DPDP Act for Hospitals and Health Apps

Consent is the main basis for processing, but the Act lists legitimate uses that do not need it. Two matter to healthcare: responding to a medical emergency involving a threat to life or an immediate threat to health, and providing treatment or health services during an epidemic, outbreak or other threat to public health. A patient who voluntarily gives data for a specified purpose, such as registering for a consultation, and does not object is also covered for that purpose. Marketing, research and sharing with third parties need separate consent.

The registration form becomes a notice. It should list the data collected and the purposes in plain language, in the patient's language where possible, and record that the patient saw it. Software should store the notice version against each patient.

Patients under 18 need verifiable consent from a parent. The Rules exempt clinical establishments, mental health establishments and healthcare professionals from the parental consent and no-tracking requirements where processing is limited to providing health services to the child, to the extent necessary to protect the child's health. That exemption is narrow: a paediatric app that shows targeted advertising would not fall within it. For adults who have a lawful guardian, consent comes from the guardian, who must be verified.

The Rules require encryption or equivalent protection, access control, access logs and backups. In hospitals, the practical gaps are usually shared logins at nursing stations, reports sent on personal WhatsApp and old systems with no audit trail.

Shared logins make every access log meaningless. Fix that first.

Lab partners, TPAs, cloud hosting, teleconsultation providers and software vendors all process patient data for the hospital. The hospital stays responsible as Data Fiduciary. Contracts should require security safeguards, breach reporting to the hospital, deletion on termination and no use of data for the vendor's own purposes.

Medical records have their own retention requirements under professional regulations and state Clinical Establishments rules, and the DPDP Act allows retention where another law requires it. Document those periods per record type. Any breach must be reported to affected patients and to the Data Protection Board, with a detailed report within 72 hours. ABDM's consent framework for sharing health records works alongside the Act; an ABDM consent artefact covers a specific exchange, not your general processing.