assume that the DPDP Act alone guarantees a right to transfer every electronic health record directly between platforms. Access, disclosure, correction, grievance remedies, and transfers may instead depend on the applicable law, rules, contractual arrangements, and health-sector framework.

3. Ayushman Bharat Digital Mission

ABDM seeks to enable interoperable digital healthcare and the creation of longitudinal electronic health records. Its architecture facilitates exchange between intended participants following patient consent, rather than relying on a single central repository of all patient records. The Health Data Management Policy establishes privacy and security principles for participating stakeholders.

National Portal of India+2

ABDM's significance for portability is practical: it can make health information more transferable between participating systems through common standards, consent mechanisms, and interoperable infrastructure.

Nevertheless, technical interoperability and a legally enforceable individual portability right are not identical. The patient's ability to request, authorize, or challenge a transfer must still be assessed under the relevant legal and policy provisions.

C. United States: HIPAA and health-record access

The Health Insurance Portability and Accountability Act (HIPAA) provides a right of access to protected health information held by covered entities in designated record sets.

Under 45 C.F.R. § 164.524(c)(3)(ii), an individual can direct a covered entity to transmit a copy of qualifying health information to a designated third party through a written, signed request identifying the recipient and destination. This is a significant mechanism for transferring records to another healthcare provider or service.

HHS.gov+1

However, HIPAA's access-and-transmission mechanism is not equivalent to the broad GDPR portability right. Its scope is determined by the HIPAA Privacy Rule and applicable law.

D. Comparative overview

4. Detailed case-law analysis

A key research qualification is necessary: the following cases establish principles relevant to digital health portability, access, privacy, and transfer of medical records; they should not all be described as direct judgments enforcing an express data-portability right. That distinction matters when preparing legal arguments or academic writing.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: The Supreme Court considered whether privacy is protected as a fundamental right under the Indian Constitution.

Decision: The nine-judge bench unanimously recognised privacy as a constitutionally protected fundamental right, including aspects of individual autonomy and informational privacy.

Relevance to digital health portability:

Medical information is closely connected to bodily integrity, personal autonomy, and dignity.

Digital health systems should not treat patient data as freely transferable merely because it is held electronically.

Access and transfer mechanisms should incorporate lawful purposes, appropriate safeguards, and respect for individual privacy.

Legal significance: Puttaswamy supplies a constitutional foundation for privacy-protective digital health governance. It supports arguments against arbitrary or disproportionate processing, but it does not itself create a freestanding statutory right to portable health records.

Indian Kanoon+1

Case 2: Mr. X v. Hospital Z

Supreme Court of India · (1998) 8 SCC 296

Facts: The case concerned the disclosure of a patient's HIV-positive status by a hospital in circumstances connected with a proposed marriage.

Decision: The Court considered medical confidentiality alongside competing rights and public-interest concerns, recognising that confidentiality is important but not absolute.

Relevance to portability:

This case illustrates why transferring health data requires more than identifying the patient who owns or is associated with the information.

A lawful transfer must also consider:

Whether the recipient is authorised.

Whether disclosure is justified by consent or another valid legal basis.

Whether the information includes sensitive details that could harm the patient if improperly disclosed.

Whether a competing legal duty or sufficiently important public interest justifies disclosure.

Legal significance: The case supports confidentiality safeguards around health-data transfers. It does not decide a patient's express right to portability between digital platforms.

Case 3: Ciox Health, LLC v. Azar

United States District Court for the District of Columbia · 435 F. Supp. 3d 30 (D.D.C. 2020)

Facts: A medical-records provider challenged federal regulatory guidance concerning the HIPAA right of access, including third-party directives and the fees that could be charged for providing records.

Decision: The court invalidated aspects of the federal rules and guidance that extended third-party directives and patient-rate fee limitations beyond the authority provided by the governing statute and regulations.

Document 51 (D.D.C. 2020) :: Justia+1

Relevance to portability:

The judgment demonstrates that patient-directed transfer rights depend on the exact statutory authority and regulatory framework. A regulator cannot necessarily extend a right beyond the scope authorised by legislation.

For digital health providers, this highlights the importance of distinguishing between:

A patient's right to obtain their own records.

A patient's right to direct a provider to send those records elsewhere.

A third party's independent entitlement to receive the records.

The fees permitted for fulfilling a transfer request.

Legal significance: Ciox Health is particularly relevant to the design of patient-directed health-record transfer procedures. It is a US access-rights case, not a ruling interpreting GDPR Article 20.

Case 4: Faber v. Ciox Health, LLC

United States Court of Appeals for the Sixth Circuit · 2020

Facts and issue: The dispute concerned claims arising from medical-records services and the legal remedies available under HIPAA and related state law.

