Consent That Travels: DPDP for Multi-Provider Healthcare

The form at the admission desk is not doing the work you think it is

Most Indian hospitals have a consent form at registration. It usually covers consent to treatment, authorisation to bill, an acknowledgement of hospital rules, and somewhere near the bottom a line permitting the hospital to share information with insurers, referring doctors and “such other parties as may be necessary”. It is signed at a counter, in a queue, often by an attendant rather than the patient, frequently in a language that is not the patient’s first.

Then the record starts moving. A sample goes to an external pathology chain. A CT is read overnight by a teleradiology service. The discharge summary and the itemised bill go to a third-party administrator, by email. A triage model reads the chest films. Six months later the quality team pulls a dataset for a paper.

None of those movements was described to the patient in terms they could act on, and several are not care delivery at all. Under the Digital Personal Data Protection Act, 2023, consent must be free, specific, informed and limited to the purpose stated in the notice — so a single blanket line at admission cannot carry eight purposes and a dozen recipients. This is not a documentation problem to be solved with a longer form. It is a design problem: consent has to be attached to the record and checked at the point of disclosure, not collected once and filed.

Two features of the Act change the design. Unlike the older IT Rules framework, it does not create a separate category of sensitive personal data — health data is personal data, under the same obligations that apply to a mobile number. And unlike GDPR, it gives you no general legitimate-interest basis and no contractual-necessity basis. You have consent, plus a short closed list of legitimate uses that includes medical emergencies involving a threat to life or an immediate threat to health, and the provision of medical treatment during an epidemic or other threat to public health. That is a narrower toolkit than hospital legal teams often assume, and it puts almost all of the design burden on consent and notice.

Where a patient record actually goes

Before designing anything, write down the real flow. This exercise takes about a week and reliably surprises the people who commissioned it, because nobody in the building has the whole picture — the medical records officer knows the court summons flow, the billing head knows the TPA flow, and only the HIS administrator knows about the vendor’s remote-access account.

Inside the hospital

Registration creates an identity record. Notes accumulate in the HIS, results in the LIS, images in PACS, dispensing in pharmacy, the financial file in billing. Most hospitals find on inspection that role-based access is nominal: a front-desk login retrieves a full clinical record, and the dietary department sees diagnoses it has no reason to see. Internal over-access is the least discussed and most common exposure.

External diagnostics

Samples and images leave the building constantly — to a partner chain, to a reference lab for an assay nobody runs locally, to a teleradiology service reading overnight from another city or another country. The requisition routinely carries far more than the assay requires, because that is how the template was printed.

Payers: insurers and TPAs

Cashless claims pull the discharge summary, investigation reports, implant invoices and the itemised bill into the payer’s process. This is the most document-heavy outbound flow, the one most often handled over consumer email and messaging applications, and the one where your role changes: the TPA and the insurer are not processing on your instruction, they are processing for their own claim-adjudication purpose. That distinction changes both the basis and the paperwork.

Teleconsultation and digital front doors

Booking, symptom intake, video consultation, e-prescription and payment often run on a platform the hospital licenses rather than builds. Patients type symptoms into it before any form is signed, consultations are sometimes recorded, clinicians attend from personal devices, and the hospital frequently cannot say where the intake data is hosted or how long the platform keeps it.

AI diagnostic and documentation tools

The fastest-growing flow and the least papered: triage models reading radiographs, retinal screening, ECG interpretation, sepsis prediction on vitals, ambient scribes drafting the note. Two questions decide whether the use is lawful and both are usually unanswered in the contract — does the vendor retain inputs and outputs, and does it train or improve its models on your patients’ data? A tool supporting this patient’s care sits inside the care purpose. A tool quietly building a training corpus does not, and a licence that is silent on retention should be read as a yes until the vendor says otherwise in writing.

Everything else

Transcription. Cloud hosting and offsite backup. HIS support engineers with standing remote access to production. Referring physicians. The patient’s own health account. Research registries. And camp registrations, health-check marketing lists, feedback surveys and app analytics — not clinical data at all, and never something that should have been pooled with it.

