The recent conversation over the merchant discount rate on select UPI transactions raised the question of who pays for the digital convenience that millions of people enjoy. Hospitals may soon face a similar problem for strengthening their privacy even if no separate “privacy charge” appears on a patient’s bill.
Protecting digital patient information will require secure systems, trained personnel, and continuous compliance. Parliament enacted the Digital Personal Data Protection (DPDP) Act 2023 in response to this need. The Act consists of 44 sections in nine chapters plus one Schedule. The government notified its Rules on November 13, 2025, with the Sections pertaining to provisions for consent managers set to kick in from November 13, 2026. The rest of the substantive obligations will start to apply from May 13, 2027.
Unusually difficult places
The Act is a general framework to protect digital personal data across sectors, including healthcare. In healthcare, the Act recognises that clinical consent and data consent are different. For example, a person agreeing to undergo a medical scan does not automatically mean they have agreed to every later use of the same scan, no matter how useful the hospital or doctors deem the scan data to be. While facilitating this distinction, the Act also makes room for data-processing during emergencies and specific medico-legal and public health situations.
Under the DPDP Act, the patient is the data principal (or owner) and the hospital — which usually decides why and how some information will be used — is the data fiduciary. Some external software, cloud, and/or data-processing company will serve as the data processor.
That said, hospitals are unusually difficult places in which to ensure compliance with a general data-protection law. Unlike banks or regional transport offices, hospitals continuously create information of an intimate nature. For example, healthcare workers record a patient’s clinical notes, nursing observations, diagnostics and laboratory results, ventilator readings, and prescriptions — all within hours.
At the same time, several professionals will need to access different parts of that record at different times. If access is too tightly controlled, patient care may suffer; on the other hand, unrestricted access can result in significant breaches of privacy. So the Act needs to facilitate the lawful processing of consent with reasonable security safeguards, grievance handling processes, and of course the correction or erasure of data where permissible.
Failure to take reasonable safeguards can attract a penalty of up to ₹250 crore.
Compliance costs
In the same vein, compliance requires hospital information systems with role-based access, facility to encrypt or mask data as necessary, systems to generate and preserve audit logs, backups, vendor contracts, breach response protocols, staff training, and a clearly identified person who is responsible for data governance.
Entities designated data fiduciaries must also appoint a statutory data protection officer, and smaller hospitals will need a privacy or data management lead in practice.
Further, information rarely stays within the hospital, since a cashless claim can send diagnoses and reports to an insurer or a third party administrator. Laboratories, radiology platforms, cloud vendors, and telemedicine services will create additional routes for the same record. Even low-cost WhatsApp-based workflows that became popular because they were convenient will have to be examined for compliance and security.
Healthcare may therefore need specific DPDP provisions, either explicitly or eventually as a separate Act, to cover sector-specific uniqueness, such as small hospitals and large hospitals separately, as clinical care is more than a commercial transaction.
Lesson from Chandigarh
U.S. estimates show the cost of complying with the famed Health Insurance Portability and Accountability Act, or HIPAA, to be around $5 per patient a year in 2008. Estimates for 2025 suggest the cost of $498 per affected record.
In a 2023 study, researchers from India and Norway estimated that adding an integrated information and communications system to an urban primary health centre (PHC) would expand the centre’s annual economic budget by 17.7%. But when the researchers applied the same model across 400 PHCs, the incremental cost fell to about 6% per PHC. The reason: common development and infrastructure costs were shared.
The finding offers an important policy clue: the government should not expect every small hospital, diagnostic centre, and/or PHC to independently purchase the same privacy tools, legal templates, and so on.
That said, the harder problem is that India has legislated faster than it has trained the people who must make the law work. Medical education teaches confidentiality and ethics, but there is no uniform DPDP-oriented National Medical Commission curriculum or standard course materials that span medicine, nursing, allied health, hospital administration, and healthcare IT training.
The vendor side faces the same problem: behind every software workflow is a human being who configures access, checks claims, handles support or views data. And an untrained person handling data in a hospital can pave the way for a major breach due so little as to one leaked password. So data literacy has to become a core healthcare competency.
Building an ecosystem
The National Health Accounts 2022-23 released this year estimated the out-of-pocket expenses on healthcare to be 43.4% of total health expenditure. There is a nontrivial chance that the new costs of complying with the DPDP Act will be passed on to patients as well.
Ahead of the November 13 date, the Indian government should step in by enabling a shared infrastructure through the Unified Health Interface of the Ayushman Bharat Digital Mission. It could provide model consent and vendor agreements with affordable cybersecurity support, and healthcare-specific implementation standards.
User data is routinely commoditised today, and passing a law assuming compliance and waiting for complaints or litigation will not suffice. As the DPDP Act comes into effect, the government must finance, build, and sustain an ecosystem that allows every health worker to comply and patients to be able to better access care.
Dr. C. Aravinda is an academic and public health physician. Views expressed here are personal.
Published – October 26, 2026 09:00 am IST