Decision: The appellate court emphasised that HIPAA does not itself provide a private right of action for individuals to sue directly for violations of the statute. The case also addressed the effect of the class judgment on absent class members.

opn.ca6.uscourts.gov

Relevance to portability:

Even where legal rules impose obligations concerning access to health records, the available enforcement route may not be a direct damages action under the relevant statute.

A patient seeking a remedy for a failed transfer may therefore need to examine:

Regulatory complaint mechanisms.

State medical-records legislation.

Contractual rights.

Other applicable privacy or consumer-protection claims.

Legal significance: The case demonstrates that substantive access protections and the availability of a private judicial remedy are separate questions.

Case 5: Österreichische Datenschutzbehörde v. CRIF GmbH

Court of Justice of the European Union · Case C-487/21 · Judgment of 4 May 2023

Facts and issue: The case concerned the scope of the GDPR right of access, particularly what constitutes a copy of personal data under Article 15(3).

Decision: The Court held that the right to obtain a copy requires a faithful and intelligible reproduction of the personal data being processed. Extracts from documents or entire documents may be necessary where they are essential to enable the individual to understand and exercise their rights.

European Data Protection Board

Relevance to digital health portability:

Although this was an access-rights case rather than a direct portability dispute, its reasoning is important when a patient requests medical records from a digital platform.

For example, a patient may need the original context of a diagnostic result, the associated clinical notes, or relevant portions of a medical document to understand the information correctly.

A provider should not assume that a bare list of extracted data values will always satisfy an access request.

Legal significance: The case strengthens the distinction between access to intelligible personal data and portability in a machine-readable format. It does not establish that every access request must be fulfilled in the same format as a portability request.

Case 6: F.F. v. Österreichische Datenschutzbehörde

Court of Justice of the European Union · Case C-579/21 · Judgment of 22 June 2023

Principle: The case addressed the information that a data subject may obtain about consultations of their personal data under Article 15 GDPR.

Relevance to digital health: Audit trails and access logs can help patients investigate who accessed their health records and when. Such information can support accountability where a patient suspects that a transfer or disclosure was unauthorised.

However, access to information about processing activity should not be confused with a right to export all system logs or the identity of every employee involved in processing.

Legal significance: The case is relevant to the transparency and accountability that should accompany health-data sharing, although it is not a direct ruling on Article 20 portability.

5. Major legal issues in digital health data portability

A. Scope of portable data

One of the most difficult questions is determining which data must be transferred.

Potentially relevant categories include:

Patient-provided information, such as medical histories and questionnaires.

Observed or measured information, such as wearable-device readings.

Laboratory results and diagnostic reports.

Clinical notes and prescriptions, subject to the applicable access and portability rules.

Inferred information, such as risk scores generated by an algorithm.

Proprietary material, including source code, internal models, and confidential business information.

Under GDPR Article 20, the right is limited to qualifying personal data provided by the data subject. Regulatory guidance interprets this to include certain observed data, such as raw measurements generated by connected devices, but generally distinguishes it from additional profiles or inferences created by a controller. Inferred personal data may nevertheless fall within the broader right of access under Article 15.

ICO+1

For example, a wearable-device user may be able to request raw heart-rate measurements, while the legal entitlement to receive the provider's proprietary cardiovascular-risk model is a separate question.

B. Interoperability and technical barriers

Data portability is ineffective if the receiving platform cannot interpret the transferred information.

Common obstacles include:

Incompatible electronic health record systems.

Different coding conventions for diagnoses and medicines.

Proprietary formats and application programming interfaces.

Missing metadata or timestamps.

Incomplete transfer of images, attachments, and clinical notes.

Excessive fees or unnecessary administrative requirements.

Standards such as HL7 FHIR, suitable terminology systems, and secure APIs can help make health information usable across platforms. However, adopting a standard does not automatically establish a legal obligation to transfer every category of information.

C. Consent and patient authorisation

Consent can play two distinct roles: authorising a particular disclosure and establishing a legal basis for processing.

Under GDPR Article 20, consent is one of the qualifying legal bases for portability, but it is not the only one; qualifying contractual processing can also support the right.

In India, ABDM's consent-based exchange arrangements are important for transfers between participating entities. A transfer should nevertheless be assessed under the applicable legal framework, rather than assuming that a patient's initial consent authorises every subsequent use.

A sound process should identify:

The patient and the records requested.

The intended recipient.

The purpose and scope of the transfer.

The applicable legal basis and any required authorisation.

The method for verifying the request and protecting the data in transit.

D. Privacy, confidentiality, and third-party rights

Portability must not become a mechanism for exposing other people's personal information.

