Where patient information lives in a clinic
Most clinics handle personal data through more tools than they realise: a reception phone, a WhatsApp number, a booking page, a records system, a lab portal and a billing tool. Start by listing where information enters, moves through and leaves your practice.
Enquiries and bookings
Calls, WhatsApp messages, web forms and listing platforms where people share names, numbers and reasons for visiting.
Registration and intake
Patient forms, ID or insurance copies, history questionnaires and consent forms, on paper or digital.
Clinical records
Records systems or paper files, prescriptions, notes and images, and who in the team can open them.
Labs and referrals
Reports shared by email or messaging apps, referral letters and exchanges with diagnostic partners.
Billing and insurance
Invoices, receipts, insurer or TPA paperwork and payment tools that hold contact and treatment details.
Reminders and follow-ups
Appointment reminders, follow-up messages and any promotional or health-camp outreach.
Use aggregate descriptions, not patient details, in readiness conversations.
Questions for the practice team
- Which systems and apps hold patient and appointment information, including personal phones used by staff?
- Who can open booking and clinical records, and is that access reviewed when staff change?
- Are reminders sent through a contact method the patient expects and shared for that purpose?
- Which labs, billing tools, software vendors or IT providers receive patient information?
- How long are records kept, and what happens to old paper files and retired devices?
- If a patient raised a question or complaint, or you suspected an incident, who would handle it?
Where to take extra care
Health information can be particularly sensitive in practice. This page offers operational prompts only, not a conclusion about which statutory duties apply to your clinic. Take healthcare-specific legal and professional advice for segment-specific conclusions.
Common places to look first:
- Sharing reports or images over personal messaging apps
- Shared logins or personal phones used for patient communication
- Promotional messages sent using details collected for appointments
A first review in four steps
List the tools
Write down every system, app and paper process that touches patient information.
Trace one patient journey
Follow a typical visit from first enquiry to billing and follow-up, noting each hand-off.
Check who can see what
Compare access with real roles: front desk, doctors, billing and outside vendors.
Choose what to fix first
Pick a few practical actions and confirm legal interpretations with a qualified professional.
Check the official sources
The applicable law and any exemptions depend on the facts. Do not assume that all organisations have identical duties, or that a checklist alone proves compliance. Check the current official Act, Rules and commencement notifications, and obtain legal advice for segment-specific conclusions.
Official MeitY DPDP Act materials · the DPDP Act guide explains the framework and its commencement schedule.