Digital Trust · DPDP for Hospital

DPDP for hospitals: consent at the bedside, evidence at the audit.

For hospital CIOs, medical superintendents, compliance and quality heads. Hospitals hold the most sensitive data for the longest time, across the most systems — HIS, LIS, PACS, billing, insurer portals — and share it with TPAs, labs, pharmacies and referring doctors. DPDP asks you to show consent, purpose and control for all of it.

Admission consentHIS/LIS/PACS vendorsMedical record retentionTPA & insurer sharingBreach preparedness

Request a Hospital DPDP Assessment Run the Free Gap Assessment

Where this starts

What hospital teams usually discover in week one.

The privacy policy exists. The gaps are operational: what was collected under which consent, who it went to, and whether anyone can prove it. If three or more of these apply, a scoped gap assessment is the right first step.

Regulators & rule-sets in play

Clinical establishment rules (state)Accreditation standards (where applicable)National health data ecosystem (ABDM)CERT-InData Protection Board

Sound familiar?

Admission forms carry a blanket consent for treatment, data sharing and “any other purpose”.
HIS, LIS and PACS vendors have remote access to production databases with no processor agreement or access logging.
Discharge summaries and reports are shared with insurers and TPAs by email and WhatsApp.
Medical records are kept forever because no one has written a retention schedule.
Attendants, emergency contacts and visitors are recorded with no notice.
Camera and biometric attendance systems cover staff and patients with no stated purpose or retention.

Personal data in scope

The data a Hospital organisation actually holds.

A DPDP programme starts with an honest inventory. These are the categories we typically find across hospital systems — each needs a purpose, a basis, an owner and a retention period.

Admission and registration details
Clinical notes, diagnoses and treatment plans
Lab, imaging and pathology results
Billing, insurance and TPA documents
Attendant and emergency-contact details
CCTV and access records

Hospital operating theatre representing clinical workflows that generate sensitive patient records

How the Act applies

DPDP obligations, translated for Hospital.

The Act is sector-neutral. Its impact is not. These are the obligations that carry the most weight for your workflows.

Notice and consent at registration and admission

Patients (or guardians) must be told what is collected, why, who receives it — labs, insurers, TPAs, referring doctors — and how to exercise rights. Emergency treatment has its own basis; elective sharing does not.

Vendors as processors

HIS, LIS, PACS, billing, cloud and IT support vendors process personal data on your behalf. Contracts must define purpose, security, sub-processing, deletion and breach duties, and access must be logged.

Retention aligned to medical-record rules

Clinical records are retained for the period your establishment rules and accreditation standards require. Marketing, camp registrations and feedback data are not covered by that mandate.

Rights requests across departments

Access and correction requests span medical records, billing and insurance desks. A single workflow with an owner and SLA is required.

Breach preparedness

Ransomware and misdirected records are the common hospital incidents. The playbook must include vendor incidents and patient notification, not only IT recovery.

We keep legal specifics general on this page. Section-level analysis, penalty exposure and interpretation are worked through with your counsel during the engagement.

The hard part

Medical record-keeping duties versus the right to erasure.

Hospitals are required to retain medical records for defined periods, and litigation and insurance disputes extend that. DPDP erasure applies only where no law requires retention. The programme separates clinical records from operational and marketing data, and applies each rule with evidence.

How we resolve it

Clinical record categories tagged with the applicable retention requirement and owner.
Camp registrations, marketing lists, feedback forms and app analytics on a consent-based schedule, erased on withdrawal.
Vendor and TPA copies governed by contract deletion terms.
Erasure responses that explain what clinical records are retained and why.

In your workflows

Where consent, notice and rights actually show up.

Registration & admission

Layered notices in patient languages; separate consents for elective sharing; guardian consent for minors; versioned consent record.

Clinical systems & vendors

Processor contracts for HIS/LIS/PACS and IT vendors; privileged-access logging; periodic access reviews.

Insurance & TPA

Secure, logged sharing channels replacing email and messaging apps; per-insurer data register.

Records & rights

Retention schedule for records and operational data; rights-request desk with SLA; breach playbook with vendor and patient tracks.

Want to know which of these is your biggest gap? The free assessment takes about ten minutes and scores seven compliance areas.

Run the Gap Assessment

Typical starting points

Three ways Hospital clients begin.

Scoped, time-boxed and designed to produce evidence early — so the board and the regulator see progress inside the first month.

First engagements

DPDP gap assessment across admission, clinical systems and insurer sharing in three weeks
Vendor and TPA processor-contract remediation with privileged-access logging
Retention schedule and rights-request desk with evidence in Avisha Trust

How the programme runs

From gap assessment to continuous readiness.

Week 1–2 · Gap assessment

Data inventory, consent and notice review, vendor and rights-process review, breach readiness. Prioritised findings.

Week 3–6 · Remediation sprint

Notice and consent redesign, retention-vs-erasure matrix, vendor contract terms, breach playbook — highest-risk gaps first.

Week 7–12 · Operations

Rights-request workflow, consent logging and evidence store live in Avisha Trust; teams trained; first evidence pack produced.

Ongoing · Monitoring

Quarterly reviews, vendor re-assessment, AI-usage tracking and readiness reporting to the board.

Built for the Indian regulatory stack

We reconcile DPDP with the sector rules that already bind you, instead of importing a foreign template.

Security and compliance from one team

“Reasonable security safeguards” are tested by the people who run VAPT and incident response, not only described in policy.

Evidence, continuously

Avisha Trust captures consent, rights requests and attestations so the answer to “show me” is an export, not a project.

FAQ

DPDP for Hospital: questions we hear most

Consent to treatment and consent to data processing are different things. Emergency treatment has a lawful basis of its own. Elective sharing — with insurers, marketing, research, wellness programmes — needs notice and, where consent-based, specific consent that can be withdrawn.

You remain accountable as the fiduciary; the vendor has processor duties under your contract. If the contract does not define security, breach notification and deletion, the exposure is yours. Remediating vendor contracts is usually the first action item for hospitals.

Clinical records are retained for the period your establishment rules and accreditation standards specify, and erasure requests do not override that. Data outside those records — camp registrations, marketing, app analytics — must be erased on request. The response to the patient should say which is which.

A three-week gap assessment focused on admission consent, vendor contracts and insurer sharing. Those three areas typically account for most of the exposure and can be remediated in eight to twelve weeks.

Related sectors

Start with your sector’s pressure point.

Request a scoped Hospital DPDP assessment, or run the free gap assessment first.

Request a Hospital Assessment Free Gap Assessment