DPDP Impact Study: Hospitals and Healthcare Providers

Executive summary

Hospitals, clinic chains, nursing homes and mental health establishments hold some of the most sensitive personal data in India, and they hold it for years. The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 give health data no special category, but they apply in full to every registration desk, medical record system and billing platform a provider runs.

Overall impact: High. Most of the Act's operative provisions, and Rules 3, 5 to 16, 22 and 23, commence on 13 May 2027.

The three biggest changes:

First, every use of patient data needs a named legal ground. Routine treatment is not one of the Act's "legitimate uses". A hospital must decide, flow by flow, whether it relies on consent, on data the patient volunteers for a stated purpose, or on the emergency and epidemic grounds. The choice decides which rights the patient can later exercise.

Second, breach response becomes a multi-clock exercise. One ransomware incident can trigger the 6-hour CERT-In report, Rule 7 notices to patients and the Data Protection Board, a 72-hour detailed report, and the confidentiality rules of the mental health, HIV and MTP statutes. Failing to take reasonable security safeguards carries a maximum penalty of ₹250 crore.

Third, the hospital answers for its vendor chain. Section 8(1) makes it responsible for its processors "irrespective of any agreement to the contrary".

Trayambic's earlier article on hospitals, diagnostics and IVF clinics sets out record-retention periods and a worked example for a diagnostics chain. This study does not repeat them. It looks at the provider as an institution: its legal grounds, overlapping regulators, breach exposure and chances of designation as a Significant Data Fiduciary.

Background

A multi-specialty hospital collects personal data at every step. Registration captures name, age, address, phone number and often an identity document. Clinical care adds history, diagnoses, prescriptions, results, imaging, nursing notes and discharge summaries. Billing adds insurance and payment data. Many hospitals also link records to a patient's ABHA (Ayushman Bharat Health Account) under the Ayushman Bharat Digital Mission (ABDM).

The people whose data is involved, called data principals in the Act, include patients (among them children and people unable to decide for themselves), relatives and nominated representatives, donors and research participants, visiting consultants and staff, and visitors captured on CCTV.

Data flows outward as much as inward. Reports go to patients by SMS or messaging apps; claims go to insurers and third-party administrators; samples and images go to reference laboratories and remote radiologists; notifiable disease reports go to public health authorities; discharge summaries may be pushed to an ABDM-linked health locker.

Typical vendors include the hospital information system (HIS) and electronic medical record provider, PACS imaging software, laboratory systems, cloud hosts, call centres, transcription services, equipment suppliers with remote access, and marketing agencies. Under the Act, the hospital that decides why and how data is used is the data fiduciary. A vendor processing data on its instructions is a data processor.

Clinic chains and nursing homes have the same data with fewer controls. Mental health establishments have the same data with heavier confidentiality duties.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.4, 6, 7). Processing needs consent or a "legitimate use" in s.7. For providers these are s.7(a) (data voluntarily provided for a specified purpose, where the person has not objected), s.7(f) (medical emergency involving a threat to life or immediate threat to health) and s.7(g) (health services during an epidemic or other public health threat). There is no "legitimate interests" ground.
• Notice (s.5; Rule 3). Notice accompanies consent requests and must itemise data and purposes, with ways to withdraw, exercise rights and complain to the Board.
• Fiduciary duties (s.8). Responsibility for processors (s.8(1), 8(2)); accuracy where data informs a decision (s.8(3)); security safeguards (s.8(5); Rule 6); breach intimation (s.8(6); Rule 7); erasure when the purpose ends unless law requires retention (s.8(7)); a published contact (s.8(9)).
• Children (s.9; Rules 10 to 12). A child is anyone under 18. Verifiable parental consent is required, and tracking, behavioural monitoring and targeted advertising aimed at children are barred. The Fourth Schedule exempts clinical establishments, mental health establishments and healthcare professionals only for providing health services to the child, to the extent necessary to protect the child's health.
• Significant Data Fiduciaries (s.10; Rule 13). A Significant Data Fiduciary (SDF) is one the Centre designates on factors including the volume and sensitivity of data. SDFs need an India-based Data Protection Officer, an independent data auditor, and a Data Protection Impact Assessment (DPIA) and audit every 12 months.
• Rights (ss.11 to 14; Rule 14). Access, correction and erasure run only where the person consented or gave data under s.7(a). Grievances must be answered within 90 days at most.