Care delivery is not the same as secondary use

The most useful line a hospital can draw is between processing that serves this patient’s current episode of care and everything else. Inside that line, the purpose is coherent, the patient expects it, and a properly drafted notice and consent at registration can cover it — including onward disclosure to the external diagnostics the episode requires, provided the recipients and categories are actually described.

Outside that line sit uses that look administratively similar and are legally quite different. Claim adjudication by a payer. Research and publication. Model development. Service-line analytics. Teaching and case presentation. Health-check marketing. Each needs its own purpose statement, its own basis, and in most cases its own consent that the patient can refuse without being refused care — which is the practical meaning of consent being free. If declining the research consent changes how the patient is treated, the consent is not worth collecting.

Two refinements matter. De-identification is a real tool, not a formality: data that genuinely cannot be linked to an individual falls outside the Act, but a dataset with admission dates, pin codes, a rare diagnosis and a treating consultant is re-identifiable, and calling it anonymised does not make it so. Document the method and have someone outside the requesting team review it. And keep statutory disclosures in their own category — notifiable disease reporting, court orders, medico-legal cases and regulatory inspections are not consent-based, and the notice should say plainly that they happen.

Mapping flow, recipient, purpose and basis

This is the core artefact of a healthcare DPDP programme. Build it once, keep it current, and most other questions — notice wording, contract terms, retention, rights responses, breach scope — become lookups against it rather than debates.

Data flow	Recipient and their role	Purpose	Basis	What must be in place
Registration and admission details into the HIS	Hospital (fiduciary)	Identify the patient, create and maintain the record	Consent at registration, on a notice the patient has seen	Layered notice in the patient’s language; versioned consent record tied to the patient ID; role-based access with audit logging
Clinical notes, orders and results across departments	Hospital departments (internal)	Deliver care for this episode	Care-purpose consent; emergency legitimate use where the patient cannot consent	Access limited to the care team and function; minimum-necessary views for non-clinical departments; logging of record opens
Sample and requisition to an external pathology lab	Lab — processor where it tests on your instruction; its own fiduciary where it bills the patient directly	Diagnostics for this episode	Care-purpose consent, with the lab’s category of recipient named in the notice	Processor agreement: purpose limitation, no secondary use, security, sub-processing control, deletion, breach notification to you; requisition trimmed to what the assay needs
Images to an external imaging centre or teleradiology provider	Provider (processor)	Reporting and interpretation	Care-purpose consent	Processor agreement; location of reading and hosting known and recorded; identifiers minimised in the study where clinically safe; access logs retrievable by you
Discharge summary, reports and bill to insurer or TPA	Payer — processing for its own claim purpose	Cashless authorisation and claim adjudication	A separate, specific consent for claim disclosure, taken as its own act	Separate consent artefact referencing the payer; secure logged channel replacing email and messaging apps; per-payer register of what was sent and when; minimum necessary documents
Intake, booking and video consultation on a teleconsult platform	Platform (processor; its own fiduciary for any independent use)	Remote consultation and prescribing	Consent captured in the platform before intake, not at a later physical desk	Processor agreement with hosting location and retention stated; in-platform notice; separate explicit consent for recording, with its own retention period
Images, vitals or notes into an AI tool supporting this patient’s care	Tool vendor (processor)	Decision support for this patient	Care-purpose consent, where the notice says automated tools assist clinicians	Contract prohibiting training or product improvement on your data absent separate consent; retention of inputs and outputs defined; clinician-in-the-loop recorded; model version logged with the output
Dataset extracted for research, publication or model development	Research partner or vendor	Secondary use	Specific consent for that purpose, or genuine de-identification placing the data outside the Act	Ethics committee approval; documented de-identification method and re-identification risk assessment; written data-sharing agreement; no onward sharing; no quiet scope creep from one study to a programme
Patient contact details into health-check or outreach campaigns	Hospital marketing or its agency	Promotion of services	Separate opt-in consent, refusable without affecting care, withdrawable at any time	Consent not bundled with admission; suppression honoured across channels within a stated SLA; agency under processor terms; campaign lists kept separate from clinical systems
Record linked to the patient’s own health account or shared at their direction	The patient, or a recipient they nominate	Portability and the patient’s own use	The patient’s own request, authenticated	Identity verification proportionate to the request; record of what was released, to whom and when; no additional hospital use inferred from the linkage
Production data visible to HIS, cloud, backup and transcription vendors	IT vendors (processors)	Hosting, support and operations	No separate patient consent; your accountability and the processor contract	Named support accounts rather than shared logins; just-in-time privileged access with session logging; encryption at rest and in transit; deletion and return on exit; breach duty with a timeline that lets you meet yours
Statutory and medico-legal disclosures	Courts, police, regulators, public-health authorities	Legal obligation	Not consent-based	Single authorised channel; register of every disclosure with the authority, the instrument relied on and the records released; notice that states these disclosures occur
Attendant and emergency-contact details	Hospital (fiduciary)	Contactability and visitor control	The attendant’s own consent, which is separate from the patient’s	Short notice given to the attendant; no reuse of attendant numbers for marketing; retention tied to the admission

