InfraVeritas360DPDPiq

DPDP Insights › Healthcare and hospitals

Types of organisation

• Multi-specialty hospital chainA chain shares one HIS, one PACS and central billing across units. A patient seen in one city can be pulled up in another, so role-based access and logs matter more than in a single hospital.
• Standalone hospital or nursing homeSmaller hospitals often run vendor-hosted software, keep paper case sheets and rely on a few staff for IT. The vendor contract and the records room carry much of the risk.
• Diagnostic labs and imagingLabs send reports to patients and referring doctors by SMS, email and apps, and collection franchisees handle samples with names. Ultrasound centres also keep PCPNDT records, which have their own rules.
• Health-tech and telemedicineTeleconsultation records, chats and prescriptions sit on your platform. The Telemedicine Practice Guidelines ask doctors to record consent and keep consultation records; DPDP adds notices, consent for anything beyond care, and limits on tracking.
• Pharmacy chain and e-pharmacyPrescriptions show conditions. Schedule H1 drugs need a register with the patient's and prescriber's names, kept for three years. Delivery partners see names, addresses and parcels.

Whose data you hold

• Patients and their attendants
• Doctors, nurses, residents and staff
• Visiting consultants
• Insurance and TPA contacts
• Contract staff: housekeeping, security, ambulance
• Visitors

Read it from your seat

• DPO / Privacy leadIn a hospital, your work is mostly with people: the front desk, wards, labs and billing, all handling patient data every hour.
• CISO / Security headYour systems run next to patient care. An incident can stop admissions, not just leak data.
• CIO / IT headPatient data lives in the HIS, PACS, LIS, pharmacy, billing, apps and often ABDM links.
• CEO / MDPatients trust your hospital with their care and their secrets. Under DPDP, you need to be able to show that trust is kept.
• DirectorAs a director, you are expected to ask whether patients' information is cared for as well as their health.
• HR headYou hold records of doctors, nurses, residents and many contract staff, and staff are often patients too.
• Legal & complianceYou read DPDP alongside medical ethics regulations, PCPNDT, MTP, mental health, HIV and clinical trial laws.
• Operations headFront desk, records room, wards and billing handle patient data every minute.
• Medical directorAs medical director, you set the habits of clinicians, residents and nurses.
• Chief risk officerPatient-data risk now sits next to clinical and financial risk.

By department

• IT department
• Administration department
• HR department
• Finance department
• Marketing department
• Customer service department
• Legal department
• Procurement department

Questions specific to this sector

• Do we need DPDP consent to treat a patient?
• Can we share patient records with insurers and TPAs?
• Can we use patient data for research, audits or case studies?
• Which records need extra protection under other health laws?
• How do we stop staff looking at records they do not need?
• We are linked to ABDM. How does its consent fit with DPDP?
• Imaging machines and lab analysers hold patient data. What do we do?
• How long should we keep patient records?

Practical examples

Notice, request log, retention schedule, vendor clause and breach notice.

Rules that sit alongside DPDP