Medical records can affect treatment, employment, insurance and identity fraud, so casual sharing has consequences beyond privacy.
Quick View
Separate clinical need, underwriting, claims and administration purposes before collecting or disclosing data.
Map medical data flows.
Consent and notice records.
Medical reports in email.
Why It Matters
The final Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025 with phased commencement. As of 25 June 2026, organisations should distinguish provisions already commenced from operational duties scheduled for later dates, while continuing to comply with the IT Act, CERT-In directions and sectoral rules already in force.
Health and insurance entities also operate under sectoral rules and policyholder-grievance frameworks, which continue independently of DPDP commencement.
Insurers, TPAs, hospitals, diagnostics, employers and wellness vendors should have clear roles and minimum-data exchange.
Control Framework
| Area | What to establish | Operating rule |
|---|---|---|
| Purpose | Treatment, underwriting, claim or benefit. | Avoid secondary reuse. |
| Access | Clinician, claims, HR or vendor. | Segment strictly. |
| Sharing | Insurer, TPA and hospital. | Use secure channel. |
| Retention | Medical, claim and legal period. | Document source. |
Action Checklist
- Map medical data flows.
- Separate HR from clinical access.
- Review TPA and wellness contracts.
- Secure claim uploads.
- Define retention and deletion.
- Create grievance and breach workflow.
Practical Example
Evidence to Keep
- Consent and notice records.
- Medical and claim files.
- Role-access matrix.
- Insurer and TPA agreements.
- Grievance tickets.
- Deletion and breach records.
Warning Signs
- Medical reports in email.
- Managers viewing diagnoses.
- Wellness vendor reuse.
- Unencrypted claim uploads.
- Indefinite rejected-claim documents.
Detailed Review
Privacy governance should connect the personal data, individual, purpose, collection point, system, owner, recipient, access role, retention trigger and incident dependency. A policy that cannot be traced to this chain is difficult to operate.
Create a dated legal matrix rather than one status label. Record the DPDP provision, commencement date, present readiness action, current IT or sectoral obligation and the evidence owner.
Design controls in the product and system. A written rule cannot stop an SDK from firing, a shared folder from exposing payroll, or a vendor from retaining deleted users unless technology and operations enforce it.
Evidence should be generated during normal work: versioned notices, event logs, access approvals, request tickets, deletion reports, vendor registers, incident chronologies and management decisions.
Use proportionate identity and security checks. Excess verification creates more personal data, while weak verification can expose another person’s records or permit account takeover.
Sectoral regulation continues independently of DPDP commencement. The operating process should satisfy both privacy and financial or identity-specific rules.
Customer-support scripts must never request passwords, PINs, OTPs or remote-control access.
Control Test
Test the control using a real user journey from collection to deletion. Capture the notice shown, data stored, vendors called, employees with access, retention period and response if the user withdraws or complains.
Run a negative scenario: the vendor is breached, the user is a child, the employee exits, the phone is stolen, the data was inaccurate or the regulator asks for proof. Record which control fails.
Check that system records and public wording agree. Product forms, privacy notice, CRM fields, SDK behaviour, vendor contracts and support scripts should describe the same processing.
Assign a named owner and internal deadline for every gap. A risk register without funded action and closure evidence becomes an archive of known failures.
Retain the rejected alternatives and decision basis. This is especially important where the law is in phased commencement or a proportionate technical method is selected.
Escalation Route
Start with the system owner, privacy or security owner and the documented data flow. Preserve records before making changes, and separate current statutory reporting from future DPDP readiness.
For a breach, financial fraud, rights dispute, children’s-data issue or regulated-sector event, involve qualified legal, cyber, forensic and sector specialists and use the applicable official reporting or grievance channel.
Management Review
Management should record the risk owner, affected data population, financial or operational impact, current legal duty, future DPDP milestone and funded remediation date. A privacy register without accountable closure is only a list of known gaps.
The control should be tested with evidence rather than self-certification. Use screen recordings, exported logs, access reports, deletion output, vendor responses, tabletop minutes or complaint acknowledgements to prove that the workflow operates as designed.
Where several laws apply, maintain one incident or request chronology but separate each legal trigger and deadline. CERT-In, RBI, UIDAI, IRDAI, police, contractual and DPDP processes should not be collapsed into one generic notification decision.
Common Questions
Can employers access employee diagnoses?
Access should be limited to a lawful and necessary purpose.
Who handles insurance complaints?
Use the insurer’s grievance process and applicable IRDAI route.
Should TPAs be treated as vendors?
Yes, with clear processing and security duties.
Are DPDP duties fully operative?
Check the phased commencement schedule while following existing sector rules.
Official Sources
- IRDAI — Policyholder protection and grievance redressal
- MeitY — Digital Personal Data Protection Act 2023 PDF
- MeitY — Digital Personal Data Protection Rules 2025
Use the latest commencement notifications, final Rules, CERT-In directions and sectoral regulator material. Applicability depends on dates, roles, systems, users and facts.