Consent that follows the record

The structural fix is to stop treating consent as a document and start treating it as data attached to the record and evaluated at the moment of disclosure. Concretely, that means five things.

1. One consent artefact per purpose, not one form per visit. Care delivery including necessary diagnostics. Claim disclosure to a named payer. Teleconsultation recording. Research participation. Outreach and marketing. Each with its own identifier, its own notice version, its own timestamp, its own capture channel, and its own status.
2. Machine-readable and queryable. The consent state has to be something the HIS and the integration layer can read before a disclosure, not a scanned PDF in a folder. If a claim-submission screen cannot check whether claim consent exists for this episode, the check will not happen.
3. Checked at the gateway, not at the desk. Put the enforcement point where data leaves: the interface that posts to the payer portal, the HL7 or API bridge to the lab, the export that builds a research dataset. A disclosure without matching consent should fail or require a recorded override with a reason. Enforcing at collection cannot work, because the person at the desk does not know what will be needed in four days.
4. Versioned against the notice the patient actually saw. When the notice text changes, old consents remain valid for the text they were given. Storing the notice version with the consent is what lets you answer, years later, exactly what the patient was told.
5. Withdrawal that propagates. Withdrawal must be at least as easy as giving consent, and the hard part is downstream: something must stop the patient’s records flowing into the next research extract and must instruct partners who already hold the data. A withdrawal that only updates a flag in your own database is not complete.

Withdrawal does not erase a clinical record. Medical records are retained for the periods your establishment rules and accreditation standards require, and the Act’s erasure duty gives way where another law requires retention. What withdrawal must stop is the consent-based processing — the outreach, the research, the optional sharing — and the response to the patient should say plainly which records are being kept and why, rather than being a flat refusal.

The Act also provides for consent managers registered with the Data Protection Board, through which patients could manage consent across providers. The mechanics are still being worked out, so treat it as a direction to design toward: keep consent records in a layer that could later be reconciled with an external consent manager, instead of hard-coding them into HIS form fields.

Notice a patient in distress can actually read

Notice is where good intentions fail most visibly. A patient arriving for an emergency caesarean, or an attendant admitting a parent with chest pain, is not in a position to read nine hundred words of recipient categories. If that is your notice, the consent collected against it is weak, however many signatures it has.

