Health and Insurance Data: Medical Records, Claims and Privacy Controls
A health and insurance data framework for medical records, underwriting, claims, TPAs, hospitals, wellness apps and policy wording.
A medical record may be needed for underwriting or a claim, but that does not justify broad access by every sales agent, employer or vendor.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Health and insurance processing should map to the proposal, policy, underwriting, service, claim and regulatory purpose.
The issued policy wording and insurer or TPA process determine what records are contractually required; privacy controls should not conceal material facts.
Insurers, TPAs, hospitals and wellness vendors may have different roles and legal duties.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Health and insurance processing should map to the proposal, policy, underwriting, service, claim and regulatory purpose.
- The issued policy wording and insurer or TPA process determine what records are contractually required; privacy controls should not conceal material facts.
- Insurers, TPAs, hospitals and wellness vendors may have different roles and legal duties.
- Medical, genetic, prescription and claim data need strong access and security because misuse can cause serious harm.
The five-point review
| Check | What to examine |
|---|---|
| Purpose | Underwriting, treatment, claim or fraud. |
| Minimum data | Relevant diagnosis, period and document. |
| Recipient | Insurer, TPA, hospital, employer or vendor. |
| Authority | Consent, policy, law or regulator. |
| Retention | Policy, claim, dispute and medical record. |
Practical example
An employer receives full hospital records for a group-health reimbursement though the insurer and TPA can decide the claim. The employer may need only claim status or payroll information.
How to apply the framework
Create a claim-document matrix from policy wording and insurer process.
Restrict TPAs and wellness vendors from unrelated analytics, advertising or product solicitation.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review purpose, minimum data and recipient together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Map the data journey.
- Use policy-specific documents.
- Restrict employer access.
- Log medical access.
- Control vendors.
- Set claim retention.
Evidence to keep
- Proposal and policy
- Authorisation
- Claim checklist
- Access logs
- Vendor contract
Warning signs
- Medical reports emailed widely
- Agent stores reports personally
- Wellness data used for marketing
- Employer receives diagnosis unnecessarily
- Records destroyed during dispute
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.