The DPDP Act for Clinics: Patient Data Rules Every Practice Must Follow

Does the DPDP Act apply to my clinic? Yes. If you store patient names, numbers, histories or photos — on software, on paper, or in the receptionist's phone — you are a "data fiduciary" under the Digital Personal Data Protection Act, and the law expects you to handle that data properly. The penalties headline in crores, but the real daily risk is simpler: patient trust, once lost over a data slip, rarely comes back.

This is the plain-language version for practice owners. It's education, not legal advice — for specific situations, ask a lawyer.

What counts as patient data? (More than you think)

• The obvious: names, phone numbers, addresses, medical records, reports, prescriptions.
• The forgotten: appointment lists on WhatsApp, photos on the clinic camera roll, the Excel sheet of old patients, call recordings, CCTV footage.
• The sensitive core: health information itself. A person's diagnosis deserves the highest care your practice can give it — legally and morally.

What does valid consent actually mean?

Consent under DPDP must be free, specific, informed and revocable. In clinic terms: the patient knows what you're collecting, why, and can say no — and saying no to marketing can't affect their treatment. A line buried in the registration form saying "we may use your data" doesn't meet the bar. Separate purposes need separate consent: treating a patient is one purpose; messaging them offers is another; using their photo is a third. Our testimonial consent playbook already runs on this standard — DPDP makes it law, not just good practice.

What does this mean for clinic marketing?

Most of what good clinics already do remains fine — with gates. Appointment reminders and health education to your own patients: fine, with consent collected at registration. WhatsApp follow-ups: fine, with an easy opt-out honoured immediately. Buying patient lists, sharing data with third parties for ads, or building ad audiences from health conditions: stop. For sensitive specialties, the bar rises further — mental health practices should treat every data decision as if the patient's most private fact were at stake, because it is.

The five habits of a compliant clinic

• 1. Map your data once: list every place patient information lives — software, sheets, phones, drawers. You can't protect what you haven't mapped.
• 2. Collect less: every field you don't collect is a risk you don't carry. Does the inquiry form really need a full address?
• 3. Gate the phones: clinic data on personal phones is the most common leak. Use the clinic's WhatsApp Business account, not staff personal numbers.
• 4. Honour deletion: when a patient asks you to delete their data, you need a way to actually do it — subject to medical record-keeping rules, which still apply.
• 5. Name an owner: one person in the practice owns data protection. Usually the practice manager. Without an owner, it's nobody's job.

What about the software and vendors you use?

Your clinic software, lab portal, billing app and messaging tools all process patient data on your behalf — and under DPDP, you remain responsible for what they do with it. The practical questions to ask every vendor once: where is the data stored, who can access it, is it encrypted, what happens when we leave, and will you notify us of a breach? Reputable Indian healthcare software answers these in writing. A vendor that can't answer is a risk you're carrying unknowingly. Same logic applies to marketing tools: an agency running your ads or managing your inquiries must handle patient data under your rules, in your accounts — never exported into theirs.

If something goes wrong: the breach basics

A lost phone with patient chats, a staff member emailing a list out, software hacked — breaches happen to careful practices too. The law expects notification of the Data Protection Board and affected patients; your practical playbook is simpler to remember: contain it (lock the account, wipe the device), record what happened and when, inform honestly, and fix the gap that allowed it. Practices that respond fast and tell patients the truth keep their trust surprisingly often. The ones that hide it, don't. One tabletop drill a year — "what would we do if the reception phone vanished today?" — costs an hour and is worth every minute.

Where to start this month

Do the data map (one hour), add a proper consent section to your registration form, and move patient chats to the clinic's official WhatsApp. Those three steps close most of the everyday risk. Then fold data protection into the same compliance habit that governs your advertising — one review, every campaign, every form.

In short: DPDP makes patient-data care a legal duty, and the habits are simple once mapped. The free practice audit includes a basic data-handling check alongside the marketing review.