Picture a normal morning at a mid-sized hospital. The front desk is registering patients, the lab is uploading reports, the pharmacy is checking prescriptions, and someone in billing is sending a claim to an insurer. Every one of those steps touches personal data, and much of it is the kind people would least like to see leaked.
That is why the Digital Personal Data Protection / DPDP Act 2023 matters so much to healthcare. It is not only a rulebook for big tech. If you keep digital records about patients, it applies to you, and the way you handle those records will shape how much patients trust you.
Why the stakes are higher here
A health record is not like a shopping profile. It can describe a diagnosis, a mental health history, a pregnancy, a biometric scan or an insurance dispute. A large hospital may hold millions of such records, spread across departments that rarely talk to each other. One careless disclosure, one weak password or one cyberattack can hurt a patient directly, and the provider then faces legal, financial and reputational fallout.
Does it apply to you?
Almost certainly, if you process digital personal data. Multi-specialty and government hospitals, small clinics, diagnostic and imaging labs, IVF and mental health centres, telemedicine providers, online pharmacies, HealthTech start-ups, EMR vendors, insurance administrators and wellness apps all fall in. A two-doctor clinic that keeps patient records on a computer is covered just as a large chain is. Size does not buy an exemption.
What counts as patient data
It helps to sort what you hold into six buckets:
Identity: name, phone, email, address, Aadhaar or passport details
Medical: diagnoses, prescriptions, test reports, surgery notes, scans
Financial: insurance claims, payments, bills
Biometric: fingerprints, face recognition, retina scans
Device data: readings from fitness trackers, remote monitors and smart equipment
Digital health records: EMRs, EHRs, appointment logs, teleconsultation records
Most organisations find they hold more of this than they thought, often in places nobody has looked at in years.
Who is who under the Act
The DPDP Act hands out a few labels, and it pays to know which one you wear.
The patient is the Data Principal, the person the data is about. The hospital, clinic or health app that decides why and how that data is used is the Data Fiduciary. That is where most of the legal weight sits. A lab, a cloud host, a billing software vendor or an SMS provider that handles data on your behalf is a Data Processor. And a Consent Manager is a registered intermediary that lets a person give, review and withdraw consent across several organisations from one place.
The key point for providers is that outsourcing does not outsource responsibility. If your diagnostic partner mishandles a report that you sent them, the Act still looks to you as the fiduciary. That is why contracts, audits and vendor checks are not paperwork for its own sake. They are your evidence that you took care.
There is one more label that large providers should keep an eye on: the Significant Data Fiduciary. The Government can designate organisations in this category based on factors such as the volume and sensitivity of the data they handle and the risk to individuals. A big hospital network that holds millions of health records is a natural candidate. Those who are designated take on extra duties, including appointing a Data Protection Officer based in India, engaging an independent data auditor and carrying out periodic impact assessments. Even if you are not designated today, it is wise to ask whether you could be, and to build habits that would let you cope if you were.
And remember that one organisation can wear several hats. A telemedicine platform is a fiduciary for its own patients and may also be a processor for a hospital that uses its video tool. Mapping those roles early saves arguments later.
What you need to get right
Consent and notice. Before you process data, tell patients what you collect, why, who gets it, how long you keep it and how to withdraw. Consent should be free, informed, specific and unconditional, unless another lawful basis applies.
Collect less. Take what care actually needs. A phone number and medical history make sense; unrelated marketing details do not.
Lock the records down. Encryption, role-based access, multi-factor authentication, audit logs, secure APIs, backups and a tested recovery plan are the basics. Security is one of the biggest parts of compliance, not an afterthought.
Say it plainly. Publish a privacy notice that covers purposes, patient rights, who to contact and how to complain.
Honour patient rights. Patients can ask how their data is used, get access, correct mistakes, request erasure where it applies, withdraw consent, raise grievances and nominate someone to act for them. Someone on your team should own that process, with a written way to verify and answer each request.
