Healthcare organisations handle some of the most private information about individuals. Patient names, diagnoses, medical histories, prescriptions, laboratory reports, scans, insurance details, genetic information, contact details and payment records can all form part of a modern healthcare data environment. For hospitals and healthcare companies, data protection for healthcare is therefore not limited to publishing a privacy policy. It involves lawful data collection, appropriate access, secure storage, controlled sharing, retention, patient rights and effective incident response.

India's privacy framework is also evolving. The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 create an important statutory framework, while healthcare organisations must also consider medical confidentiality requirements, the Information Technology Act framework during the transition period, ABDM requirements and sector specific rules.

Why Healthcare Data Requires Strong Protection?

Healthcare data can reveal highly personal facts about an individual. A medical record may disclose a diagnosis, disability, pregnancy, mental health condition, reproductive health information or long term treatment history. Unauthorised disclosure can create financial, professional, social and personal consequences.The risk is not limited to hacking. Healthcare data may be exposed through an incorrectly configured hospital information system, excessive employee access, insecure email communication, lost devices, third party vendors, unauthorised downloads, weak passwords or inappropriate sharing between departments. Healthcare organisations also operate complex data ecosystems. A hospital may share information with laboratories, pharmacies, insurers, billing providers, cloud service providers, telemedicine platforms and technology vendors. Each additional connection creates another point requiring governance.

India's Healthcare Data Protection Framework

India does not have one single law dealing with every aspect of healthcare data. Instead, healthcare organisations operate within a combination of privacy, information technology, medical ethics and sector specific requirements. The Digital Personal Data Protection Act, 2023 is the central modern framework for digital personal data. It applies to processing of digital personal data within India and, in specified circumstances, processing outside India connected with offering goods or services to individuals in India.

The Act uses the concepts of Data Principal, Data Fiduciary and Data Processor. A hospital or healthcare company will often be a Data Fiduciary because it determines why and how patient information is processed. A cloud provider, software company or outsourced service provider may act as a Data Processor where it processes personal data on behalf of the healthcare organisation. The official Digital Personal Data Protection Act, 2023 on India Code should be treated as a primary legal reference when reviewing the statutory framework.

An Important Point About Health Data Under the DPDP Act

A common misconception is that the DPDP Act creates a separate statutory category called sensitive personal data for health information. It does not. The DPDP Act adopts a broader concept of personal data rather than reproducing the older SPDI category. This does not mean healthcare information should be treated casually. Health information can create substantial risks for individuals, so hospitals should apply security, access and governance controls proportionate to the nature and potential impact of the processing.

During the transition period, the position is more nuanced because Section 43A of the Information Technology Act and the associated SPDI Rules have not yet been displaced. Healthcare organisations should therefore avoid assuming the older framework has simply disappeared. A proper compliance review should consider which requirements currently apply and which future DPDP obligations are being prepared for.

Consent Is Important, But It Is Not the Only Legal Basis

Healthcare organisations often assume every activity involving patient information requires a fresh consent form. The DPDP framework is more nuanced. The Act provides for consent as one basis for processing. It also recognises certain legitimate uses. These include specific circumstances connected with medical emergencies and provision of healthcare services in situations contemplated by the legislation. This distinction is particularly important in clinical settings. A hospital should not design its entire patient care process around repeated consent requests where another lawful basis applies. At the same time, consent becomes important for activities such as optional data sharing or certain secondary uses where consent is the applicable basis. Consent should be specific, informed and capable of being withdrawn where the law permits withdrawal. Healthcare organisations should also distinguish treatment related processing from marketing. Using information collected during treatment to create promotional campaigns or targeted communications requires a separate legal and governance analysis.

Privacy Notices for Hospitals and Healthcare Companies

A privacy notice should explain how patient information is handled in language a patient can understand. A healthcare privacy notice should normally address the types of information collected, purposes of processing, relevant third parties, retention practices, rights, complaint mechanisms and contact details. The notice should reflect actual operations. A hospital should not state it only collects information required for treatment if its systems also process information for billing, insurance claims, appointment management, analytics, patient communications or research.

