DPDP for healthcare providers

Emergencies, patients who cannot consent, and records other rules require

Emergency treatment does not wait for consent. The Act allows processing without consent to respond to a medical emergency involving a threat to life or an immediate threat to health (s. 7(f)). Record that this was the basis. Once the patient can decide, ongoing care returns to the normal notice and consent route.

For a child, consent comes from a parent or lawful guardian, and it must be verifiable (s. 9(1)). For an adult with a disability who has a lawful guardian, the guardian consents. The Rules exempt clinical establishments and healthcare professionals from parts of the children’s-data duties, for providing health services only. Use the exemption for care itself, not for marketing or research. Under legal review: The exact scope of the Fourth Schedule exemption for clinical establishments should be confirmed for each use.

Some records carry their own confidentiality duties under other laws, such as the Mental Healthcare Act, 2017 and the HIV and AIDS (Prevention and Control) Act, 2017; the DPDP Act adds to them rather than replacing them. Under legal review: The confidentiality provisions of these Acts and how they sit with the DPDP Act should be confirmed. Other rules decide how long medical records are kept: professional conduct regulations for doctors and, in many states, clinical establishment rules. The Act then expects those records to be protected for that period and erased after it. Under legal review: The record-keeping period that applies to each provider depends on the professional and state rules in force and should be confirmed.

Emergency

Treat first; record the basis (s. 7(f)); move to notice and consent once the patient can decide.

Child or patient with a guardian

Verifiable consent from the parent or lawful guardian, recorded with the registration.

Retention

As long as medical record rules require, then erased.

The three roles, in a worked case

The Act gives three roles. The Data Principal is the person the data is about. The Data Fiduciary decides why and how it is used, and carries the duties. A Data Processor handles it on the fiduciary’s behalf, under a contract. The same business can be a fiduciary for some data and a processor for other data.

The case

Rahul’s father is admitted to a multi-speciality hospital. His blood samples go to an outside laboratory, his scans are read remotely by a teleradiology firm, the hospital runs a cloud-hosted records system, and the bill is settled with an insurer through a third-party administrator (TPA).

When the lab sends a report directly to the patient under its own name, it is usually acting as a fiduciary and owes its own notice.

What a hospital or clinic holds, and where it goes

Where it comes in

Each is a point where consent may be asked for; where it is, a notice must come with it or before it (s. 5).

• Front-desk registration and appointment booking
• Consultation notes and prescriptions
• Sample collection and imaging
• Insurance pre-authorisation and claim forms
• Telemedicine calls and patient apps
• Pharmacy dispensing and home visits

Where it goes

Where hospitals and clinics are most exposed

Severity follows the same rules as the assessment; your own result sets it from your answers. How severity is set.

Who else handles the data

You answer for what your processors do with the data (s. 8(1)), and you need a valid contract with each (s. 8(2)). Some vendors are fiduciaries in their own right; the table says where that is common.

42 controls written for hospitals and clinics, on top of 66 common ones

Alongside the common controls, the healthcare assessment asks about clinical realities: how reports reach patients, individual logins and role-based access, restricted records, emergencies and consent on someone’s behalf, labs and teleradiology, TPAs and insurers, telemedicine, connected devices and imaging systems, downtime procedures, and medical record retention.

Each control is weighted by how critical it is and tied to the section of the Act or rule behind it. How results work.

Six of the questions you will be asked

Questions ask what you actually do, not whether you have a policy. Each answer maps to one control.

1. HC-01 Critical

   Are reports and prescriptions sent to patients through a protected channel, rather than staff members' personal WhatsApp or email?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Only through a portal, expiring link or official account.

   Why it is asked: A report sent to a wrong number or forwarded from a personal phone cannot be recalled. The DPDP Act has no separate category for health data; this applies its general duty in a healthcare setting.

2. HC-02 Critical

   Can each member of staff see only the patient records their role needs?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Access is set by role and reviewed.

   Why it is asked: Most health data misuse is by insiders looking at records they have no reason to see.

3. HC-28 High

   Are especially sensitive records (mental health, HIV status, reproductive health) restricted further than ordinary records?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Further restricted with access alerts.

