Patient Records and the DPDP Act: What Clinics Should Change Now
Published: 10/9/2026
Category: Healthcare
Clinics hold some of the most sensitive personal data in any small business. Practical changes for patient records, prescriptions, WhatsApp reports and staff access ahead of DPDP obligations in 2027.
A small clinic holds names, phone numbers, addresses, diagnoses, prescriptions and lab reports: some of the most sensitive data any business keeps. Under India's DPDP law, with most obligations taking effect around May 2027, clinics need to show that patient data is collected for a clear purpose, protected and handled responsibly. Most changes are habits, not expensive systems.
Where patient data leaks in small clinics
- Reception registers left open on the counter
- Prescriptions and reports sent from the doctor's or receptionist's personal WhatsApp
- Shared computer logins at reception
- Reports saved on phones and in personal Google Drive
- Old files and printouts thrown away without shredding
Seven practical changes
- Use the clinic's own number for WhatsApp communication, not staff personal numbers. When staff leave, patient chats stay with the clinic.
- Individual logins for every staff member, with access by role: reception sees appointments and billing; doctors see clinical notes.
- Tell patients what you record and why, on the registration form or a notice at reception, and how they can contact you about their data.
- Take consent for non-essential uses, such as health camp invitations or promotional messages. Appointment reminders and reports are part of care; marketing is not.
- Share reports securely. A link or app with access control is better than forwarding PDFs from personal phones.
- Shred paper records you no longer need to keep, following medical record retention rules.
- Plan for a lost phone or hacked account: who changes passwords, who informs patients and the authorities.
What to keep, and for how long
Medical records have retention expectations from medical regulations and state rules, separate from DPDP. Follow those for clinical records, and do not keep unrelated personal data (like old marketing lists) longer than needed. Ask your professional body or advisor about the periods that apply to you.
ABHA and digital records
If your clinic links records to patients' ABHA (Ayushman Bharat Health Account), patients control consent for sharing through the ABDM framework. That aligns well with DPDP principles. Integrating is optional for most private clinics today, but worth considering as you digitise.
Where BizFlow fits
BizFlow's OPDFlow keeps patient records, prescriptions and billing in one system with role-based staff access, sends appointment reminders from the clinic's number and avoids reports scattered across personal phones. See digital prescription software.
General information, not legal or medical-regulatory advice.
Frequently asked questions
Q: Can clinics send reports to patients on WhatsApp?
A: Many do. Use the clinic's own business number, send only to the patient (or someone they authorised) and prefer secure links over forwarding files from personal phones.
Q: Does the DPDP Act apply to small clinics?
A: Yes. It applies to any business processing digital personal data, regardless of size. Health data needs particular care.
Sources
Home | Blog