DPDP for the Records and archives department in Healthcare

Keep them for at least the periods health laws set: indoor records for three years from the start of treatment under the 2002 medical ethics regulations, PCPNDT records for two years, MTP registers for five years, Schedule H1 registers for three years, and ethics committee trial records for five years after a trial. Many hospitals keep records longer for continuity of care and legal claims. Write the period and reason for each record type, then erase or archive.

Section 8(7) allows retention where a law requires it; Rule 8(3) sets a one-year floor. Section 8(7) · Rule 8 · Section 7

1. List record types: OPD, IPD, lab, imaging, billing, PCPNDT, MTP, pharmacy.
2. Note the legal minimum.
3. Decide any longer period and why.
4. Archive with restricted access.
5. Record each deletion.

• Retention schedule
• Archive access list
• Deletion log

• No schedule at all
• Deleting before the minimum
• Keeping open access to old records

Keep data for as long as its purpose needs, or as long as a law requires, and then erase it. Every organisation must keep personal data and logs for at least one year under Rule 8(3). Write a retention schedule by record type, with the law or reason against each period.

Indoor records at least 3 years (2002 regulations), PCPNDT 2 years, MTP 5 years, Schedule H1 3 years.

Section 8(7) asks for erasure when the purpose is over, unless a law requires retention. Rule 8(3) sets a one-year minimum for personal data, traffic data and logs. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

1. List the record types you hold.
2. Write the period for each, with the law, regulator rule or business reason.
3. Set a trigger for the period to start: end of relationship, date of transaction, exit date.
4. Automate deletion where you can; for paper, schedule shredding.
5. Keep a deletion log.

• Retention schedule approved by Legal
• Deletion log
• Shredding or disposal certificates

• 'Keep everything forever' because storage is cheap
• Deleting before the legal minimum
• Forgetting email, shared drives and backups

You must erase data that you no longer need for the purpose it was collected for, unless a law requires you to keep it. Where a law does require it, keep the data, stop using it for anything else, and tell the person why it is being kept and until when.

Medical records have legal minimums; a patient's erasure request cannot cut those short.

Section 12 gives the right to correction and erasure. Section 8(7) allows retention only where a law requires it. Rule 8(3) asks every organisation to keep personal data and logs for at least one year first. Sections 11–14 · Rule 14 · Section 8(7) · Rule 8

1. Log the request and verify identity.
2. Check the retention schedule for each record type involved.
3. Delete what has no legal reason to stay, including copies with vendors and in test systems.
4. Mark what must stay, with the law and the end date.
5. Reply in plain words: what was deleted, what is kept, why and until when.

• Erasure log
• Vendor deletion confirmations
• Reply to the person

• Refusing every erasure request 'because of backups'
• Deleting records a law requires
• Not telling vendors

Deletion should reach every copy you control. For backups, the usual practice is to let deleted records expire with the normal backup cycle, never restore them into live use, and write this down. Test and training copies should use masked data.

Offline backups decide whether care continues during ransomware.

Section 8(7) asks for erasure. Rule 6 asks for backups for continuity. The two meet in a backup retention rule that is short enough and written down. Section 8(7) · Rule 8 · Section 8(5) · Rule 6

1. List where copies live: backups, replicas, test, analytics, laptops, vendors.
2. Set backup retention to match the retention schedule.
3. Write a rule: deleted records are not restored into live systems.
4. Mask personal data in test and training copies.
5. Get deletion confirmations from vendors.

• Backup retention settings
• Written backup-expiry rule
• Masking procedure for test data

• Ten-year backups for convenience
• Live copies in test
• Restoring old backups and bringing deleted records back

Send a summary of the personal data you hold about them and what you do with it, and the names of the other organisations you shared it with and what was shared. Check the person's identity first, log the request and keep a copy of your reply.

Under the 2002 regulations, patients and authorised attendants should get record copies within 72 hours of a request. The DPDP summary adds who the data was shared with.

Section 11 gives the right to a summary and the list of organisations it was shared with. Rule 14 asks you to publish how requests are made and to answer within the period you publish. Sections 11–14 · Rule 14 · Section 8(9)–(10) · Rules 9, 14

1. Log the request in one register the day it arrives.
2. Verify identity using details you already hold.
3. Search every system, including vendors' copies.
4. Write a plain summary: what data, why it is used, who received it.
5. Send it, and file the request, search notes and reply.

• Request register
• Search notes for each request
• Copy of each reply with date

• Sending raw database dumps
• Forgetting data held by vendors
• No identity check before sending

Check that the request is in writing, comes from the right authority and cites the legal power. Share only what is asked for, record what you sent and to whom, and keep the request on file. The Act allows processing to meet a legal duty, but it does not mean sharing everything on a phone call.

Police requests for MLC records and court summons are common.

Section 7(d) and 7(e) allow processing to meet a legal duty to disclose to the State, or to comply with a judgment or order. Section 17(1)(c) exempts processing for preventing, detecting or investigating offences. Section 7 · Section 8(5) · Rule 6

1. Route every such request to Legal.
2. Check the authority, the legal power and the scope.
3. Share only what is asked, by a secure method.
4. Log the request, what was sent, by whom and when.
5. Tell the person, unless the law or the authority says you must not.

• Authority request log
• Copies of requests
• Record of what was sent

• Sharing on a phone call
• Sending whole files when a few lines were asked
• No log

Contain it, then tell people. A reportable cyber incident goes to CERT-In within six hours of being noticed. Under DPDP, each affected person and the Data Protection Board must be told without delay, and the Board needs a detailed report within 72 hours. Sector regulators may have their own clock too.

A ransomware attack on the HIS needs a CERT-In report in six hours and the DPDP messages.

Section 8(6) and Rule 7 set the DPDP steps. The CERT-In Directions of 28 April 2022 set the six-hour report. A breach includes accidental disclosure and loss of access, not only hacking. Section 8(6) · Rule 7 · Section 8(5) · Rule 6

1. Name one incident lead and a back-up, with phone numbers that work at night.
2. Write the first-hour steps: isolate, preserve logs, tell the DPO and the incident lead.
3. Keep ready-made drafts for CERT-In, the regulator, the Board and affected people.
4. Decide in advance who signs off each message.
5. Rehearse once a year with the people who would actually be called.

• Incident plan with clocks
• Rehearsal record
• Incident log with times of each step

• Waiting to finish the investigation before telling anyone
• Treating a wrong email or a lost laptop as 'not a breach'
• Only IT knowing the plan