Healthcare gets privacy backbone, but devil is in details, Pg9

Key Highlights:

• The Digital Personal Data Protection (DPDP) Rules, 2025 have enacted parts of the DPDP Act, 2023, initiating a significant privacy reform.
• The Act impacts the healthcare sector, designating all clinics, hospitals, labs, and telemedicine apps as data fiduciaries.
• Patients, now termed data principals, gain rights to access, correct, and erase their medical information.
• The Act permits data processing without consent during medical emergencies and public health crises.

Detailed Insights:

• The DPDP Act aims to minimize data collection and retention, allowing individuals to withdraw consent or seek data deletion, which poses challenges for healthcare due to treatment responsibilities.
• The definition of "processing" includes erasure and destruction, potentially requiring patient consent even for data deletion, raising questions about data retention timelines for healthcare providers.
• The absence of specified data retention norms for medical data in Schedule III of the Rules creates uncertainty for hospitals and may leave patients vulnerable.
• Section 5(2) of the Act mandates notifying data principals about their rights for data collected before the Act's commencement, but lacks a time limit for this look-back period, potentially encompassing all digitized data.
• The Act intends to provide Indian healthcare with a privacy framework, emphasizing patient data rights and provider duties of digital care, suggesting the need for sector-specific rules.

Key Concepts Involved:

• Data Fiduciary: Any entity that processes personal data.
• Data Principal: The individual to whom the personal data relates.
• Data Processing: Any operation performed on personal data, including collection, storage, and erasure.