DPDP for Healthcare
Patient Data, Consent & Compliance

Patient Records as
Protected Personal Data

Under the DPDP Act 2023, every hospital, clinic, nursing home, diagnostic laboratory, telemedicine platform, and health insurance company that collects and processes patient data is a data fiduciary. Patient records — including registration details, Aadhaar-linked identity verification, medical history, diagnosis notes, treatment protocols, prescription records, diagnostic reports, billing data, and insurance claims — are digital personal data protected by the Act.

Multi-speciality hospital chains operating across multiple cities process personal data at a scale comparable to large banks and NBFCs. A single hospital chain may hold electronic medical records for tens of millions of patients, each record containing deeply sensitive health information. These large healthcare fiduciaries are likely to be designated as Significant Data Fiduciaries under Section 10, triggering additional obligations: mandatory Data Protection Officer appointment, independent data auditor, and periodic Data Protection Impact Assessments.

The sensitivity of health data magnifies every compliance obligation. While a breach of financial data exposes account numbers and transaction history, a breach of health data exposes diagnosis, mental health records, HIV status, reproductive health, genetic information, and treatment history — information that can lead to discrimination in employment, insurance denial, and social stigma. The DPDP Act does not create a separate category for health data (unlike GDPR which explicitly identifies health data as a special category), but the sensitivity of the data influences the standard of "reasonable security safeguards" that the Data Protection Board will expect.

Ayushman Bharat Digital Mission
Meets Data Protection

The Ayushman Bharat Digital Mission (ABDM) is building India’s digital health infrastructure: ABHA (Ayushman Bharat Health Account) IDs for every citizen, Health Information Exchange and Consent Manager (HIE-CM) for interoperable health records, and a unified patient health record system that allows data sharing between hospitals, laboratories, pharmacies, and insurers. The DPDP Act adds a critical compliance layer to this architecture.

Every data sharing event within the ABDM ecosystem requires DPDP-compliant consent. When a patient visits Hospital A and their records are requested by Hospital B through the Health Information Exchange, the consent manager must ensure that the patient has given informed, specific, and revocable consent for that particular data transfer. The ABDM consent framework and the DPDP consent requirements must be aligned — and where they diverge, healthcare institutions need legal guidance on which standard prevails.

Healthcare providers participating in ABDM occupy dual roles under DPDP: they are data fiduciaries for patient data they generate (consultation notes, diagnostic reports, prescriptions) and effectively function as data processors for data received through the exchange from other providers. This dual role creates complex compliance obligations around data retention, purpose limitation, and security safeguards for both originated and received data.

The aggregation risk is particularly acute in ABDM. A patient who links their ABHA ID across a general hospital, a diagnostic lab, a mental health counsellor, and a pharmacy creates an extensive longitudinal health profile. The combined dataset is far more sensitive than any individual record — and its protection under DPDP requires security safeguards commensurate with the aggregated sensitivity. Healthcare institutions integrating with ABDM need legal advisory that addresses both the ABDM regulatory framework and DPDP consent architecture simultaneously.

Paediatric Records Under
Heightened Protection

Section 9 of the DPDP Act imposes the strictest obligations on processing personal data of children — defined as individuals under 18 years of age. For healthcare providers, this creates a distinct compliance framework for paediatric hospitals, neonatal intensive care units, child psychiatry and psychology practices, paediatric diagnostic labs, and children’s health monitoring applications.

The core requirement is verifiable parental or guardian consent before processing a child’s medical data. This means a paediatric hospital cannot rely on the general registration consent signed by a parent — it must obtain specific consent for each category of data processing involving the child’s records. If the hospital shares the child’s diagnostic report with a specialist, an insurer, or a school health programme, each sharing instance requires separate consent from the parent or guardian.

Section 9 also prohibits processing that is detrimental to the well-being of the child. In a healthcare context, this could restrict: (a) sharing children’s health data with third-party marketing platforms; (b) using paediatric patient data for commercial research without explicit consent; (c) behavioural tracking in children’s health apps that monitors usage patterns beyond clinical necessity. The prohibition on tracking and monitoring is particularly relevant for digital health platforms targeting children — fitness apps, mental health chatbots, medication reminder apps, and wellness trackers.

Penalties for children’s data violations reach Rs 200 crore per contravention (Schedule Sl.3, Section 9). Healthcare institutions with significant paediatric patient populations need specialised consent architecture, data handling protocols, and compliance documentation that specifically addresses Section 9 requirements. Unified Chambers advises paediatric hospitals and children’s healthcare providers on building Section 9-compliant data governance frameworks.

DPDP for Healthcare — Key Questions