Patient data privacy in hospitals is decided less by the hospital information system (HIS) than by the WhatsApp groups, personal phones and spreadsheets around it. From 13 May 2027, India’s Digital Personal Data Protection Act, 2023 (the DPDP Act), the law governing how businesses use digital personal data, holds the hospital responsible for all of it. That informal layer is where compliance breaks, and every slip there is a breach the hospital must report. A|P’s reading, not settled law; confirm with counsel.

Take a 90-bed private hospital in Ludhiana. Discharge summaries go out on the ward’s WhatsApp group, the OT list sits on a consultant’s phone, pre-authorisation requests leave the front desk by email, and billing runs on an Excel sheet. None of that is in the HIS, and all of it is patient data. It is the side of digital transformation in healthcare that rarely appears in an HIS project plan.

This is the first Provider piece in A|P’s DPDP series. The series guide page, The DPDP Act and Rules for Indian healthcare businesses, holds the timeline and the notifications to watch.

Why does the informal layer count under the DPDP Act?

From 13 May 2027, the Act applies to digital personal data, whether collected in digital form or “collected in non-digital form and digitised subsequently” (s.3(a)). A WhatsApp message, an Excel sheet and a scanned admission form are all inside it. A paper register stays outside until someone photographs or types it. A|P’s reading, not settled law; confirm with counsel.

The hospital decides why that data is processed, so it is the data fiduciary for all of it (s.2(i)). A nurse forwarding a report from her own phone is processing the hospital’s data for the hospital’s purposes. The device being personal does not move the duty off the hospital. A|P’s reading, not settled law; confirm with counsel.

Where does patient data live in a private hospital?

A|P reads a hospital the way it reads any business, department by department, the lens behind its work on operational excellence for private clinics and hospitals in India. Applied to patient data, the lens shows the same pattern in almost every department: a formal system, an informal layer beside it, and a list of outsiders who receive copies. The map below is illustrative. A|P’s reading, not settled law; confirm with counsel.

Department	Formal system	Informal layer	Who else receives it
Front desk and OPD	HIS registration	Register photos, appointment WhatsApp	Referral doctors
Wards and IPD	HIS clinical notes	Ward WhatsApp groups, nurses’ phones	Visiting consultants
OT and consultants	HIS scheduling	Consultants’ phones, OT list photos	Anaesthetists, implant vendors
Lab and radiology	Lab system, PACS	Reports sent on WhatsApp	Patients, outsourced labs
Billing and TPA desk	HIS billing	Excel sheets, email	TPAs, insurers
Patient relations	CRM, if any	Follow-up lists in spreadsheets	Messaging vendors

OPD and IPD here mean the outpatient and inpatient departments: patients treated without admission, and patients admitted for care. A TPA is a third party administrator, a company registered with the insurance regulator IRDAI that handles health insurance claims for insurers.

Why can’t WhatsApp groups in hospitals meet the security rules?

From 13 May 2027, a hospital must take reasonable security safeguards (s.8(5)), and Rule 6 of the DPDP Rules, 2025 sets the minimum. Its minimums include access control on the computer resources used, logs of who accessed the data with monitoring and review, and those logs kept for a year (Rule 6(1)(b), (c), (e)), alongside encryption or masking and backups (Rule 6(1)(a), (d)).

A ward WhatsApp group fails each test. The hospital does not control the phones, cannot see who opened a report, and cannot remove a former employee’s copy of three years of discharge summaries. A spreadsheet emailed between desks fails the same way. A|P’s reading, not settled law; confirm with counsel.

The fix is rarely a ban. It is moving the highest-risk flows, reports and discharge summaries first, into a channel the hospital controls and can log. A|P’s guide to NABH digital health accreditation for hospitals covers how NABH, the National Accreditation Board for Hospitals & Healthcare Providers, assesses access control, a practical benchmark for the same work.

Is a report sent to the wrong number a data breach?

