DPDP Insights › Questions › Can we use patient data for research, audits or case studies

Question · Healthcare and hospitals

Can we use patient data for research, audits or case studies?

Short answer: Consent or de-identification first

Research with identifiable patients needs informed consent under research rules and DPDP consent for that use. Clinical audit to improve care within the hospital usually fits the treatment purpose. Case studies and teaching material should be de-identified so patients cannot be recognised. Clinical trials follow the NDCT Rules, 2019.

What the law says

Section 6 sets consent; Section 17(2)(b) covers research only where no decision is taken about the person and prescribed standards are followed.

Section 6: Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, limited to the data needed for the purpose, and as easy to withdraw as it was to give.
Section 7: Some uses need no consent: data a person gave voluntarily for a specified purpose, duties under law, medical emergencies involving a threat to life, health services during an epidemic, safety during a disaster, and purposes of employment.
Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.

Steps

Route research through the ethics committee.
Take research consent separately.
De-identify teaching cases and photos.
Limit researcher access.
Delete or anonymise at the end.

Evidence to keep

Ethics approvals
Research consents
De-identification checks

Common mistakes

Photos with faces or tattoos in slides
Using records for studies without approval
Keeping research data with names after the study

From each seat

DPO / Privacy lead: Check research data is deleted or anonymised at the end.
Legal & compliance: Align research consent with NDCT and DPDP.
Medical director: You set the rules for case presentations.

What a good answer from management sounds like

“Research goes through the ethics committee with consent; teaching material is de-identified.” Effort and time: Medium.