How to Deliver Lab Reports Online to Patients and Doctors, Securely

A front desk executive at a lab in Vashi once showed me her phone. Her WhatsApp had more than 400 chats with patients, each with a report PDF in it, sent from her personal number because “patients ask for it on WhatsApp”. She had left the previous lab with a similar phone. Nobody had thought about what was on it.

This guide answers one question: how should a diagnostic lab deliver reports online to patients and referring doctors, quickly and securely? I write as the founder of Infoways, a Navi Mumbai company that builds report delivery, patient portals and booking systems for labs. The method works with whatever lab information system (LIS) you run, and much of it can start this week without new software.

1. How do labs deliver reports online securely?

A secure online report delivery has five parts: release only after sign-off, a neutral notice to the patient, a link that opens only after an OTP and expires, a patient portal where past reports live, and a log of who opened what. Doctors get the same report through their own login, with the patient’s consent.

The reason for the extra steps is simple. A lab report is about a person’s health, and under the Digital Personal Data Protection Act 2023 it is personal data your lab holds as a data fiduciary. The DPDP Rules, notified on 14 November 2025 and phased in over 12 to 18 months, list security safeguards such as encryption, access controls, logging and backups (The Week/PTI; SCC Online). A PDF sent into a chat is outside every one of those controls the moment it leaves.

Source: Infoways’ assessment from setting up report delivery for labs. Legal basis: DPDP Rules safeguards as summarised by SCC Online; WhatsApp limits from the WhatsApp Business Messaging Policy.

2. Can a lab send reports on WhatsApp?

A lab can use WhatsApp to tell an opted-in patient that a report is ready, with a link to a secure page. It should not send the report itself, the results or the test names in the WhatsApp message. The WhatsApp Business Messaging Policy restricts health information where regulations require heightened safeguards.

The policy, last updated on 23 September 2026, says: “Don’t use WhatsApp for telemedicine or to send or request any health related information, if applicable regulations prohibit distribution of such information to systems that do not meet heightened requirements to handle health related information.” It also prohibits using WhatsApp Business to buy, sell or promote drugs and medical and healthcare products, and requires opt-in before you message anyone (WhatsApp policy).

You do not need to settle the legal question of whether a chat app meets those requirements. If the message contains nothing about health, only that a report is ready and a link, the report stays on a system you control. That is the pattern we build for every lab.

What the notice should and should not say

Source: Infoways’ default template for lab clients, written to stay within the health information limits in the WhatsApp Business Messaging Policy. SMS versions must use a DLT-registered template with a whitelisted link (MediaNama on TRAI’s URL rule).

Use the WhatsApp Business Platform through a provider on the lab’s own number, not staff phones. Then messages come from one number, opt-ins are recorded, and nobody leaves with 400 report chats.

See also: Report delivery is the last step of a longer chain. Our guide to home sample collection booking covers the steps before it.

3. How OTP links and link expiry work

An OTP link is a unique web address for one report that asks for a one-time password, sent to the patient’s registered mobile, before the report opens. Link expiry means the address stops working after a set time, so a forwarded or old message cannot open the report later.

This design solves the two most common leaks we see: a message forwarded to the wrong family group, and a phone that changes hands. Without the OTP, anyone with the link sees the report. Without expiry, the link works for years.

Settings that work for most labs

• One link per report, never a link that lists all of a patient’s reports.
• OTP sent only to the mobile number registered at booking, never to a number typed on the report page.
• Link valid for a fixed period, often 7 to 30 days; after that, the patient logs in to the portal or asks the lab to resend.
• OTP retries limited, with a lock after several wrong attempts.
• Downloads allowed, but every view and download logged with time.
• For a family booking, the OTP goes to the account holder who booked, unless the adult patient asks for their own number.

The DPDP Rules require a data fiduciary to tell each affected person, without delay and in plain language, if their personal data is breached (The Week/PTI). Logs and a disable switch are what let you find out quickly which reports were exposed, and stop it.

4. What should a lab patient portal include?

A lab patient portal should let a patient log in with an OTP, see all their signed reports in one place, manage family profiles, download a report, compare repeat tests over time, and book the next test. It should never show a report that has not been signed off.

Repeat patients use portals most: diabetics checking HbA1c every few months, thyroid patients checking TSH, elderly parents whose children manage their tests. For them, the portal replaces a folder of paper. A trend chart of past values is useful, but present it as their numbers over time, not as a diagnosis or a health score; interpretation belongs with their doctor.

Source: Infoways’ portal specification for lab clients. Consent and withdrawal follow the DPDP Act 2023 framework; confirm details with your adviser.