Sector instruments that apply alongside

Accredited hospitals also work to the NABH Accreditation Standards for Hospitals, 6th edition (effective 1 January 2025), which have an Information Management System chapter. These are voluntary, but DPDP controls should sit inside the same records programme.

How the regimes fit together

Section 38(1) says the DPDP Act applies in addition to other laws; s.38(2) says it prevails in a conflict. True conflicts are rare in healthcare, because the Act defers at the main friction points: s.8(7) allows retention needed "for compliance with any law", s.7(d) covers disclosures to the State required by law, and s.7(e) covers compliance with court orders.

Section 16(2) works in one direction. The Centre may block transfers to notified countries (none are notified), but any Indian law giving higher protection or stricter transfer limits continues to apply.

The confidentiality statutes add something the DPDP Act lacks: they protect specific categories of patient whatever the legal ground. A disclosure that passes the DPDP test, such as a relative's request handled under s.7(a), can still breach the MTP Act or the HIV Act.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Choosing a legal ground for each data flow

The commonest error in hospital privacy programmes is to treat "treatment" as self-justifying. Section 7 is a closed list, and routine care appears in it only through the emergency (s.7(f)) and public-health (s.7(g)) grounds.

For an ordinary admission, the realistic ground is s.7(a): the patient provides data for a stated purpose and has not objected. It has limits:

• The purpose must be specified. "For hospital purposes" specifies nothing.
• It does not stretch to new purposes. Health-check campaigns, sharing with a drug company's patient-support programme or training a commercial AI model need consent of their own.
• The ground decides the rights. Access and correction under ss.11 and 12 apply where the patient consented or gave data under s.7(a). Data processed only under the emergency ground falls outside them, though the patient can still request records under IMC regulation 1.3.2.

The practical output is a register of processing activities, one row per flow: purpose, ground, data items, systems, recipients and retention rule. Rule 3 notices are then drafted from the consent-based rows, not from a template.

Two groups need care. For unconscious adults, the emergency ground covers immediate care; anything further should wait for the patient or someone entitled to act for her. For persons with disability, the Removal of Difficulties Order, 2026 aligns s.9(1) so that a lawful guardian's verifiable consent is required, verified under Rule 11. A nominated representative under the Mental Healthcare Act is not automatically a lawful guardian for DPDP purposes, so mental health establishments should record both roles.

Retention: lifetime records against a duty to erase

Trayambic's article on hospitals, diagnostics and IVF clinics maps statutory retention periods. Two institutional points sit on top of that map.

First, the EHR Standards, 2016 recommend preserving records during the patient's lifetime, and rule 9(iv) of the 2012 Central Rules ties registered establishments to the EHR formats the government determines. A cautious provider should document its basis for long retention and restrict access to older records rather than leave them open to every login.

Second, the exception covers only what law requires. Appointment-reminder lists, call recordings, abandoned enquiries, CCTV footage and campaign databases are not clinical records. They must be deleted once their purpose ends, and processors holding copies must be told to delete too (s.8(7)(b)). Rule 6 sets a floor: security logs and related personal data are kept for at least a year.

Specially protected patients

Mental health, HIV status and pregnancy termination each carry a statutory confidentiality rule. These do not conflict with the DPDP Act; they narrow what a provider may do even where the Act would allow it.

• Mental health. Section 23 of the Mental Healthcare Act gives a right to confidentiality, and s.24(2) applies it to information "stored in electronic or digital format in real or virtual space". Section 25 gives access to basic medical records but lets the professional in charge withhold information whose disclosure would cause serious mental harm or risk harm to others. A DPDP access request should pass through that filter, with reasons recorded.
• HIV. Section 8 of the HIV Act bars disclosing HIV status without informed written consent, subject to exceptions such as sharing between treating providers. Section 11 requires data protection measures for HIV-related records.
• Pregnancy termination. Section 5A of the MTP Act bars a practitioner from revealing the name and particulars of a woman whose pregnancy was terminated, except to a person authorised by law. Billing and insurance desks see these records too, so access controls must reach beyond clinicians.

