Data Privacy | DPDP for Healthcare
DPDP Act Compliance for Hospitals and Healthcare Providers in India
Hospitals have always held sensitive information, but the way they hold it has changed completely. Patient records sit in hospital information systems rather than file rooms, diagnostic reports reach patients by WhatsApp and email, appointment data flows through booking platforms, and insurance claims move electronically between providers, third party administrators and insurers. The Digital Personal Data Protection Act applies to all of it, and for Indian healthcare providers DPDP compliance has become a board level obligation rather than an IT housekeeping task.
This guide explains what the Act asks of hospitals, diagnostic chains, clinics and health technology companies, where healthcare differs from other sectors, and how to build a programme that holds up in practice.
Table of Contents
- What the Act Requires, in Hospital Terms
- Why Healthcare Is Harder Than Most Sectors
- How DPDP Sits Alongside the Other Rules Hospitals Follow
- Building the Programme
- Where Hospitals Usually Find Gaps
- A Practical First Ninety Days
- How Univate Supports Healthcare Organisations
- Final Thoughts
- Frequently Asked Questions
What the Act Requires, in Hospital Terms
The DPDP Act governs the processing of digital personal data. A hospital that determines why and how patient data is processed is a Data Fiduciary, the patient is a Data Principal, and vendors processing data on the hospital's instructions are Data Processors. Our explainer on data fiduciary and data principal roles sets out where each responsibility sits, and our general DPDP guide covers the wider obligations.
The core duties translate directly into hospital operations. You must have a lawful basis for processing, give clear notice to patients about what you collect and why, obtain consent where consent is the basis you rely on, honour patient rights to access, correction and erasure, limit retention to what is necessary, apply reasonable security safeguards, and report personal data breaches. Organisations designated as Significant Data Fiduciaries carry additional duties including a Data Protection Officer based in India, independent audits and impact assessments. Our note on penalties explains the financial exposure attached to failures.
Why Healthcare Is Harder Than Most Sectors
Four features of hospital operations make this work more demanding than a typical corporate rollout.
Consent is complicated by clinical reality. A patient arriving unconscious in emergency cannot give consent, and treatment cannot wait. The Act recognises certain legitimate uses, including medical emergencies and the provision of treatment during an epidemic or threat to public health, which is why hospitals need their legal bases mapped per processing activity rather than relying on a single consent form at admission.
Children's data is routine in healthcare. Paediatric departments, vaccination records and school health programmes all involve data about minors, where the Act requires verifiable parental consent and restricts tracking and targeted advertising. Hospitals need a workable way to establish and record that consent at registration.
The data flows outward constantly. Diagnostic samples go to reference laboratories, images go to teleradiology providers, claims go to third party administrators and insurers, prescriptions go to pharmacies, and increasingly appointment and engagement data flows through marketing platforms. Each recipient is a processor or a separate fiduciary, and each relationship needs a contract that reflects it.
Legacy systems are everywhere. Many Indian hospitals run a hospital information system installed years ago, alongside departmental systems for radiology, laboratory and pharmacy that were never designed to support deletion requests, consent records or access logs. Retrofitting rights handling onto that estate is usually the longest line in the plan.
How DPDP Sits Alongside the Other Rules Hospitals Follow
| Framework | Applies when | Main focus | Status in India |
|---|---|---|---|
| DPDP Act | You process digital personal data of individuals in India | Lawful processing, notice, consent, rights, breach reporting | Statutory obligation |
| DISHA proposals | Discussed for digital health data governance | Health record ownership and exchange | Not an operative statute; informative only |
| HIPAA | You process protected health information for United States entities | Safeguards, business associate agreements, breach rules | Contractual via client obligations |
| ISO 27001 | Voluntary, usually client or board driven | Information security management system | Certification |
| ISO 27701 | Voluntary extension of ISO 27001 | Privacy information management | Certification |
Two clarifications matter here. DISHA was a proposed framework for digital health data and has informed thinking in the sector, but hospitals should plan against the DPDP Act as the operative law. And HIPAA becomes relevant only where you process data for American healthcare entities, which affects medical transcription, billing and teleradiology providers more than domestic hospitals. Our guide to HIPAA for Indian companies explains when it applies.
Building the Programme
Start with a data inventory. Map every system, department and vendor that touches patient data, from the hospital information system and laboratory information system to the WhatsApp number the front desk uses for reports. Most hospitals discover flows nobody had documented, which is precisely the point of the exercise.
Determine your lawful basis for each processing activity, separating treatment, billing, insurance, research, marketing and employee data rather than treating them as one. Rewrite patient notices in plain language, and in the languages your patients actually read, then rebuild the consent capture at registration so it is specific and recorded rather than buried in an admission form.