See also: A portal is also how a neighbourhood lab keeps repeat patients who might otherwise drift to app-based aggregators. We compare the two in local labs vs aggregators, and cover being found nearby in Google Business Profile for diagnostic labs.

5. How should doctors get their patients’ reports?

Doctors should get reports through their own login or a secure link, only for patients who agreed at booking that the report may be shared with that doctor. Record the consent with the booking, and let the patient withdraw it.

In practice, the patient names a referring doctor at booking and ticks a consent line: “Share my report with Dr ___.” When the report is signed, the doctor gets a notice and opens it in their account. Doctors who see many of your patients get a simple list of their patients’ signed reports, with search. A doctor who sees a critical value should also get a phone call from the lab, because a notice can sit unread.

Keep the doctor relationship on service. Track which doctors refer patients so their reports reach them quickly and so you notice when a doctor stops referring. Do not attach any payment, cut or gift to referrals; Indian medical ethics frameworks prohibit referral commissions and inducements from labs (Indian Journal of Medical Ethics, July 2026).

6. Amended reports, sign-off and NABL scope

When a released report has to be corrected, issue an amended version that keeps the original, records the reason and the person who amended it, and notifies the patient and doctor that a revised report is available. Never silently replace a PDF someone may already have.

Accredited labs work to ISO 15189, which has requirements on reporting and releasing results; NABL now accredits medical labs to the 2022 version and launched a new application portal for it in August 2025 (PIB). I have not quoted the standard’s report-content clauses here because the text is not public; your quality manager has them. What software must do is simple: release only after an authorised signatory approves, show NABL accreditation only for tests within your scope, and keep amendments traceable.

7. Can a lab link reports to ABHA under ABDM?

Yes, if the lab chooses to. A lab registers in the Health Facility Registry and uses an ABDM-enabled lab information system to link reports to the patient’s ABHA, with the patient’s consent. The patient can then see those reports in an ABHA-linked health records app.

The National Health Authority’s flyer for labs says all types of labs can join, explains registration on the Health Facility Registry with a health professional ID, and says the lab needs an ABDM-enabled LMIS to generate and link health records with the patient’s ABHA; a lab with its own system can make it ABDM-enabled through the ABDM sandbox (ABDM for Labs). ABDM uses a federated design: records stay where they were created and are shared with healthcare providers after the patient’s consent (PIB explainer on ABHA).

ABHA linking does not replace your own report delivery. Many patients do not have an ABHA or do not use the app. Treat it as an extra channel: capture ABHA at booking if the patient offers it, and link the report after sign-off if they consent.

8. How long should a lab keep reports, and who can see them?

Keep reports for the period your accreditation, state rules and adviser set, restrict access by role, and log every view and export. Under the DPDP framework, personal data should not be kept longer than needed for its purpose unless a law requires it, so a written retention period matters.

I could not verify a single statutory retention period that applies to every Indian lab, so I will not give you a number. Your accreditation body, state registration and legal adviser decide it. What the system must do is hold that number per report type, keep logs, and limit who sees what. SCC Online’s summary of the DPDP Rules says data logs must be kept for at least one year (SCC Online).

Source: Infoways’ role template for lab systems. Adapt it with your quality manager; it reflects the access-control safeguard in the DPDP Rules as summarised by SCC Online.

9. Where software helps

Software makes the secure route the easy route: the LIS signs off, a notice goes out by itself, the OTP link and expiry are automatic, doctors see only consented reports, and every view is logged. Done by hand, each of those steps depends on a busy front desk remembering.

Many LIS products sold in India already include report links, portals or apps, so test yours before buying anything. Where we usually add value is a delivery layer on top of the LIS under the lab’s own brand: one business number for notices, OTP links with expiry, a patient app with family profiles, doctor logins with consent, amended report handling and ABHA linking where the LIS supports it. Our diagnostic labs page shows how this fits with booking and home collection.

Source: Infoways’ checklist for report delivery evaluations. Confirm each with the vendor in a live demo.

Where this advice breaks down

Some patients will still want the PDF on WhatsApp, and some doctors will ask for reports by email. You can explain why you send a link instead; most accept it once they see the OTP takes ten seconds. For the few who insist, decide a policy with your adviser rather than letting each staff member choose.

Elderly patients without smartphones need a different route: a printed report, or a link sent to a family member they nominate in writing. Security that locks out your oldest patients is not a win.

The DPDP Rules are being phased in until about May 2027, and the WhatsApp policy changes often. I have given the rules as of October 2026. Nothing here is legal advice; your adviser should approve your consent wording, retention and data-sharing terms.

Your report delivery checklist

Get these right and the phone with 400 report chats disappears from your front desk, while patients still get their report within minutes of sign-off.