Yes, on the Act’s wording. A personal data breach includes “accidental disclosure” of personal data (s.2(u)), and the Rules set no minimum size before the duty to report applies. A lab report sent to the wrong WhatsApp number, a discharge summary forwarded to the wrong group and a lost phone holding patient photos are all breaches. A|P’s reading, not settled law; confirm with counsel.

From 13 May 2027, the hospital must tell each affected patient without delay, and give the Data Protection Board of India, the regulator, a first intimation without delay and a detailed report within 72 hours (s.8(6); Rule 7). The Schedule to the Act allows penalties, also from 13 May 2027, of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to report a breach.

One clock already runs. CERT-In’s directions of 28 April 2022, issued under IT Act s.70B(6), require any body corporate to report listed cyber incidents, including data breaches and data leaks, to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of noticing them. A|P’s reading, not settled law; confirm with counsel.

Why does the hospital need to know who receives the data?

From 13 May 2027, a patient who gave consent, or who provided the data voluntarily for a specified purpose, can ask the hospital for “the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared”, with a description of what was shared (s.11(1)(b), s.7(a)). The hospital cannot answer that without a list of every recipient: TPAs, insurers, outsourced labs, referral doctors and the vendors behind its systems.

From 13 May 2027, where the hospital discloses data to another fiduciary, such as an insurer settling a claim, it must also ensure that data is complete, accurate and consistent (s.8(3)). Whether visiting consultants and TPAs act as fiduciaries or processors in each flow is not settled. A|P’s reading, not settled law; confirm with counsel.

What applies before 13 May 2027?

Until then, health data held by a body corporate is governed by section 43A of the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the SPDI Rules). They treat medical records as sensitive personal data (rule 3), require prior permission before disclosing it to a third party (rule 6) and treat a body corporate as having reasonable security practices if it runs a documented information security programme (rules 5(8), 8(1)).

Whether a trust- or society-run hospital is a body corporate depends on how it is constituted. Sharing a patient’s report with a referral doctor on a WhatsApp group may already be a disclosure that needs permission under rule 6. Doctors also owe confidentiality under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002(reg. 7.14). A|P’s reading, not settled law; confirm with counsel.

How to build the map in a week

None of this needs outside help to start, and it uses only what the hospital already knows.

1. Name one owner per department. The person who runs the desk, not IT.
2. List every place patient data is kept. The HIS module, plus every WhatsApp group, shared phone, spreadsheet, email inbox and scanned folder.
3. List every recipient. Each TPA, insurer, lab, referral doctor and vendor, and what each receives.
4. Mark what cannot meet Rule 6. Any store without access control, access logs, one-year log retention, encryption or backups.
5. Move the riskiest flow first. Usually lab reports and discharge summaries sent on WhatsApp.

Which channel goes first?

Back to the Ludhiana hospital: for patient data privacy in hospitals of its size, the HIS is rarely the weak point. The ward groups, the consultant’s phone and the billing sheet are, and each carries the hospital’s name on any breach. The decision for its owner is which informal channel to retire first, and which to keep under controls the hospital can show.

Next in the series: consent or “voluntarily provided”? Designing patient intake under the DPDP Act.

Frequently asked questions about patient data privacy in hospitals

Can hospitals share patient reports on WhatsApp under the DPDP Act?

The Act does not ban any app, but from 13 May 2027 the hospital must meet Rule 6’s security minimums wherever it processes patient data. WhatsApp groups and staff phones make access control and access logs hard to show. A|P’s reading, not settled law; confirm with counsel.

Is a lab report sent to the wrong patient a data breach?

Yes, on the Act’s wording, because a personal data breach includes “accidental disclosure” (s.2(u)). From 13 May 2027 the hospital must tell the patient and the Board, and it must already report data leaks to CERT-In within 6 hours. A|P’s reading, not settled law; confirm with counsel.

Do paper medical records come under the DPDP Act?

Not while they stay on paper. From 13 May 2027, the Act covers personal data collected in digital form or digitised later (s.3(a)), so a scanned or photographed record is covered. A|P’s reading, not settled law; confirm with counsel.