Put processor agreements in place with laboratories, teleradiology partners, third party administrators, software vendors and marketing agencies. Stand up a rights handling process with real timelines, so a patient asking what you hold receives an answer rather than a transfer to another desk. Build a breach response plan that can move quickly, because notification duties leave no room for a week of internal discussion.
Then address security, which is where most of the engineering effort lands. Role based access so a billing clerk cannot browse clinical notes, logging so access to records is traceable, encryption, retention schedules that actually delete, and tested backups. Many hospitals formalise this through ISO 27001 and extend it with ISO 27701 privacy management, since both map closely to DPDP duties. Regular testing provides the evidence that controls work.
Where Hospitals Usually Find Gaps
Certain weaknesses surface in almost every healthcare privacy assessment. Shared logins at nursing stations and reception counters top the list, because a single account used by whoever is on shift makes it impossible to show who accessed a record. Access breadth comes next: many hospital systems were configured so that any clinical login can open any patient's file, which is convenient in an emergency and indefensible the rest of the time.
Reports sent over consumer messaging apps are a widespread practice that few hospitals have formally assessed. So are discharge summaries and investigation reports left on shared drives with no retention schedule. Marketing is another recurring finding, where appointment and diagnosis data gets used for campaign targeting without a lawful basis that would survive examination.
Finally, vendor sprawl. Between the hospital information system, laboratory and radiology systems, billing software, queue management, feedback tools and booking platforms, a mid sized hospital may have twenty vendors touching patient data, often without current contracts. Mapping that estate is unglamorous work and it is where most of the real risk sits.
A Practical First Ninety Days
- Appoint an accountable owner and confirm whether you are likely to be a Significant Data Fiduciary
- Complete the data inventory across clinical, administrative, insurance and marketing systems
- Map a lawful basis to each processing activity, including emergency and child scenarios
- Rewrite patient notices and rebuild consent capture at registration and online booking
- Issue or update processor agreements with laboratories, teleradiology, administrators and vendors
- Establish rights request and breach response procedures with named owners and timelines
- Close the highest risk security gaps first, starting with access control and record logging
How Univate Supports Healthcare Organisations
Univate works with hospitals, diagnostic chains, clinics and health technology companies on exactly this programme. Our DPDP practice runs the data inventory, maps lawful bases, drafts notices and agreements, builds rights and breach procedures and prepares you for audit scrutiny, within a wider data privacy function that also covers classification of sensitive records. Providers serving international patients or partners often need to understand GDPR alongside DPDP, and our GRC team sequences the security and privacy work so one control set serves both. Our cost guide sets out what shapes the budget.
Final Thoughts
Patients hand over information at their most vulnerable, usually without reading anything, and the trust that makes healthcare work rests on what happens to it afterwards. The DPDP Act turns that expectation into a legal duty with real consequences. Hospitals that approach it as a data governance programme rather than a document exercise end up with cleaner records, clearer vendor relationships and far less exposure, and they are ready when a patient, an insurer or a regulator finally asks the question.
Frequently Asked Questions
Does the DPDP Act apply to hospitals?
Yes. Any organisation processing digital personal data of individuals in India falls within scope, and hospitals process some of the most sensitive personal data there is. The hospital is a Data Fiduciary and the patient is a Data Principal.
Can we treat a patient who cannot give consent?
Yes. The Act provides for certain legitimate uses including medical emergencies where the patient is incapable of giving consent. The practical requirement is to map lawful bases per processing activity in advance rather than relying on consent alone.
What about data of children treated at our hospital?
Processing children's data requires verifiable parental or guardian consent, with restrictions on tracking and targeted advertising. Hospitals need a workable way to establish and record that consent at registration and in online booking.
Are our laboratory and teleradiology partners our responsibility?
Where they process data on your instructions they are Data Processors, and you remain accountable for that processing. Each relationship needs a contract that reflects the obligations, and you should know exactly which vendors hold patient data.
Does DISHA still apply to health records?
DISHA was a proposed framework for digital health data governance rather than an operative statute. Plan your compliance programme against the DPDP Act, which is the law that applies to patient data today.
Do we need HIPAA compliance as well?
Only if you process protected health information for United States healthcare entities, which typically affects medical billing, transcription and teleradiology providers. Domestic Indian hospitals generally do not, though their obligations under DPDP remain.
Does ISO 27001 make us DPDP compliant?
No, but it covers a substantial part of the security safeguards the Act expects and produces the evidence to demonstrate them. Privacy specific duties such as notice, consent, rights handling and breach reporting still need to be addressed directly.
What happens if patient data is breached?
The Act requires notification of personal data breaches, and failures can attract significant financial penalties. The practical requirement is a tested response plan with named owners, since notification timelines leave no room for extended internal deliberation.
