Under India's Digital Personal Data Protection (DPDP) Act, a clinic is a data fiduciary: legally accountable for the personal data it collects — and patient health records are about as personal as data gets. In practice, compliance for a clinic reduces to a short list: collect data for a stated purpose with proper notice, protect it with reasonable security safeguards, don't keep it past its purpose, and be able to show who accessed what. (This is an operational guide, not legal advice — confirm specifics for your clinic with counsel.)
What the DPDP Act expects of a clinic
- Notice and consent. Patients should know what data you collect and why. For clinics, most processing is straightforwardly tied to care — but the notice still has to exist.
- Purpose limitation. Data collected for treatment is for treatment. Reusing patient contact data for unrelated marketing without consent is exactly the pattern the law targets.
- Reasonable security safeguards. This is the clause with teeth — and financial penalties behind it. "We kept it in a shared spreadsheet" is not a safeguard.
- Accountability. When something goes wrong, the questions are: who had access, what was accessed, and can you prove it?
The controls that satisfy "reasonable safeguards"
- Role-based access. Reception sees scheduling, pharmacy sees dispensing, doctors see their patients. Nobody sees everything by default. Granular, role-based access control is the control regulators and auditors look for first.
- Real authentication. Individual logins with token-based sessions that expire — never shared passwords. And when someone's role changes or they leave, access should update immediately, not at next login.
- Encryption in transit and at rest. TLS on every connection; encrypted storage underneath. With a credible cloud platform this is inherited rather than built.
- An audit trail. A record of who did what, when. Without it, you can't demonstrate compliance even when you were compliant.
- Backups you don't manage by hand. Data loss is a compliance failure too. Automatic cloud backups beat the external hard drive in the drawer.
The uncomfortable comparison
Clinics on paper files and spreadsheets aren't exempt from the law — they're just unable to implement most of the controls above. A shared workbook has no roles, no audit trail, and no way to prove who changed what. Moving to a proper platform is often the compliance step, not a precursor to it.
FalconCare ships these controls as standard: granular role-based access, token-based authentication with automatic expiry and real-time permission propagation, TLS with encryption at rest, and route-level protection throughout. For the security architecture behind cloud EMRs, see securing patient EMR data in the cloud. Or talk through your clinic's setup.