Skin
Free gap analysis · Hospitals

DPDP Gap Analysis for Hospitals and Healthcare Providers

Measure your hospital’s compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules. You get an overall score, the gaps found and the corrective steps for each.

Applicable to hospitals, multi-speciality and single-speciality clinics, nursing homes, day-care centres, diagnostic and imaging centres attached to hospitals, telemedicine services and other healthcare providers operating in India.

35 questions 8 sections 10–15 minutes No login needed
Progress 0 of 35 answered
Yes Fully implemented Partially Implemented, but gaps remain No Not implemented Not Applicable Does not apply
1. Governance and Accountability
01 Has the hospital assigned clear responsibility for compliance with the Digital Personal Data Protection (DPDP) Act, 2023 and Rules?
02 Has the hospital identified when it acts as a Data Fiduciary and when as a Data Processor, for example for visiting doctors, insurers, laboratories and government health programmes?
03 Are data protection responsibilities defined across clinical departments, medical records, billing, IT, front desk, pharmacy and other relevant teams?
04 Does management periodically review data protection risks, compliance gaps and corrective actions?
2. Patient Data Inventory and Mapping
05 Has the hospital identified the personal data it collects about patients, attendants, donors, employees, doctors and visitors?
06 Has the hospital documented the purposes for processing personal data, including registration, diagnosis, treatment, billing, insurance claims, research and marketing?
07 Has the hospital mapped how patient data flows between the Hospital Information System (HIS), laboratory, imaging, pharmacy, billing, insurers and external systems?
08 Does the hospital maintain an inventory of systems, medical devices, databases and vendors that store or process personal data?
09 Has the hospital identified personal data shared with insurers, Third Party Administrators (TPAs), referral doctors, laboratories, government health programmes and other recipients?
3. Notices, Consent and Legitimate Uses
10 Does the hospital give patients a clear privacy notice explaining what personal data is processed, why, and how they can exercise their rights?
11 Has the hospital identified which processing relies on consent and which on a legitimate use under the DPDP Act, such as a medical emergency or a legal obligation?
12 Is consent for data processing kept separate from consent to medical treatment, and recorded for each optional purpose such as research, health camps or marketing?
13 Can patients withdraw consent through accessible channels, and does the hospital stop the relevant processing unless another legal basis permits it?
14 Are notices and consent mechanisms consistent across registration desks, the patient app, the website, appointment call centres and health camps?
4. Health Records, Children and Representatives
15 Does the hospital apply stricter controls to especially sensitive records, such as mental health, HIV status, reproductive health and genetic information?
16 Does the hospital identify patients under 18 and obtain verifiable parental consent where the DPDP Act and Rules require it, applying the Rules’ exemptions for health services only where they apply?
17 Does the hospital verify the identity and authority of attendants, guardians and nominees before sharing a patient’s information with them?
18 Does the hospital control how patient data is shared through messaging apps, email and personal devices used by doctors and staff?
19 Does the hospital have a policy for patient data in research, teaching, case presentations and publications, including de-identification?
5. Patient Rights and Retention
20 Can patients obtain a summary of their personal data, correct or update it, and request erasure where the law allows?
21 Does the hospital have documented procedures for verifying, tracking and responding to patient requests and grievances?
22 Has the hospital defined retention periods for medical records, images, test results, billing records, CCTV footage and other personal data?
23 Does the hospital securely erase or destroy personal data, including paper files and films, when it is no longer required?
24 Can the hospital implement and verify deletion across its systems, backups and Data Processors?
6. Data Security and Breach Management
25 Has the hospital implemented appropriate technical and organisational security safeguards for patient data, including connected medical devices?
26 Is access to patient records role-based, limited to those involved in care or administration, and logged?
27 Does the hospital have documented procedures to detect, investigate, respond to and record personal data breaches, including ransomware?
28 Can the hospital notify affected patients and the Data Protection Board of India about personal data breaches within applicable statutory timelines?
7. Vendors, Insurers, AI and Cross-Border Processing
29 Does the hospital assess the data protection practices of vendors, such as the Hospital Information System (HIS) provider, laboratories, imaging, telemedicine and billing partners?
30 Do contracts with Data Processors include provisions for confidentiality, security, breach reporting and deletion of patient data?
31 Has the hospital assessed privacy risks of Artificial Intelligence (AI) diagnostic tools, clinical decision support, remote monitoring and telemedicine?
32 Has the hospital identified patient data processed or accessed outside India, such as cloud hosting, teleradiology or second-opinion services, and assessed DPDP restrictions?
8. Training and Compliance Monitoring
33 Are doctors, nurses, front desk, billing and support staff trained on their responsibilities under the DPDP Act?
34 Does the hospital assess privacy risks before introducing new systems, devices, apps or significant changes to patient data processing, including Data Protection Impact Assessments (DPIAs) where legally required?
35 Does the hospital periodically review its data protection controls, track corrective actions and maintain evidence of compliance?
Ready to see your report? Unanswered questions count as No. Your answers are used only to calculate this report. Nothing is stored.