The DPDP Act for a hospital owner, in plain language

What the Digital Personal Data Protection Act, 2023 asks of a hospital that stores patient records, and the five things to have in place.

Who is who

Under the Act, the hospital that decides why and how patient data is used is the data fiduciary. A software vendor that stores or processes that data on the hospital's instructions is a data processor. The obligations sit with the fiduciary; the processor must follow a written contract.

In practice: the hospital owns the responsibility, the vendor owns the mechanism. Choose a vendor whose mechanism you can describe.

Consent, per purpose

Consent must be free, specific, informed and unambiguous, for a stated purpose. 'We may use your data' is not consent. 'We will store your record at this hospital', 'we will record your consultation to write the note' and 'we will message you on WhatsApp' are three purposes and three consents.

Consent can be withdrawn as easily as it was given. A withdrawal must stop the use it covers, and you must be able to show when it was withdrawn.

The patient's rights

A patient may ask what data you hold, ask for a copy, ask for corrections and, subject to other laws that require records to be kept, ask for erasure. They may also nominate someone to exercise these rights.

Clinical records have their own retention rules under medical council and state regulations; erasure requests are answered against those rules, not ignored.

Security and breaches

The fiduciary must take reasonable security safeguards and must notify the Data Protection Board and affected patients of a breach. 'Reasonable' will be read against what a competent vendor offers: encryption, access by role, audit logs, backups.

Five things to have in place

1. A written processing agreement with every vendor that touches patient data. 2. Consent recorded per purpose, with the method and time, and withdrawable at the desk. 3. A log of who accessed which record and when. 4. A way to give a patient a copy of their record within days. 5. A named person who owns data protection in the hospital, even if it is the administrator.

Vaidyah records consent per purpose at registration, logs every access, and exports a patient's record on request. The processing agreement is part of the hospital's contract with us.