   Why it is asked: The DPDP Act has no special category, but reasonable safeguards match the harm a leak would cause, and other laws set confidentiality duties for these records.

4. HC-15 Medium

   When you treat in an emergency without consent, do you record that the emergency was the basis, and move ongoing care onto the normal notice and consent route once the patient can decide?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Recorded each time, with the move to consent.

   Why it is asked: Processing to respond to a medical emergency is a legitimate use without consent, but only for the emergency.

5. HC-34 High

   Is patient data shared with insurers and TPAs only for claims the patient has asked for, and limited to what the claim needs?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Only requested claims, minimum data.

   Why it is asked: Sharing for a claim is a specific purpose; sending more than the claim needs goes beyond it.

6. HC-13 Medium

   Before a teleconsultation, are patients told which platform is used, whether the session is recorded, and how records are kept?

   Answers: Yes, Partly, No, Not sure · “Yes” means: Told before every session.

   Why it is asked: A notice must accompany consent; recording a consultation is a use the patient should know about.

All 42 questions written for hospitals and clinics

1. HC-08 Have you agreed in writing, with visiting consultants, outside labs, imaging centres and referral partners, who decides how patient data is used for each service? Organisation and role mapping
2. HC-09 Have you identified every group whose data you hold: patients, attendants and caregivers, next of kin, emergency contacts, staff and visiting doctors? Organisation and role mapping
3. HC-10 Does your registration form collect only what treatment, billing and legal duties need, leaving out details such as religion, caste or full ID numbers unless a law requires them? Data inventory and purpose
4. HC-11 Do you know where old patient data sits: scanned registers, retired software, old PCs, archived images and discs? Data inventory and purpose
5. HC-03 At registration, are patients told what you collect and why, with reminders and health offers asked about separately? Notice and transparency
6. HC-12 Are clinical photographs and case details used for teaching, publications or social media only with the patient's specific consent, and identifying features removed? Consent and lawful basis
7. HC-15 When you treat in an emergency without consent, do you record that the emergency was the basis, and move ongoing care onto the normal notice and consent route once the patient can decide? Consent and lawful basis
8. HC-16 Can patients get a copy of their records and a list of who received them, with identity checked before anything is released? Data Principal rights
9. HC-17 Can patients have their details corrected, with clinical entries amended rather than overwritten, so the original stays visible? Data Principal rights
10. HC-18 Before results, prescriptions or procedures, do staff confirm the patient with two identifiers, and are duplicate records merged? Data quality
11. HC-19 Is data sent to insurers, TPAs and referral partners checked for accuracy, and are corrections passed on? Data quality
12. HC-06 Do you keep patient records for the period medical record-keeping rules require, and then delete them? Retention and deletion
13. HC-20 Are old PCs, phones, USB drives and diagnostic equipment with stored patient data wiped before disposal, return or service? Retention and deletion
14. HC-01 Are reports and prescriptions sent to patients through a protected channel, rather than staff members' personal WhatsApp or email? Security safeguards
15. HC-22 Are patient records encrypted in the hospital or clinic system, its backups, and on laptops and phones that hold patient data? Security safeguards
16. HC-24 Are connected medical devices and imaging systems (PACS, analysers) on a separate network, with default passwords changed and updates applied? Security safeguards
17. HC-31 Do you keep an offline or immutable backup of patient records, and a paper downtime procedure for when systems are locked? Security safeguards
18. HC-02 Can each member of staff see only the patient records their role needs? Access control
19. HC-23 Do shared computers at nursing stations, front desks and labs lock automatically and require each person's own login? Access control
20. HC-26 Do accounts for visiting consultants, locums, students and agency staff expire when their placement ends? Access control
21. HC-27 Is two-step sign-in required for remote access to the records system, imaging viewers and email? Access control
22. HC-28 Are especially sensitive records (mental health, HIV status, reproductive health) restricted further than ordinary records? Access control
23. HC-29 Do you regularly review who opened which patient records, especially those of staff, well-known patients and sensitive cases? Incident testing
24. HC-30 When a report, prescription or record goes to the wrong person, is it logged as an incident and notified to the Board and the patient? Breach response
25. HC-05 Are labs, telemedicine platforms, pharmacies and other partners that receive patient data bound by written data terms? Processors and vendors
26. HC-32 Does your hospital or clinic software contract cover where data is hosted, when the vendor's staff may access it, immediate breach notice, and return of all data at exit? Processors and vendors
27. HC-33 Before a vendor gets access to patient data, do you check its security, hosting location and who can access the data? Processors and vendors
28. HC-34 Is patient data shared with insurers and TPAs only for claims the patient has asked for, and limited to what the claim needs? Data sharing and disclosure
29. HC-35 Do you log each release of patient data outside the facility: to referrers, insurers, other hospitals and authorities? Data sharing and disclosure
30. HC-36 Are requests for patient data from police, courts and health authorities checked by a named person, limited to what is required, and logged? Data sharing and disclosure
31. HC-37 Do you know where your records system, imaging archive, telemedicine platform and backups store data? Transfer and storage location
32. HC-38 Where reports are read abroad (teleradiology) or patient data is processed overseas, have the transfers been checked against any government restriction? Transfer and storage location
33. HC-39 Do you keep signed consent forms and records of releases so you can show what each patient agreed to and what was shared? Records and evidence
34. HC-40 Is there a written policy covering photographing patients or records, discussing patients on messaging groups, and using personal phones for patient data? Policy and training
35. HC-41 Do employees, students, interns and volunteers sign a confidentiality undertaking before they see patient data? Policy and training
36. HC-04 For children and patients who cannot consent for themselves, do you record consent from a parent or lawful guardian, and check the guardian's appointment where one is claimed? Children and guardians
37. HC-42 Where you rely on the exemption for clinical establishments for children's data, have you recorded it, and is children's data used only for health services under it? Children and guardians
38. HC-07 Before linking a patient to a national health ID or sharing records through a health-information exchange, do you take their explicit consent? Consent and lawful basis
39. HC-13 Before a teleconsultation, are patients told which platform is used, whether the session is recorded, and how records are kept? Notice and transparency
40. HC-43 Is your telemedicine platform or patient app secured: encrypted sessions, verified patient identity before records are shown, and no recordings on staff personal devices? Security safeguards
41. HC-44 Is CCTV kept out of consultation, examination and procedure areas, with footage viewable only by named people and overwritten after a set period? Security safeguards
42. HC-45 Do home-visit staff use locked, managed devices for patient data, and avoid keeping patient lists or photos on personal phones? Security safeguards