The DPDP Rules, 2025 introduce more detailed requirements around notices. These requirements form part of the later implementation phase, giving organisations time to redesign their notices and consent architecture. The Ministry of Electronics and Information Technology's DPDP Rules 2025 resources provide the official reference point for the notified Rules and implementation material.

Patient Rights and Medical Records

Data protection becomes particularly challenging when patient rights intersect with medical record retention requirements. The DPDP Act provides rights relating to correction, completion, updating and erasure in specified circumstances. Erasure is not an absolute requirement to destroy every record immediately. Retention may still be necessary where required by law or for a specified lawful purpose.

Healthcare organisations therefore need a documented retention schedule. It should distinguish clinical records from administrative information, billing records, insurance documents, research information, system logs and marketing records. The NMC's medical ethics framework also addresses maintenance and access to medical records. Hospitals should therefore reconcile privacy rights with professional and legal obligations relating to clinical documentation. This is an area where a simple “delete everything when requested” policy can create serious operational problems.

Security Controls for Patient Information

Healthcare organisations should adopt security controls based on the sensitivity and risk associated with their information systems. Access should follow a need to know principle. Doctors, nurses, technicians, billing teams, administrators and external vendors should not automatically receive access to the same information. Hospitals should consider encryption, access controls, authentication, privileged access management, audit logs, monitoring, backups, endpoint security and secure disposal. Systems should also record meaningful access events so organisations can investigate inappropriate viewing or disclosure of patient records. 

The DPDP Rules, 2025 specify security safeguards including encryption or similar protections, access controls, monitoring and logs, backups, contractual safeguards for processors and appropriate technical and organisational measures. These detailed requirements are part of the later commencement phase. Security should not be treated as an IT responsibility alone. Clinical leadership, compliance, legal, information security, procurement and senior management all have a role.

Healthcare Vendors and Data Processors

Modern hospitals rarely operate their entire technology environment internally. Electronic medical record platforms, laboratory systems, radiology platforms, cloud infrastructure, appointment software, payment providers, telemedicine tools and analytics platforms may all process patient information. This makes vendor governance essential. Contracts should clearly establish the permitted processing activities, security expectations, confidentiality obligations, incident notification, subcontracting, access controls, retention, deletion and assistance with patient rights.

A healthcare company should also maintain visibility over where vendors store information and which subcontractors may receive access. This is where data protection compliance for healthcare becomes an operational discipline rather than a document exercise. Procurement teams should involve privacy and legal teams before onboarding vendors capable of accessing patient information.

ABDM and Digital Health Data Governance

The Ayushman Bharat Digital Mission has introduced an important additional layer to India's digital health ecosystem. The ABDM Health Data Management Policy focuses on principles such as security and privacy by design, consent, interoperability and protection of personal health information. It covers participants in the digital health ecosystem, including health facilities, healthcare professionals, health information providers and health information users.

The official ABDM Health Data Management Policy is therefore particularly relevant to organisations participating in the ABDM ecosystem. Healthcare organisations should identify whether they participate in ABDM enabled systems and then assess the specific technical, contractual and governance requirements applicable to their role.

Telemedicine and Digital Healthcare Services

Telemedicine creates additional privacy considerations because healthcare information may move through websites, mobile applications, video platforms, messaging systems and cloud infrastructure. Patient identity verification, secure communication, recording practices, access control and storage should be addressed before a telemedicine service is launched. Healthcare companies should also consider whether consultation recordings are necessary. If recordings are made, the organisation should identify the purpose, retention period, access permissions and applicable legal basis. The same principle applies to patient communication through messaging applications. Convenience should not replace appropriate confidentiality and security controls.

Clinical Research and Secondary Use of Patient Data

Research creates another major compliance challenge. A hospital may wish to use clinical records for medical research, analytics, artificial intelligence development or population health studies. The legal analysis can change when information collected for patient care is later used for another purpose. Healthcare organisations should identify the purpose of secondary processing, determine the applicable legal basis, evaluate whether identifiable information is necessary and consider anonymisation or other privacy preserving measures where appropriate. 

