Health Data
Personal data about a person’s physical or mental health, treatment and medical history.
Health data is personal information about a person's body or mind: diagnoses, test results, prescriptions, insurance claims and even fitness-tracker readings. The DPDP Act treats it as ordinary personal data, but it is some of the most revealing data anyone holds.
Meaning of Health Data
There is no separate category in the DPDP Act, but health data is high-risk, so safeguards should match. Legitimate uses include medical emergencies and epidemics, and some child-data exemptions apply to health services.
Health data includes records made by doctors and hospitals, diagnostic reports, prescriptions, vaccination records, mental-health notes, insurance and claims data, and information from wearables and wellness apps. It can also be inferred: a pattern of pharmacy purchases or search queries for a medicine can point to a condition. The question under Section 2 is simply whether the data is about an identifiable individual.
The DPDP Act has no "sensitive" or "special category" list, unlike the GDPR and unlike the old SPDI Rules 2011, which listed medical records and history as sensitive. So health data follows the general scheme: notice under Section 5, consent under Section 6 or a legitimate use under Section 7, safeguards under Section 8(5), breach reporting under Section 8(6), and erasure under Section 8(7). Rule 6 expects safeguards in proportion to risk, and a hospital database carries a high one.
Two legitimate uses matter in healthcare. Section 7(f) allows processing to respond to a medical emergency involving a threat to life or immediate health, and Section 7(g) allows processing for measures against an epidemic or threat to public health. Rule 12 and the Fourth Schedule exempt clinical establishments, healthcare professionals and allied health services from the verifiable parental consent rule to the extent needed to provide health services to a child. These are narrow: a marketing email about a wellness package gets no cover from them.
Other regimes still apply under Section 38. Medical council rules on confidentiality, National Medical Commission telemedicine guidelines, IRDAI rules for insurers, and the ABDM framework for digital health records all contain obligations. Where a sector law requires you to keep records, Section 8(7) allows retention, but only for that period and purpose.
Examples of Health Data
A clinic stores prescriptions and lab reports. They get the same legal treatment as other personal data, with stricter practical controls.
A multi-speciality hospital finds that front-desk staff can open any patient's discharge summary. It introduces role-based access, enables audit logs and trains staff, so each lookup is traceable and linked to a care purpose.
An insurer's call centre asks claimants for medical history over the phone. It adds a short notice at the start of each call, restricts recordings to a secured store and deletes them after the dispute period in its retention schedule.
A fitness app collects heart rate, sleep and menstrual cycle data. It asks for separate consent before sharing any data with partner brands, makes sharing off by default, and lets users delete their history from within the app.
Why Health Data matters
A leak of health data can lead to discrimination in jobs, insurance and marriage, social stigma and emotional distress, so regulators treat it seriously. A failure of reasonable safeguards can cost up to ₹250 crore and a failure to report a breach up to ₹200 crore, both decided by the Board after an inquiry. Doctors' duty of confidentiality adds professional exposure.
Trust is the business case. Patients who fear that diagnoses will leak delay treatment or hide facts from the doctor. For health-tech start-ups and insurers, one incident can end partnerships with hospitals and employers.
How it works in practice
- 1Map where health data lives: hospital information system, lab software, staff WhatsApp groups, insurer portals, wearable-linked apps and paper files.
- 2Limit access by role. A receptionist does not need lab results. Keep access logs and review them, as Rule 6 expects logging and monitoring.
- 3Write a notice patients can follow, in plain language and local languages where needed. Say what is collected, why, who receives it (labs, insurers, TPAs) and how to withdraw consent or complain.
- 4Use emergency and public-health grounds sparingly and record why.
- 5Set retention by record type. Keep clinical records for the period medical rules require, delete marketing and enquiry data sooner, and de-identify data used for research.
- 6Control vendors tightly. Teleconsultation platforms, lab partners and cloud hosts need contracts covering security, breach alerts and deletion.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Thinking no special category means no special care. The law scales safeguards to risk, and health data sits at the top of that scale.
Sharing patient reports over personal WhatsApp or email accounts. Use secured, auditable channels.
Using the emergency ground for anything convenient. Section 7(f) applies only where there is a threat to life or immediate health.
Assuming de-identified data is automatically safe. If it can be linked back to a person, it remains personal data.
Compliance tips
Treat any health-related inference, such as a likely diagnosis from purchases, with the same care as a medical record.
Test your breach drill with a health scenario: who tells the patients, who tells the Board, who prepares the 72-hour report under Rule 7.
Encrypt backups and laptops used by doctors and field staff.
Check whether the Fourth Schedule exemption covers a given activity before relying on it.
Common questions about Health Data
Is health data sensitive under the DPDP Act?
The DPDP Act does not use the label sensitive. Health data is personal data with the same legal duties as others, though the practical standard of security is higher. The older SPDI Rules 2011 treated medical records as sensitive, and those rules are being replaced.
Can a hospital share patient data with an insurer?
It needs a lawful basis, normally the patient's consent given through a clear notice, and must share only what the claim needs. Sector rules from IRDAI and medical councils also apply. Hospitals should confirm the position for their own facts.
Do doctors need parental consent to treat a child?
Under Rule 12 and the Fourth Schedule, clinical establishments and healthcare professionals are exempt from the verifiable parental consent rule to the extent needed to provide health services to a child. The exemption is limited to that purpose.
Can I ask a clinic to delete my medical records?
You can request erasure under Section 12, but the clinic may keep records where another law requires it. Section 8(7) allows retention for that period. The clinic should tell you the reason and delete anything it no longer needs.