Evidence that may be asked for

A “yes” is self-declared until something shows it. These are the documents and records that usually do. Your own result lists what each control needs.

• Registration notice and consent wording, with a completed sample
• User list for the hospital or clinic system showing individual logins and roles
• Access log extract for a sample patient record, and the last review of unusual access
• Report delivery method, with a screenshot of the protected link or portal
• Data terms or agreements with labs, teleradiology, telemedicine and software vendors
• Claim-sharing procedure with TPAs, showing what is sent and on whose request
• Retention schedule aligned with medical record-keeping rules
• Breach plan, including how patients are told

What makes evidence good enough · How the Evidence Room keeps it

First actions, in the order they usually make sense

1. Stop sending reports as open attachments; use expiring links or a portal

   Now

2. Give every staff member their own login and remove shared accounts

   Now

3. Restrict mental health, HIV and reproductive health records further

   Before 13 May 2027

4. Add consent for children and guardians to registration

   Before 13 May 2027

5. Sign data terms with labs, teleradiology, telemedicine and software providers

   Before 13 May 2027

6. Set retention periods by record type and a destruction routine

   Before 13 May 2027

7. Train front-desk and nursing staff on what may be shared and how

   Ongoing, yearly

Your own result orders these by your answers and the law’s dates. How to plan remediation.

The reports a hospital or clinic usually needs

In healthcare the result is read by management, by accreditation and quality teams, and by partner insurers and corporate clients who send patients.

Every report states whether the result is Self-Assessed, Evidence-Supported or Expert-Verified. None is a certificate or a statement of compliance. All six reports.