A clinical record may contain information about relatives, genetic contributors, caregivers, or other patients. A hospital must assess whether redaction or another proportionate safeguard is necessary.

Genomic data presents a particularly difficult issue because one person's genetic information can reveal information about biological relatives who have not themselves requested the transfer.

The legal response should balance the patient's rights with confidentiality and other applicable legal protections, rather than automatically withholding the entire record.

E. Data accuracy and incomplete records

A transfer can preserve an error just as easily as it can preserve accurate information.

Healthcare organisations should maintain appropriate accuracy controls and, where required by applicable law, provide correction mechanisms. The act of transferring data does not necessarily require the original provider to create a new clinical opinion or independently revalidate every historical result.

Where data are incomplete, disputed, or superseded, suitable metadata and annotations can reduce the risk that another provider relies on an outdated diagnosis or an unverified measurement.

6. Remedies for unlawful refusal or obstruction

The remedies available depend on the jurisdiction and the legal basis for the request.

In the EU, complaints may be made to the competent supervisory authority, and judicial remedies may be available under the GDPR. In the United States, HIPAA complaints can be made to the Department of Health and Human Services' Office for Civil Rights, although HIPAA does not itself create a private right of action. In India, the appropriate remedy depends on the applicable legislation, its commencement status, relevant health-sector rules, and the facts of the dispute.

7. Practical example

Consider a patient who changes from Hospital A to Hospital B and wants to transfer electronic medical records, laboratory results, and wearable-device measurements.

Step 1 — Identify the records

The patient specifies the records, date range, and intended recipient.

Step 2 — Verify the request

Hospital A verifies identity, authority, and the legal basis for disclosure.

Step 3 — Prepare the transfer

The hospital exports qualifying records in the required or appropriate usable format, preserving relevant context and metadata.

Step 4 — Transfer securely

The records are sent to the verified destination using suitable security controls, and the transfer is documented.

Step 5 — Confirm usability

Hospital B checks that the files are readable and clinically interpretable and identifies any missing information.

If Hospital A refuses the request solely because Hospital B uses a competing electronic health record system, the refusal may be legally challengeable where an applicable portability or access right requires disclosure and no valid exception applies. If Hospital B cannot read a particular proprietary file, the solution may involve an alternative export format or a separate interoperability obligation, rather than assuming that either hospital has violated the law automatically.

8. Recommended compliance framework for digital health providers

Healthcare organisations, health-tech businesses, and electronic-record vendors should implement the following measures.

Define data categories: distinguish patient-provided data, observed data, clinical records, derived data, and proprietary information.

Create a request procedure: establish a clear process for receiving, verifying, tracking, and answering requests.

Adopt interoperable formats: use suitable technical standards and preserve the metadata necessary to interpret records.

Apply data minimisation: transfer the information needed and legally authorised for the request, without exposing unrelated records.

Secure the transmission: authenticate recipients, protect data in transit, and maintain appropriate access controls.

Provide transparent explanations: communicate the scope, format, timing, and any lawful limitation on a transfer.

Maintain audit trails: document the request, verification, records transferred, destination, and outcome.

Establish dispute resolution: provide escalation and complaint mechanisms for refusals, incomplete exports, and disputed fees.

Review cross-border transfers: assess applicable transfer restrictions and the receiving country's data-protection requirements.

Test actual usability: verify that exported information can be interpreted by the intended recipient, rather than merely generating a downloadable file.

9. Conclusion

Data portability is a significant component of patient autonomy, privacy, continuity of care, and competition in digital health ecosystems. Its legal strength, however, varies across jurisdictions.

The GDPR expressly establishes a conditional right to data portability. The United States provides important patient-directed transfer mechanisms through HIPAA's right of access. In India, constitutional privacy protections, the DPDP framework, health-sector rules, and ABDM's interoperability and consent arrangements provide relevant legal and operational foundations, but the DPDP Act does not establish a general portability right equivalent to GDPR Article 20.

The cases discussed above show why a complete legal analysis must distinguish portability from access, confidentiality, technical interoperability, and enforcement. A successful digital health portability framework must protect patients from unnecessary barriers while preserving medical confidentiality, data security, and the rights of other affected persons.

This is a comparative legal overview, not jurisdiction-specific legal advice. The applicable provisions and commencement status should be verified before relying on them in a current dispute or formal legal submission.

Primary legal sources for further study

GDPR, including Article 20 — Right to data portability

Digital Personal Data Protection Act, 2023 — India Code

Ayushman Bharat Digital Mission — Health Data Management Policy

US HHS — Patient-directed transfer of protected health information

European Data Protection Board — Guidelines on data-subject access rights