Research governance should also consider ethics committee requirements, clinical trial rules and contractual restrictions. A useful distinction is between genuinely anonymised information and information which has merely had obvious identifiers removed. If an individual can still reasonably be identified using available information, the organisation should not automatically assume the information is outside the personal data framework.

Children and Healthcare Data

Children's information requires particular care. Hospitals, paediatric clinics, mental health providers and digital health platforms may process information belonging to minors. The DPDP Act contains additional obligations concerning children's personal data. Healthcare organisations should establish procedures for identifying the appropriate person responsible for consent and verification where required. At the same time, emergency treatment and other lawful healthcare situations must be considered within the broader statutory framework. The organisation's policy should therefore distinguish routine administrative processing from urgent clinical situations.

Data Breach Response in Healthcare

A healthcare data breach can involve more than stolen passwords. It may include unauthorised access to electronic medical records, disclosure of test reports, ransomware, compromised cloud accounts, lost devices or accidental disclosure through email.Healthcare organisations should maintain a documented incident response plan before a breach occurs. The plan should identify who investigates the incident, who decides whether regulatory reporting is required, who communicates with affected individuals, how evidence is preserved and how clinical operations continue during system disruption.

The DPDP Rules provide for notification to affected Data Principals without delay and detailed notification to the Data Protection Board within 72 hours in the circumstances specified by Rule 7. However, these detailed DPDP Rules belong to the later commencement phase. Healthcare organisations must also consider the separate CERT In cyber incident reporting framework. Specified cyber incidents can trigger a six hour reporting requirement, meaning a healthcare organisation cannot build its incident response plan around a single future DPDP deadline.

Cross Border Transfers of Healthcare Information

Healthcare companies increasingly use international cloud providers, global technology platforms, overseas research partners and multinational insurance or pharmaceutical systems. Cross border transfers therefore require careful assessment. Section 16 of the DPDP Act provides a framework under which the Central Government may restrict transfers to specified countries or territories. Other Indian laws and sector specific requirements can also affect international transfers. Before transferring patient information overseas, organisations should map the data flow, identify the recipient, establish the purpose, review contractual protections and assess applicable Indian and foreign laws.

Significant Data Fiduciary Considerations

The DPDP Act allows the Central Government to designate certain organisations or classes of organisations as Significant Data Fiduciaries based on factors including the volume and sensitivity of personal data processed and risks to Data Principals. Large healthcare organisations may therefore need to monitor developments around Significant Data Fiduciary classification rather than assuming their size alone determines their status. Where an organisation is designated, additional requirements include a Data Protection Officer based in India, an independent data auditor, periodic Data Protection Impact Assessments and periodic audits. Healthcare groups should therefore consider these requirements when designing their governance framework.

How Hospitals Can Prepare for DPDP Compliance?

Preparation should begin with a complete data inventory. The organisation should identify what patient information it collects, why it collects it, where it is stored, who can access it, which vendors receive it and when it is deleted. The next stage is to review privacy notices and consent journeys. Paper admission forms, websites, mobile applications and telemedicine platforms should not provide contradictory information.

Hospitals should then review contracts with technology providers and other processors. Security requirements should be measurable rather than limited to generic confidentiality clauses. Access permissions should also be reviewed regularly. Former employees, temporary staff, contractors and external consultants should not retain unnecessary access to patient systems. Finally, organisations should conduct incident response exercises. A breach involving a hospital's patient database can affect clinical operations as well as privacy compliance. The response plan should therefore involve both technology and healthcare leadership.

Why Legal and Compliance Governance Matters?

Healthcare privacy is ultimately a governance issue. Technology teams can implement encryption and access controls. Clinical teams understand patient confidentiality and treatment requirements. Compliance teams can monitor regulatory obligations. Procurement teams can manage vendors. Legal teams can assess contracts, statutory duties and emerging regulatory requirements. These functions need to operate together. Healthcare organisations can also benefit from structured corporate legal support when reviewing contracts, privacy notices, regulatory responsibilities, data sharing arrangements and incident response procedures. Legal review is particularly useful where several overlapping healthcare and technology requirements apply.

