Digital Personal Data Protection Act, 2023: Challenges in Healthcare

GS-II | Governance | Health | Digital Governance | Data Protection

Introduction

• DPDP Act, 2023: The DPDP Act, 2023 was passed by the Parliament to protect digital personal data. It includes 44 sections, 9 chapters and 1 schedule.
• Implementation Timeline: The Government issued the Rules on November 13th, 2025. It is expected that the provisions of the consent managers will be effective from November 13th, 2026, and all other substantive obligations from May 13th, 2027.

Key Challenges

• Consent for clinical and data purposes: While you may agree to have a clinical scan, this does not imply that you are agreeing to the subsequent uses of your scan.
• Balancing privacy and patient care: The right amount of privacy versus patient care is a delicate balance. If there is too much restriction on the ability of healthcare professionals to access patient information, it can have an impact on how well they are able to provide patient care. On the other hand, if there are no restrictions on the ability of healthcare professionals to view patient information, this could lead to serious violations of patients’ privacy.
• Sensitive health information: Hospitals continually produce extremely personal information such as clinical notes, nursing observations, laboratory test results, diagnostic image reports, respiratory device measurements and prescriptions.
• Multiple data processors: A variety of different types of data processors (e.g., insurers, third-party administrators, laboratories, radiology platforms, cloud providers, and telemedicine providers) can provide additional avenues for patient health information to flow.
• Compliance cost: Role based access for hospital employees; encryption of all sensitive data; maintenance of audit logs; backup of systems; contract agreements with vendors; development of protocol for breaches; training of employees; and implementation of data governance.
• Financial consequences: Failure to take proper precautions will result in financial consequences of up to ₹250 crores.
• Lack of consistency in training: Currently there does not exist any national medical commission dpdp based curriculum or standardized courses for medicine, nursing, allied health, hospital administration and healthcare it.
• Small hospital burden: Small hospitals, diagnostic centers, and PHCs should not be required to buy their own privacy tools and template legal forms by the federal government.
• Cost of healthcare: The costs of complying with the DPDP act may be reflected in patient’s cost of care. In 2022-23, National Health Accounts showed that out-of-pocket health care spending was 43.4% of all health care spending.

Way Forward

• Shared Infrastructure: Establish a common infrastructure by using the Unified Health Interface under the Ayushman Bharat Digital Mission.
• Affordable support: Provide affordable support by providing a model consent agreement and vendor agreement with affordable cybersecurity support, as well as implementation standards specific to the healthcare industry.
• Training: Make data literacy a core healthcare competency.
• Specific provisions for different sectors: Develop sector specific DPDP provisions to meet the unique requirements of both large and small hospitals since clinical care is not simply a business transaction.
• Sustainable ecosystem: Finance, build, and maintain a sustainable ecosystem where all health care providers can be compliant, and patients can access their needed care.

Conclusion

With the DPDP Act taking effect, the Government must develop a long-lasting environment for patients to have protection of their privacy, for hospitals/clinics/etc. to comply with rules regarding how they use and share data, and for all individuals to have improved access to quality healthcare services.

UPSC Mains Practice Question

Q. What are some of the obstacles that may occur when trying to apply the Digital Personal Data Protection Act, 2023, within the health care industry? How can we create solutions for ensuring compliance with this act, while simultaneously maintaining patients’ privacy?

Build a strong foundation for UPSC Civil Services with our GS Foundation Course. Master General Studies, strengthen your Prelims and Mains preparation, and learn with expert guidance and a structured study plan.

Start your UPSC preparation today with our GS Foundation Course and take the first step towards your IAS dream!