Here’s the full text — just select and copy:
Health Data Privacy: Knowing Your Rights Over Your Digital Health Records in Indian Hospitals
A patient’s guide to digital privacy rights under India’s evolving data protection law
Why Your Medical Records Deserve a Second Look
Think about the last time you walked into a hospital. Maybe it was for something minor, maybe not. Either way, by the time you left, a version of you existed on a server somewhere — your prescriptions, your scan results, your blood work, possibly even the insurance details you handed over at the front desk. Almost none of this happens on paper anymore.
That shift toward digital records has made healthcare faster and more connected, but it has also left a lot of patients wondering something simple: once my health information is typed into a hospital’s computer system, who actually controls it, and what say do I have in what happens to it next?
Few categories of personal data carry the weight that medical information does. A leaked salary figure is embarrassing. A leaked diagnosis can follow someone into a job interview, an insurance renewal, or a family conversation they never wanted to have. This is exactly why Indian law has started treating health data with a level of seriousness it didn’t get a decade ago — and why it’s worth understanding, in plain terms, what protections actually exist today.
How Indian Law Approaches Health Data Today
There isn’t a single, standalone law devoted to health records in India. Instead, patient data protection has emerged from a mix of constitutional principle, a new data protection statute, older IT rules that are still technically in force, and health-technology policy built specifically for hospitals and digital health platforms. It’s a layered system, and it’s still settling into its final shape.
The starting point: privacy as a fundamental right
In 2017, a nine-judge bench of the Supreme Court decided Justice K.S. Puttaswamy (Retd.) v. Union of India, ruling that privacy is protected under Article 21 of the Constitution as part of the right to life and liberty. That single judgment is the reason India has spent the years since building out a proper data protection framework, and medical information has always been treated as sitting close to the heart of what privacy is meant to protect.
The Digital Personal Data Protection Act, 2023, and its 2025 Rules
The DPDP Act, 2023 is India’s first full-fledged data protection law, and it applies directly to hospitals, diagnostic labs, insurers, and health-tech apps that handle patient information. For a long stretch after it was passed, though, the Act sat without the detailed rules needed to actually enforce it. That changed when the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 in mid-November 2025, finally giving the law operational machinery.
A few things stand out about how this framework treats patients:
- Consent has to mean something. Hospitals, referred to as “Data Fiduciaries” under the Act, are expected to collect clear, specific consent rather than relying on a blanket form signed at admission.
- Notices have to be honest and readable. The 2025 Rules require that patients be told, in plain language, exactly what data is being collected and why — a real departure from the dense fine print patients are used to signing without reading.
- Data can’t be repurposed freely. Information collected for treatment shouldn’t quietly end up feeding a marketing database or an unrelated research project without fresh consent.
- Breaches have to be disclosed. If a hospital’s systems are compromised, both the Data Protection Board and the affected patients must be informed within tight timelines, along with an explanation of what was exposed.
- There’s now somewhere to complain. The Data Protection Board of India is a new, fully digital body where patients can file and track grievances online, with appeals going to the Telecom Disputes Settlement and Appellate Tribunal.
- The penalties are serious. Failures around basic data security can attract fines running up to ₹250 crore, which is a meaningful incentive for hospitals to take this seriously rather than treat it as paperwork.
It’s worth being upfront about timing, though. Not everything is live yet. The Data Protection Board’s establishment took effect immediately, provisions around Consent Managers are expected to kick in around November 2026, and the bulk of substantive compliance duties for organisations aren’t scheduled to bind until May 2027. Until then, the older rules described below continue to do most of the heavy lifting. The Rules do carve out some sensible flexibility for hospitals too — for example, easing certain parental consent requirements in genuine clinical situations involving children, rather than forcing rigid consent steps into emergency care.