If a general HIS shows every diagnosis to every user, these duties are hard to meet whatever the DPDP programme says.

Worked example: a ransomware night at a hospital group

A mid-size group runs three hospitals in a state capital, including a 30-bed psychiatric unit, and is an ABDM health information provider. At 11 pm on a Saturday, IT finds the HIS and PACS servers encrypted, with a note claiming patient files were copied.

The incident plan runs five tracks in parallel:

1. 1.CERT-In. Report within 6 hours of noticing the incident; preserve the 180 days of logs kept in India.
2. 2.DPDP Rule 7. From May 2027, inform the Board without delay and file a detailed report within 72 hours: facts, causes, mitigation, who caused it if known, remedial steps and the patient notices sent. Until then, s.43A of the IT Act governs liability.
3. 3.Patient notices. Each affected patient is told what happened, the likely consequences, what the group is doing and what the patient can do. Psychiatric patients hear through their treating team, because a generic SMS could itself reveal that they are psychiatric patients.
4. 4.ABDM. The group notifies the mission under clause 33 of the Health Data Management Policy.
5. 5.Special statutes. HIV and MTP records are identified separately, and nothing about any patient goes to the media, consistent with s.24 of the Mental Healthcare Act.

The drill exposes three weaknesses: the HIS vendor's contract has no incident-notice clause, the backup server shares credentials with production, and nobody can quickly list which patients were in the stolen files. The last is the costliest. Without a data inventory, Rule 7 notices go to everyone, or to the wrong people.

Could a hospital chain become an SDF?

No entity has been designated an SDF, and s.10 itself commences only on 13 May 2027. Its factors include the volume and sensitivity of data and the risk to data principals. A national chain holding records of millions of patients, including mental health and HIV data, fits them better than most consumer businesses.

Designation would add an India-based DPO reporting to the board, an independent data auditor, an annual DPIA and audit reported to the Board, due diligence on algorithmic software such as radiology AI, and possible limits on transferring specified data abroad. Building that capability voluntarily costs less than building it under a designation deadline.

Compliance framework

Phased roadmap to 13 May 2027

• Now to December 2026: map data flows and grounds; inventory vendors; appoint a privacy lead; run a breach tabletop exercise using the existing CERT-In process.
• January to March 2027: redesign forms and notices; segregate sensitive records; sign vendor addenda with the highest-risk processors; train front-office and billing staff.
• April to May 2027: finish security uplift; switch on the deletion schedule for non-clinical data; publish the grievance process; brief the board.
• Ongoing: annual DPIA for large chains; quarterly access reviews; refresh as the Board issues guidance and as states update clinical establishment rules.

Recommendations

1. 1.Treat the register of processing activities as the foundation. Every notice, consent, retention rule and breach notice depends on knowing which ground covers which flow.
2. 2.Stop using one consent form for everything. Keep treatment on its own footing and make marketing, research and data-sharing programmes separately optional.
3. 3.Build access controls around the special statutes. Mental health, HIV and MTP records need narrower access than general clinical records.
4. 4.Rewrite vendor contracts before renewal, starting with the HIS, PACS, laboratory and messaging providers, and require incident notice within hours.
5. 5.Rehearse a breach that runs all clocks at once, including notices that do not themselves reveal a sensitive diagnosis.
6. 6.Document the legal basis for long retention of clinical records, and delete everything that lacks one.
7. 7.If you run a large chain, prepare as if designated: a DPIA, a data audit and due diligence on clinical AI tools.

Key takeaways

• Routine treatment is not a legitimate use under s.7; hospitals must record whether each data flow rests on s.7(a), the emergency or epidemic grounds, or consent, and that choice decides which rights apply.
• A single ransomware incident can engage CERT-In's 6-hour report, Rule 7 notices to patients and the Board, ABDM notice and the confidentiality rules of the MHA, HIV Act and MTP Act.
• Clinical records can usually be kept under health law, but call recordings, campaign lists, CCTV and enquiries must be deleted once their purpose ends.
• Mental health, HIV and pregnancy-termination records need narrower access than general records because their own statutes restrict disclosure.
• Large hospital chains fit the SDF factors well and should pilot an annual DPIA and data audit before any designation.