DPDP for Healthcare & HealthTech (2026): Emergency, IPD/OPD, Pharmacy & Breach

DPDP compliance for Indian hospitals, clinics, diagnostics, and HealthTech — emergency Sec 7 paths, IPD/OPD/pharmacy/lab consent, guardians for minors, secondary use, and clinical breach notification.

Answer in one line: Healthcare fiduciaries must treat clinical care (emergency, IPD, OPD, pharmacy, labs, billing/TPA), workforce, campus/CCTV, and vendor data as separate streams — with Section 7 “treat first” only for true emergencies, guardian consent for minors, fresh consent or anonymisation for secondary/AI use, and Board/patient intimation on breach without delay.

Aligned to the Health industry map in the DPDP Handbook.

Why healthcare is high-sensitivity under DPDP

Health data sits at the intersection of clinical duty, insurance networks, and digital products. A single HIS outage or lab vendor leak can trigger Board scrutiny and patient harm. Consent banners alone are not enough — you need a clinical purpose register and a rehearsed breach path.

Figure 1 — Hospital / HealthTech data map

Figure 1. Healthcare data map — clinical, workforce, campus, vendors

flowchart TD
  HUB([Hospital / HealthTech / diagnostic chain]) --> CLIN[Clinical care data]
  HUB --> WORK[Workforce data]
  HUB --> CAMP[Campus / access data]
  HUB --> VEND[Vendor / partner data]
  CLIN --> ER[Emergency / trauma]
  CLIN --> IPD[IPD / admission / OT]
  CLIN --> OPD[OPD / clinics / teleconsult]
  CLIN --> PH[Pharmacy / formulary]
  CLIN --> DX[Labs / imaging / pathology]
  CLIN --> BILL[Billing / TPA / insurance]
  WORK --> EMP[Employees / doctors / nurses]
  WORK --> CON[Contract staff / residents]
  CAMP --> VIS[Visitors / attenders]
  CAMP --> CCTV[CCTV / biometric gates]
  VEND --> LAB[Outsourced labs / cloud HIS]
  VEND --> TPA[TPA / insurers / device vendors]
  ER --> B7[Sec 7 - treat first then notice]
  IPD --> B6[Sec 5 notice + purpose consent]
  OPD --> B6
  PH --> B6
  DX --> B6
  BILL --> B6
  EMP --> BHR[Employment notice + basis]
  CON --> BHR
  VIS --> BVIS[Visitor notice + short retention]
  CCTV --> BVIS
  LAB --> BDPA[DPA + breach SLA Sec 8-2]
  TPA --> BDPA
  B7 --> AGE{Patient under 18?}
  B6 --> AGE
  AGE -->|Yes| GUA[Verifiable guardian consent]
  AGE -->|No| REG[(Clinical + consent register)]
  GUA --> REG
  BHR --> REG
  BVIS --> REG
  BDPA --> REG
  REG --> SEC{Secondary use?}
  SEC -->|Research / AI / marketing| FRESH[Fresh consent OR anonymise]
  SEC -->|Care continuity only| KEEP([Stay within original purpose])
  FRESH --> REG
  REG --> DSR{DSR / discharge / retention end?}
  DSR -->|Yes| OUT([Erase or archive per clinical schedule])
  DSR -->|No| REG
  class HUB,CLIN,WORK,CAMP,VEND,ER,IPD,OPD,PH,DX,BILL,EMP,CON,VIS,CCTV,LAB,TPA,B7,B6,BHR,BVIS,BDPA,GUA,FRESH act;
  class AGE,SEC,DSR dec;
  class REG start;
  class KEEP,OUT ok;
  classDef start fill:#DBEAFE,stroke:#2563eb,color:#0f172a;
  classDef act fill:#EFF6FF,stroke:#3B82F6,color:#1e3a8a;
  classDef dec fill:#FEF3C7,stroke:#D97706,color:#78350f;
  classDef ok fill:#D1FAE5,stroke:#059669,color:#064e3b;
  classDef stop fill:#FEE2E2,stroke:#DC2626,color:#7f1d1d;
  classDef note fill:#F1F5F9,stroke:#64748B,color:#334155;

Operating rules clinicians and ops can follow

Emergency / trauma: treat first under Sec 7 where applicable, then notice as soon as practicable.
IPD / OPD / pharmacy / labs / billing: Sec 5 notice + purpose-bound consent; limit secondary marketing.
Under 18: verifiable guardian consent before non-emergency digital processing.
Research / AI / marketing: fresh consent or effective anonymisation — not silent reuse of care data.
Vendors: outsourced labs, cloud HIS, TPA — DPAs and breach SLAs under Sec 8(2).

Figure 2 — Clinical personal-data breach path

Figure 2. Healthcare breach notification — patients, Board, 72-hour detail

flowchart TD
  A([Breach detected in HIS / lab / TPA]) --> B[Contain and assess clinical impact]
  B --> C[Intimate affected patients without delay]
  B --> D[Intimate Board - initial without delay]
  D --> E[Detailed Board report within 72 hours]
  C --> F[Remediate + root cause + vendor notice]
  E --> F
  F --> G([Retain evidence 1 year plus])
  class A stop;
  class B,C,D,F act;
  class E dec;
  class G ok;
  classDef start fill:#DBEAFE,stroke:#2563eb,color:#0f172a;
  classDef act fill:#EFF6FF,stroke:#3B82F6,color:#1e3a8a;
  classDef dec fill:#FEF3C7,stroke:#D97706,color:#78350f;
  classDef ok fill:#D1FAE5,stroke:#059669,color:#064e3b;
  classDef stop fill:#FEE2E2,stroke:#DC2626,color:#7f1d1d;
  classDef note fill:#F1F5F9,stroke:#64748B,color:#334155;

Healthcare checklist

Label HIS modules by purpose and retention (clinical schedule vs marketing).
Separate visitor CCTV and biometric gate notices from clinical consent.
Train front desk and ER on when Sec 7 applies vs routine OPD consent.
Run a tabletop: lab vendor leak affecting 10,000 reports.
Publish grievance / DSR channels patients can actually use.

FAQ

Does emergency care need consent before treatment?

Life-saving processing can proceed on legitimate use where the Act allows; document the basis and serve notice when the patient or guardian can receive it.

Can we use OPD data to train an AI triage model?

Only with a lawful secondary basis — typically fresh consent or anonymised datasets that no longer identify the data principal.

Who notifies the Board if a TPA is breached?

The fiduciary remains accountable. Contracts must force rapid vendor notice so you can intimate patients and the Board without delay.

What should HealthTech product teams ship first?

Purpose-level consent, age/guardian gates, audit logs, and the breach runbook — then deepen RoPA with PII discovery.