Why in the News
The Digital Personal Data Protection (DPDP) Act, 2023 will soon require every hospital to protect patient data through secure systems, trained staff and continuous compliance. India has legislated faster than it has trained the people who must apply the law, and compliance costs may reach patients’ bills.
What does the DPDP Act ask of hospitals?
- What the law is: The DPDP Act is a general framework protecting digital personal data across sectors, including healthcare, deciding who may use a person’s data and how.
- Three roles: The law gives each party a role:
- the patient is the data principal, the owner of the data;
- the hospital is the data fiduciary, deciding how data is used, like a bank holding money in trust;
- an outside software or cloud firm is the data processor.
- Two kinds of consent: Clinical consent and data consent are separate, so agreeing to a scan is not agreeing to every later use of it. Emergencies, medico-legal cases and public health are exceptions.
- Phased start: Provisions on consent managers apply from November 2026, and the remaining substantive obligations from May 2027.
- The takeaway: Protecting patient data is becoming a legal duty with a deadline, not just good practice.
Why are hospitals unusually hard places to comply?
- Intimate, continuous records: Unlike banks, hospitals create intimate information within hours: clinical notes, laboratory results, ventilator readings and prescriptions.
- Access dilemma: Several professionals need parts of one record, so tight control harms care and open access causes breaches.
- Data leaves the hospital: A cashless claim sends diagnoses to an insurer or its third party administrator. Laboratories, radiology platforms, cloud vendors, telemedicine services and WhatsApp-based workflows open further routes.
- Case for health-specific rules: Clinical care is not a commercial transaction alone, so healthcare needs specific DPDP provisions or a separate Act that treats small and large hospitals differently.
What will compliance cost, and who pays?
- Compliance toolkit: The law requires security safeguards, grievance handling and data correction or erasure. In practice, hospitals need role-based access, encryption, audit logs, backups, vendor contracts and breach protocols.
- Statutory duties and penalty: Data fiduciaries must appoint a statutory data protection officer. Failing to take safeguards can attract a penalty of up to ₹250 crore.
- Sharing cuts cost: An India and Norway study (2023) found an integrated information system raised an urban primary health centre (PHC) budget by 17.7%. Shared across many PHCs, the cost fell sharply.
- Patients may pay: The National Health Accounts 2022-23 put out-of-pocket spending at 43.4% of total health expenditure, so compliance costs are likely to pass to patients.
Why is training the harder problem?
- No uniform curriculum: Medical education teaches confidentiality and ethics, but there is no uniform DPDP-oriented National Medical Commission (NMC) curriculum across medicine, nursing, allied health, administration and healthcare IT.
- People behind software: Behind every software workflow is a person who configures access or views data, at hospitals and vendors alike.
- One leaked password: One leaked password from an untrained person can cause a major breach, so data literacy, knowing how to handle data safely, must become a core healthcare skill.
Challenges
- Duplicated spending: Each small hospital, diagnostic centre and PHC buying the same privacy tools alone multiplies cost.
- Complaint-driven enforcement: A law that waits for complaints or litigation cannot protect data that is routinely commoditised.
- Unequal capacity: A small clinic faces much the same duties as a large hospital.
Way Forward
- Shared infrastructure through ABDM: The Centre should finance and build common privacy infrastructure through the Unified Health Interface of the Ayushman Bharat Digital Mission (ABDM).
- Model agreements and standards: Issue model consent and vendor agreements, affordable cybersecurity support and healthcare-specific implementation standards.
- NMC training module: The NMC should introduce a standard DPDP course for all clinical and health IT staff.
Conclusion
India’s health data law will work only if the people handling patient records are trained. Whether the Centre builds shared infrastructure and training before hospitals’ legal duties begin is the test to watch.
Key numbers
- Structure of the Act: 44 sections in nine chapters, plus one Schedule.
- DPDP Rules notified: November 13, 2025.
- United States costs: compliance with the Health Insurance Portability and Accountability Act (HIPAA) about $5 per patient a year (2008); a breach about $498 per affected record (2025 estimate).
- Shared PHC model: across 400 PHCs, the extra cost fell to about 6% per PHC.
Matching Previous Year Question
“[2024, GS3, 10 marks] Describe the context and salient features of the Digital Personal Data Protection Act, 2023”
