India's Digital Personal Data Protection Act (DPDPA) 2023 fundamentally changes how healthcare providers handle patient data. Unlike the previous fragmented framework under the IT Act, the DPDPA creates clear obligations, significant penalties (up to ₹250 crore), and patient rights that every clinic. from single-practitioner offices to hospital chains. must respect. Here's what it means for your practice.
Key Obligations for Clinics
The DPDPA requires lawful purpose and consent for processing personal data, purpose limitation (data collected for appointments can't be used for unrelated marketing), storage limitation (don't retain data longer than needed), data accuracy obligations, and reasonable security safeguards. For healthcare specifically, health data is "sensitive personal data" requiring explicit consent. implied consent from visiting your clinic is insufficient under the new framework.
Consent Management
Every patient must give clear, informed consent for data processing. and consent must be specific to each purpose. Collecting data for treatment is one consent; using it for research is another; sharing with third-party AI tools is yet another. Consent must be freely given (not a condition of receiving care), easy to withdraw, and documented with timestamps. Practices need digital consent management systems that track what each patient has consented to and when. paper forms no longer suffice.
Data Principal Rights
Patients (called "Data Principals" under DPDPA) have the right to access their data, correct inaccuracies, and request erasure. A patient asking "what data do you hold about me?" must receive a comprehensive, understandable answer. not a runaround.
Clinics must respond to these requests within a reasonable timeframe. This means your practice management system and any AI tools must support data export, modification, and deletion capabilities.
Third-Party AI Tools and DPDPA
If you use AI tools that process patient data. voice AI receptionists, clinical scribes, analytics platforms. each is a "Data Processor" under DPDPA. You remain responsible for ensuring they handle data appropriately. Require data processing agreements from every vendor, verify their security measures, understand where data is stored (data localization requirements may apply), and ensure they can support patient rights requests. Your compliance is only as strong as your weakest vendor.
Practical Steps for Compliance
Start immediately: audit what personal data you collect and why, implement digital consent capture for all patients, review vendor contracts for data processing terms, establish procedures for responding to patient data requests, appoint a responsible person (not necessarily a DPO for smaller clinics, but someone accountable), and document your data processing activities. The enforcement timeline is approaching. practices that start now avoid the scramble and penalties that will catch the unprepared.