India's Digital Personal Data Protection Act: A Crucial Milestone for Healthcare Data Governance

Strategic Insights -

As India's healthcare system undergoes a digital transformation, hospitals are increasingly relying on digital platforms to provide efficient and individualized care. However, this shift has raised concerns about the security of private patient data. The Digital Personal Data Protection (DPDP) Act, 2023, is a significant step towards ensuring data governance in India, particularly for hospitals and healthcare providers that handle sensitive patient information.

Key Takeaways:

  • The DPDP Act, 2023, is India's first comprehensive data protection law, aimed at protecting the rights of data principals (patients) while placing responsibilities on data fiduciaries (hospitals, clinics, and digital health platforms).
  • Key provisions relevant to hospitals include obtaining explicit consent from patients for data collection and use, minimizing and limiting data storage, and providing patients with rights to access, correct, and erase their data.
  • Hospitals must implement systems for managing consent, ensuring data security, and notifying data breaches, as well as complying with third-party vendors that handle patient data.
  • The Act also requires data fiduciaries to appoint a Data Protection Officer (DPO) and establish a complaint mechanism for patients.

Statistics:

  • The DPDP Act applies to all digital personal information, including health records, diagnostic reports, prescriptions, and insurance information.
  • Patients have the right to access their health data and request corrections within 72 hours of the request.
  • Hospitals must destroy or anonymize patient data after three years, unless required by law.
  • Breach notifications must be made to the Data Protection Board and affected individuals within 72 hours of discovery.

Sources:

  • Digital Personal Data Protection Act, 2023
  • Clinical Establishments Rules
  • Aarna Law - www.aarnalaw.com