DPDP Insights › Questions › Which records need extra protection under other health laws?

Question · Healthcare and hospitals

Which records need extra protection under other health laws?

Short answer: Yes, tighter access than other records

HIV results, mental health records, MTP registers and PCPNDT records each have their own law. HIV status needs informed consent before disclosure. Mental health records are confidential and cannot go to the media without consent. The MTP admission register is a secret document. PCPNDT records are kept for two years. Give these the tightest access in the hospital.

What the law says

Section 8(5) asks for safeguards suited to the risk; the special laws set their own rules.

Section 8(5) · Rule 6: Protect personal data with reasonable security safeguards. Rule 6 lists the minimum: encryption, masking or tokenisation; access control; logs and monitoring; backups for continuity; keeping logs for at least one year; and security terms in contracts with processors.
Section 8(7) · Rule 8: Erase personal data when its purpose is over or consent is withdrawn, unless a law requires you to keep it, and have your processors erase it too. Rule 8(3) asks every Data Fiduciary to keep personal data, traffic data and logs for at least one year for purposes listed in the Rules.

Steps

List where these records sit.
Restrict access to the treating team.
Keep the MTP register with the head of the hospital.
Set retention as each law says.
Log every access.

Evidence to keep

Access settings
Retention entries
Access logs

Common mistakes

HIV results visible to all clinicians
MTP details in general billing
PCPNDT records deleted early

From each seat

CISO / Security head: Set role-based restrictions in the HIS.
Director: Ask whether these records have tighter access than others.
Legal & compliance: Keep the list of special laws current.
Medical director: Clinical heads decide the treating team.

What a good answer from management sounds like

“Sensitive records have restricted access and their own retention, with logs reviewed.” Effort and time: Medium.