What about emergencies?
When a patient arrives unconscious, nobody should be waiting for a consent form. The Act recognises legitimate uses, including processing needed to protect life or health in an emergency. Once the crisis is over, ordinary privacy duties apply again to anything that follows.
Your vendors are part of the picture
Patient data does not stay inside your walls. It moves to diagnostic labs, cloud hosts, payment gateways, insurers, telemedicine platforms, EMR vendors, SMS tools, WhatsApp integrations and booking systems. You stay responsible for how it is shared, so check how each vendor protects data and put safeguards into the contract.
Consent in the real life of a hospital
Consent sounds simple until you map it onto a hospital's day. A patient might give details at registration, agree to a teleconsultation, join a free health camp, sign up for appointment reminders and later be asked to take part in a research study. Each of these is a different purpose, and a single signature at admission cannot sensibly cover all of them.
The clearest way to think about it is by purpose. Data needed to treat the patient and to bill for that treatment is one thing. Reminders about a follow-up visit are another. Promotional messages about a new wellness package are a third, and they should never be a condition of getting care. If a patient says no to marketing, treatment must carry on as normal.
Good practice looks like this:
Ask for each purpose separately, in language a patient can follow without a lawyer.
Offer the notice in a language the patient actually speaks. The Rules allow English or any of the languages listed in the Eighth Schedule to the Constitution.
Record who agreed, to what, when, through which channel and under which version of the notice.
Make withdrawal as easy as giving consent. If a patient agreed at the front desk, they should not need to write a formal letter to take it back.
When a patient withdraws, make sure the message travels to every system that holds the data, including your marketing tools and processors.
Withdrawal does not erase the past. Treatment already delivered stays lawful, and you may keep records you are required by other laws to keep. What changes is that you stop using the data for the purpose the patient has withdrawn from.
Children, guardians and vulnerable patients
Paediatric wards, maternity units and elderly care all raise questions about who is allowed to say yes. For anyone under 18, the Act requires verifiable consent from a parent or lawful guardian. The same applies to a person with a disability who has a lawful guardian. The Act also prohibits processing that is likely to harm a child, as well as tracking, behavioural monitoring and targeted advertising aimed at children.
For a hospital, this means thinking about the flow of a typical visit. Who accompanies the child? How do you check that the adult is really the parent or guardian? Where do you store that check? The Rules deal with these questions and also carve out limited situations, including some involving clinical care, where certain obligations are relaxed. Those details are worth reading closely, because relying on an exemption you have misunderstood is worse than not claiming one.
HealthTech products need extra care. A children's health app, a school screening tool or a wellness platform for teenagers should build age checks and guardian consent into the design from the start, not bolt them on later.
Security safeguards and breach response
The Act expects fiduciaries to take reasonable security safeguards to prevent personal data breaches, and failing to do so is one of the most heavily penalised lapses. In healthcare, "reasonable" has a high bar because the data is so sensitive.
Start with the basics that auditors always ask about. Encrypt data when it moves and when it sits in storage. Give each person only the access their job needs, and review that access when roles change. Use multi-factor authentication for administrators and anyone who can reach full records. Keep logs of who viewed or changed what, and look at them. Back up regularly and test whether you can actually restore. Patch software, retire systems that no longer get security updates, and put equipment such as connected monitors on the same watchlist as laptops.
Then plan for the day something goes wrong, because eventually something will. The Act requires a fiduciary to inform the Data Protection Board and each affected person when a personal data breach occurs, and the Rules set out what that notice must contain and the timelines to follow. A hospital that has never rehearsed this will lose precious hours working out who decides, who calls the lawyer, who talks to patients and who tells the regulator. Write the plan, name the people, run a drill, and keep notes on what you learn.
Keeping data, and letting it go
Healthcare has an unusual tension. Medical records are valuable for continuity of care, and several other laws and professional standards require you to keep them for set periods. At the same time, the DPDP Act expects you to stop retaining personal data once its purpose has been served, unless a law requires you to keep it.
