DPDP Compliance for Healthcare and Hospitals

What makes healthcare harder than most sectors

The obligations are the same as anyone else's. The estate is what differs.

• Data is fragmented across HIS, LIS, PACS, pharmacy and billing, often from different vendors and eras, frequently on-premise.
• Consent is taken at the point of care, sometimes on paper, sometimes by a person who is unwell or accompanied by a relative — so proving consent was free, informed and unambiguous is genuinely difficult.
• Children's data appears routinely in paediatrics, and the Act treats it with additional care obligations.
• Third parties are everywhere: insurers, TPAs, referring doctors, diagnostic partners and increasingly ABDM participants.

Consent at the point of care

The realistic answer is to separate clinical care from everything else. Treatment records generally do not rest on consent as their lawful basis; marketing, research participation, feedback campaigns and data sharing with partners usually do. Bundling all of it into one admission form is the common failure — it makes the whole bundle challengeable.

Notices must be available in a language the patient can read, which in most Indian hospitals means more than English.

What to do first

Inventory the systems before touching consent forms. In healthcare the inventory itself is usually the revelation, because imaging archives and legacy lab systems tend to hold far more identifiable data, for far longer, than anyone assumes.

Then split the consent model: care, versus everything else.