What Is the DPDP Act 2023 for Hospitals?
The Digital Personal Data Protection Act 2023 is India's data-privacy law, and it classifies hospitals as "Data Fiduciaries" responsible for how patient data is collected, stored, and shared. For a hospital, this means explicit consent logging before sharing diagnostic or prescription records, a complete audit trail of which staff member accessed which patient's file and when, and strict access controls so third-party vendors or unrelated staff can't view patient identifiers they have no reason to see.
What This Looks Like in Software, Not Just Policy
A DPDP-aligned HMS enforces these rules at the system level rather than relying on staff discipline: every record view or edit is logged with a user ID and timestamp, consent is captured before records leave the hospital's system, and data access is scoped to each staff role by default rather than open by default.