What’s still governing things in the meantime: the IT Act and the SPDI Rules
Until the DPDP Act’s core provisions are fully switched on, hospitals remain bound by the Information Technology Act, 2000 and the accompanying Sensitive Personal Data or Information Rules, 2011. These rules explicitly list physical and mental health conditions and medical records as “sensitive personal data,” which means hospitals handling this information are supposed to obtain written consent, publish a privacy policy, follow recognised security standards such as ISO/IEC 27001, and let patients review and correct their own records.
The digital health push: ABDM and the Health Data Management Policy
Alongside the privacy law itself, India has been building the Ayushman Bharat Digital Mission, which lets patients set up an ABHA — an Ayushman Bharat Health Account — that ties their records together across hospitals, labs, and pharmacies. The Health Data Management Policy that governs this ecosystem is built around patient consent from the ground up: data can only move between providers through Consent Managers, intermediaries that show patients exactly who has looked at their records and let them pull that access back at will. The policy also gives patients the right to access, correct, and carry their health information between providers, and it generally keeps health data stored within India rather than letting it drift overseas.
What doctors themselves are bound by
Separately from data protection law, the Indian Medical Council’s Professional Conduct, Etiquette and Ethics Regulations, 2002 place a direct duty of confidentiality on doctors, with only narrow exceptions such as a serious public health risk or a court direction. The Clinical Establishments Act, 2010, along with related state rules, adds another layer by requiring hospitals to maintain standardised records, which shapes how digital record-keeping is expected to work in practice.
What This Actually Means for You as a Patient
Strip away the legal detail, and here’s what a patient walking into an Indian hospital today can genuinely expect to be able to do:
- Be told what’s being collected. You should be informed, before your data is taken, what it is and why the hospital needs it — not have this buried inside a discharge form.
- See your own records. You can ask for copies of your medical history, lab results, and scans, and a hospital that stonewalls this without good reason can be challenged, both under medical ethics rules and increasingly under the DPDP framework.
- Fix what’s wrong. If your digital file has an error — the wrong allergy noted, an outdated diagnosis — you can ask for it to be corrected.
- Move your records with you. Through ABDM-linked systems, your health data is meant to travel with you between providers instead of being locked inside one hospital’s server.
- Take back consent. You can withdraw permission for a specific use of your data — say, sharing it with an insurer or a research team — though this won’t undo processing that already happened.
- Ask for deletion, within reason. Once the purpose your data was collected for no longer applies, you can request erasure, though hospitals may still have to hold onto certain records where the law requires it, such as in medico-legal cases.
- Be told if something goes wrong. If a hospital’s data is breached, you’re entitled to be informed and given guidance on what to do next.
- Have somewhere to take a complaint. Beyond a hospital’s own grievance officer, unresolved issues will increasingly be able to go to the Data Protection Board of India as its systems come fully online.
A Few Practical Habits Worth Building
- Actually read the consent form, especially any clause about sharing your data with insurers, outside labs, or research partners.
- If you have an ABHA ID, check which Consent Manager your hospital uses and glance over what permissions you’ve granted every so often.
- If a hospital is slow to hand over digital copies of your reports, put the request in writing — it creates a paper trail if things need to escalate.
- If you suspect your data has been exposed, report it to the hospital’s grievance or data protection officer and hold onto any evidence, like emails or screenshots.
- Before agreeing to something data-heavy, like a clinical trial, take a moment to actually look at the hospital’s privacy policy first.
Where This Leaves Things
India’s approach to health data privacy is still very much a work in progress. The DPDP Act and its 2025 Rules, sitting alongside the older IT Act framework, ABDM’s consent-first design, and long-standing medical ethics rules, are slowly pulling things toward a system where patients genuinely sit at the centre of their own data. But because the DPDP Act’s heavier obligations aren’t fully binding until 2027, patients today still need to lean on more than one framework at once to make their rights count.
The practical lesson is straightforward: your digital health record isn’t just something a hospital owns and manages however it sees fit. It’s your information, and the law — imperfect and still catching up as it is — already gives you real ground to stand on when it comes to notice, access, correction, and control. The rights exist on paper; using them is what makes them real.