The way through is to decide, category by category, how long each kind of record is needed and why. A discharge summary, an appointment log, a marketing list and a CCTV recording at the entrance do not need the same treatment. Write the periods down, link each to the law or purpose behind it, and set up a routine for deleting or anonymising what has passed its date. When a patient asks you to erase their data, you will then be able to say clearly what can go, what must stay and for how long, instead of improvising.
Small clinic or large hospital: same law, different shape
A two-doctor clinic and a multi-city hospital group both come under the Act, but their journeys look very different.
For a small clinic, the priorities are practical. Know exactly where patient data lives, whether that is a billing app, a spreadsheet, a messaging group or a diary. Use strong passwords and two-step login. Put up a short, honest privacy notice. Keep a simple record of consent. Choose software vendors who can explain how they protect data. Decide who in the clinic answers patient requests. None of this needs a big budget, but it does need someone to own it.
For a large group, the challenge is coordination. Dozens of departments, many facilities and a long list of vendors mean that the same patient's data may sit in a dozen places. Here, a central privacy function, a maintained data inventory, standard contract terms, regular audits and proper tooling become essential. Large providers also have to think about whether they might be designated Significant Data Fiduciaries, as discussed above.
Whichever you are, the underlying habits are the same: know your data, ask for consent properly, protect it, and be ready to explain what you did.
What happens if things go wrong
The Act backs its rules with penalties set out in a Schedule. The highest amounts, reaching up to ₹250 crore, apply to serious failures such as not taking reasonable security safeguards to prevent a breach. Other failures, such as not notifying a breach or breaching duties around children's data, attract their own penalties. Cases are handled by the Data Protection Board of India.
For hospitals, the cost of a lapse is rarely just the fine. A leaked record can break a patient's trust in a way that is hard to repair, and word travels fast in communities where people rely on a few local providers. Treating penalties as the last line of defence, not the reason to comply, is a healthier way to look at it.
Building a culture, not just a checklist
Policies on paper protect nobody if the people doing the work do not follow them. In a hospital, the riskiest moments are often small and human: a printout left at a nursing station, a lab report forwarded on a personal messaging app, a password shared to save time during a busy shift, a conversation about a patient in a corridor.
Training should be short, regular and tied to real tasks. Show the receptionist what a valid consent request looks like. Show the nurse what to do when a patient's relative asks for a report. Show the technician why a personal phone is not a safe place for scans. Give people an easy way to report a mistake, and make it safe to do so, because a hospital that hears about small slips quickly is far better placed than one that learns about them from a regulator.
It also helps to make privacy someone's job. That might be a Data Protection Officer in a large organisation or a named person in a small clinic. What matters is that questions have an owner.
Where the real difficulty lies
The law is rarely the hardest part. Legacy hospital systems often have no audit trail or consent tracking. Paper and digital records live side by side. Reception, lab, pharmacy, ICU, billing and radiology each handle data their own way. And every doctor, nurse, technician and administrator needs to know what good practice looks like.
A sensible order of work
List the personal data you collect and where it lives.
Map how it flows between departments and vendors.
Review how consent is asked for and recorded.
Update your privacy notices.
Restrict access by role and encrypt sensitive data.
Review vendor agreements.
Train your staff.
Write an incident response plan and rehearse it.
Consent management platforms, data discovery tools and request portals can take on much of the repetitive work.
Mistakes worth avoiding
The common ones: assuming consent for treatment covers every other use of the data, collecting more than you need, not documenting consent, sharing records without safeguards, ignoring vendor risk, running outdated software and treating privacy as purely an IT job.
Closing thought
Privacy and good care go together. Patients who trust you with their information are more likely to share what you need to treat them well. Start early, build privacy into each step of the patient journey, and the compliance work becomes part of how you run the place.