What works is layering. The first layer is short — six or seven lines, in the patient’s language, on the form or the kiosk screen: what the hospital records, that it is used to treat them, that samples and images go to named categories of lab and imaging partners, that claim documents go to their insurer or TPA only if they agree, and that they can get a copy, correct it, complain, and refuse the optional items without affecting their treatment. The second layer is the full notice, on the website and as a leaflet, read aloud on request. The third layer is the point-of-use prompt, where most of the real work happens: claim consent at the insurance desk when the claim is raised, recording consent in the teleconsult app before the call starts, research consent discussed by a study coordinator in a room rather than at a counter.

• Separate the treatment consent from the data consent. They are different decisions and bundling them makes both weaker.
• Write at the reading level of your actual patient population, in the languages they actually speak, and keep translations as controlled versions rather than ad-hoc counter translations.
• Name recipient categories concretely — “the pathology laboratory that performs your tests”, “your insurer or its third-party administrator” — not “such third parties as may be required”.
• Delete “and any other purpose” from every form in the building. It is the clearest signal to a regulator that consent was not specific.
• Make the optional items visibly optional, with unticked boxes, and train the desk to say so out loud.
• Record who explained the notice, in which language and through which channel — that record is your evidence that consent was informed.
• Re-present optional consents at a calmer moment, such as pre-discharge, instead of treating the admission desk as the only opportunity.

The processors you have not papered

Hospitals remain accountable for what their processors do with patient data, and processor paperwork is the weakest part of almost every hospital estate we assess — because these relationships grew clinically rather than contractually. The reference lab arrangement is a rate card. The teleradiology service was introduced by a consultant. The HIS vendor’s support team has had remote access since go-live, under no agreement that mentions data at all.

The terms that need to exist are not exotic: a stated purpose and a prohibition on any other use; a security standard with named controls rather than a general assurance; named individual accounts instead of shared vendor logins; access logging you can obtain on request; approval required before sub-processing, with a current list of sub-processors; a deletion and return obligation at the end of the relationship with written confirmation; a breach notification duty with a timeline short enough that you can still meet your own; the right to audit or to receive an independent assessment; and a clear statement of where data is stored and processed.

Three awkward realities are worth naming. Large diagnostic chains and insurers will not sign your paper; the realistic path is to obtain their standard data terms, assess them against the list above, record the gaps as accepted risks with a named approver, and reduce what you send so the gap matters less. TPAs fit processor language badly, because they act on the insurer’s instruction and hold their own purpose — what you control is the consent you take, the channel you use, the documents you release and the register of what went where. And AI vendors frequently cannot answer the retention and training questions on a first pass, because the people selling the tool do not know. Get it in writing before deployment, and make deployment contingent on the answer.

Two operational habits do more than any clause. Move payer and lab exchanges off consumer email and messaging applications onto a logged channel, because misdirected records and forwarded reports are the most common hospital incidents after ransomware. And review privileged vendor access quarterly, with the expectation of replacing standing access with time-bound, approved sessions.

Emergency, incapacity and the limits of consent

Clinicians need to hear one thing clearly, because fear of the Act can do real harm: nothing here requires you to withhold treatment while hunting for a signature. The Act’s legitimate uses include a medical emergency involving a threat to life or an immediate threat to health, and the provision of medical treatment during an epidemic or other threat to public health. An unconscious trauma patient is treated, and their data processed for that treatment, without consent.

What compliance actually requires is discipline about the edges of that situation.

• Record the basis at the time. The record should show that the emergency basis was relied on, by whom, and when — not be reconstructed later from clinical notes.
• Treat it as temporary. When the patient regains capacity, give the notice and take consent for the processing that continues beyond the emergency, particularly claim disclosure and any optional item.
• Do not let it spread. An emergency admission does not create a basis for marketing, research or sharing with a wellness partner. This is the most common misuse of the exception.
• Separate incapacity from inconvenience. A conscious, competent adult whose attendant is doing the paperwork should still be asked; attendant-signed data consent for a competent patient is a weakness in a large number of admission files. The attendant’s own number and identity documents are their personal data, collected for contactability during the admission, and not a marketing list.
• Write down how capacity is assessed and by whom, for sedated, ventilated, delirious and psychiatric patients, and who may act for them — with the clinical and the data decision recorded separately.

