For hospitals & clinics
DPDP Compliance for Hospitals and Clinics: Your Checklist Before 13 May 2027
There is no healthcare-specific extension, and the deadline is about seven months away. An 8-point checklist covering consent, security, breach reporting, ABDM and NHCX.
- Written by
- MyMedicare Editorial Team
- Published
- Reading time
- 1 min read
Every hospital, clinic, lab and pharmacy that handles patient data is a Data Fiduciary under the DPDP Act. Full compliance is due by 13 May 2027, with no healthcare-specific extension. That's about seven months away.
The 8-point checklist
- 1Map your data: where patient data lives (HMS, paper, WhatsApp, Excel, lab machines).
- 2Consent notices: clear, purpose-specific, in English and the local language.
- 3Security safeguards: encryption, access control, access logs, backups.
- 4Log retention: keep logs for at least 1 year.
- 5Dual breach reporting: 6 hours to CERT-In and 72 hours to the Data Protection Board, plus notifying affected patients.
- 6Patient rights workflow: access, correction and erasure handled within 90 days, balanced against medical-record retention laws.
- 7Vendor contracts: your software, lab and cloud vendors must meet the same standards.
- 8Grievance officer: named contact, published on your website.
Don't forget ABDM and NHCX
- ABDM: register on the Health Facility Registry (HFR) and link care contexts to patient ABHAs. Over 5.8 lakh facilities have already been verified.
- NHCX: the National Health Claims Exchange standardises insurance claims (FHIR format). 83 payers were registered by April 2026, and IRDAI is discussing incentives for faster settlement.
How MyMedicare helps partners
One ABDM-ready platform for OPD, live queues, e-prescriptions, lab, pharmacy and billing, with consent-based record sharing built in. No joining fee. No commission.
Book a demo