Common Data Protection Mistakes in Healthcare

One common mistake is treating a privacy policy as the complete compliance solution. A policy cannot compensate for excessive employee access, weak vendor contracts or poor security controls. Another mistake is assuming every healthcare processing activity requires consent. The legal basis should be assessed according to the specific purpose and applicable law. Some organisations also assume health data is automatically subject to one universal localisation rule. The position is more nuanced and can depend on the applicable healthcare ecosystem, contract, sectoral requirements and transfer framework. A further mistake is waiting until the DPDP provisions become fully operational before preparing. Hospitals need time to map legacy systems, redesign forms, update contracts and test their incident response processes.

Conclusion

Data protection in healthcare requires much more than cybersecurity. Hospitals and healthcare companies must manage patient information across the entire data lifecycle, from collection and clinical use to sharing, retention, research and eventual deletion. The DPDP Act provides the central modern framework, but healthcare organisations must also consider the continuing transition from the earlier IT Act and SPDI framework, medical confidentiality requirements, ABDM governance, healthcare specific rules and cyber incident obligations. The strongest approach is practical and risk based. Healthcare organisations should know what information they hold, why they hold it, who can access it, where it travels and how quickly they can respond when something goes wrong. With the DPDP framework moving towards fuller implementation, hospitals and healthcare companies have an important opportunity to strengthen privacy governance before regulatory deadlines become operational requirements.

Frequently Asked Questions (FAQs)

Q1. Is health data protected under Indian data protection law?

Yes. Health information relating to an identifiable individual is personal data within the DPDP framework. The Act does not create a separate general category called sensitive personal data, although healthcare information can present significant privacy and security risks. Other laws and healthcare frameworks may also impose additional requirements.

Q2. Does a hospital need patient consent for every use of health data?

No. Consent is an important basis for processing, but the DPDP Act also recognises certain legitimate uses. Medical emergencies and specified healthcare situations require careful assessment under the applicable provisions.

Q3. Are hospitals required to follow the DPDP Act?

Hospitals processing digital personal data in India can fall within the DPDP framework. Their exact obligations depend on their activities, role as Data Fiduciary or Data Processor, applicable exemptions and the implementation status of individual provisions.

Q4. Is health data considered sensitive personal data under the DPDP Act?

The DPDP Act does not create a separate sensitive personal data category. However, health information requires strong safeguards because misuse or unauthorised disclosure can create significant harm.

Q5. What should a hospital privacy policy contain?

It should explain the categories of personal data collected, purposes of processing, relevant disclosures, rights, complaint mechanisms, retention practices and appropriate contact details. The final content should reflect the hospital's actual processing activities and applicable legal requirements.

Q6. Can patients request deletion of their medical records?

The DPDP Act provides a right to erasure in specified circumstances, but it does not mean every medical record must always be destroyed on request. Retention may be required by another law or may remain necessary for a lawful purpose.

Q7. What happens if a hospital suffers a data breach?

The organisation should immediately activate its incident response process, contain the incident, preserve evidence, assess the affected information and determine all applicable reporting obligations. DPDP requirements and CERT In requirements should be assessed separately because they operate under different frameworks.

Q8. Do healthcare companies need a Data Protection Officer?

Not every healthcare organisation automatically needs a statutory Data Protection Officer merely because it operates in healthcare. Additional DPO requirements arise where an organisation is designated as a Significant Data Fiduciary under the DPDP framework. Organisations may still choose to appoint privacy leadership as part of good governance.

Q9. Does ABDM create additional privacy obligations?

Organisations participating in the Ayushman Bharat Digital Mission ecosystem should review the applicable ABDM policies, technical requirements and consent framework alongside the general data protection laws.

Q10. Does GDPR apply to Indian hospitals?

GDPR may apply in specific circumstances, particularly where an organisation falls within its territorial scope. An Indian hospital should not assume GDPR applies merely because it uses European technology or has an international patient. The actual processing activities and territorial connection must be assessed.

Q11. How should hospitals prepare for the DPDP Rules?

Hospitals should begin with data mapping, privacy notice review, consent management, vendor due diligence, retention analysis, access controls, security testing and breach response planning. Preparing early allows legacy systems and contracts to be addressed before the later implementation deadlines.

This update was released on 25 Sep 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.