Children, guardianship and records that outlive the arrangement

Paediatrics, neonatal intensive care, adolescent medicine and the care of adults with lawful guardians all sit in the part of the Act that deals with children and persons with disability, and it is stricter than general practice. Processing a child’s personal data requires the verifiable consent of a parent or lawful guardian, and the Act treats anyone under eighteen as a child — which includes the sixteen-year-old attending an adolescent clinic.

The operational questions a hospital must answer are these. How is the guardian relationship verified at registration, and what is accepted as proof? Which parent’s consent is recorded, and what happens in a custody dispute where one parent demands the record and the other objects? For an adolescent presenting alone for a sensitive service, what does the hospital do, and how is that reconciled with a guardian consent requirement and with the clinician’s duty of confidentiality to the young person? When the patient turns eighteen, who becomes the decision-maker, and does any system in the hospital notice the birthday? For an adult under guardianship, what document is held, when was it last checked, and does it cover data decisions or only clinical ones?

Two prohibitions are worth stating to marketing and digital teams before they build anything: tracking and behavioural advertising directed at children are off the table, as is processing likely to have a detrimental effect on a child’s wellbeing. A paediatric vaccination-reminder programme and a paediatric remarketing audience are not the same thing. The Act contemplates that some of these restrictions may be relaxed by rules for specified classes of fiduciaries and purposes, and healthcare is an obvious candidate — but until that is settled, design to the stricter reading. It is cheaper than retrofitting.

What is unsettled, and what to do anyway

We will be straightforward about the state of the law. The Act was passed in 2023; the operational detail lives in the Rules, and that detail has arrived in stages, with obligations phasing in over time rather than all at once. The mechanics of consent-manager registration, the precise form and timing of breach reporting, the criteria for being notified as a significant data fiduciary, and the scope of any relaxation of the children’s-data provisions for healthcare are among the items where the position has been moving. Get a current reading on those from your counsel rather than from a paper. We will tell you where our own reading is uncertain, and we are not going to quote a section number to sound authoritative.

You are also already bound by things that do not go away: your state’s clinical establishment rules, accreditation standards on records and confidentiality, telemedicine practice guidelines, the health data policy governing participation in the national health data ecosystem, insurance regulation reaching your payer flows, and sectoral incident-reporting duties. Some of the apparent conflicts — particularly erasure against medical-record retention — resolve cleanly once you separate clinical records from operational and marketing data and apply the right rule to each.

The open items do not block the work that matters. The flow map, the consent artefact design, the notice rewrite, the processor contracts, the access logging and the breach playbook are stable requirements under any reading of the detail, and none of them becomes wasted effort if a timeline shifts.

• Map the real flows for one high-volume service line end to end, including the external lab, the payer and every vendor with production access.
• Rewrite the admission notice as a layered notice in your patients’ languages, and remove every “any other purpose” clause.
• Split claim consent, recording consent, research consent and marketing consent out of the admission form into their own point-of-use artefacts.
• Move payer and lab exchanges onto a logged channel and keep a register of what was disclosed to whom.
• Put processor terms in front of your top vendors by data volume — HIS, cloud, external lab, teleradiology and any AI tool — and get written answers on retention and model training, treating silence as a no.
• Write a retention schedule that separates clinical records from camp, feedback, marketing and app analytics data.
• Stand up a rights-request desk with a named owner and an SLA, and test it with a dummy request before a real one arrives.
• Extend the breach playbook to cover vendor incidents, misdirected records and patient notification — not only IT recovery.

We do not publish invented case studies or compliance scores, and we will not tell you that a software purchase makes a hospital compliant. What we do is sit with your medical records officer, your billing head and your HIS administrator in one room for a week and produce the flow map, because every later decision depends on it. If what you need is outside our scope — a clinical-ethics question, an accreditation audit, or an opinion only your counsel should give — we will tell you on the call.