India crossed 90 crore ABHA health accounts in May 2026, and more patient records now move digitally between hospitals, labs and insurers than ever before. Hospitals are Data Fiduciaries under the DPDP Act, must report cyber incidents to CERT-In within six hours, and must keep telemedicine records under the 2020 guidelines. This guide brings those duties together for hospital and clinic leaders.
Why hospitals face the strictest scrutiny
Hospitals hold the most sensitive personal data most people ever share: diagnoses, test results, prescriptions and insurance claims. A breach harms patients directly and can stop clinical work if systems are encrypted by ransomware. Digital health growth adds more integrations to protect, from lab systems to insurer portals and ABHA-linked records.
DPDP duties for hospitals
Under the DPDP Act and the Rules notified in November 2025, a hospital must give patients a clear notice, process data for specified purposes, keep reasonable security safeguards, report breaches to affected individuals and the Data Protection Board, and handle access and erasure requests within ninety days.
The Rules allow processing of children's data without parental consent in limited cases such as healthcare, which matters for paediatric care. Hospitals should still document when that exemption applies.
- Patient privacy notice at registration and on the website.
- Purpose register for clinical care, billing, insurance and research.
- Role-based access in the HIS, with audit logs.
- Breach response plan with named owners.
- Rights request process with a 90 day deadline.
CERT-In reporting and logs
The CERT-In directions of 28 April 2022 require organisations to report specified cyber incidents within six hours of noticing them. Covered incidents include data breaches and leaks, unauthorised access to IT systems, phishing and ransomware-related intrusion. Organisations must also enable logs for their ICT systems and keep them for 180 days within Indian jurisdiction.
In practice, hospitals need an incident owner available at all hours, a pre-filled reporting template and logging turned on for the HIS, email, firewalls and servers.
Telemedicine records and consent
The Telemedicine Practice Guidelines of 25 March 2020 say consent is implied when the patient starts a teleconsultation, and explicit consent must be recorded when a health worker or doctor starts it. Doctors must keep logs of each interaction, the records and reports used, and prescription records.
The guidelines also say AI platforms must not counsel patients or prescribe medicines. AI may support evaluation, but the final advice and prescription must come from the registered medical practitioner.
| Rule | Requirement | Source |
|---|---|---|
| Consent | Implied if the patient initiates, explicit if the provider initiates | Telemedicine guidelines 2020 |
| Records | Interaction logs, reports, prescriptions | Telemedicine guidelines 2020 |
| AI use | No AI counselling or prescribing | Telemedicine guidelines 2020 |
| Incidents | Report to CERT-In within 6 hours | CERT-In directions 2022 |
The cost of getting it wrong
IBM's 2025 study put the average cost of a data breach in India at INR 220 million, up about 13% from the previous year, with an average breach lifecycle of 263 days. Under the DPDP Act, failing to keep security safeguards can draw a penalty of up to ₹250 crore and failing to notify a breach up to ₹200 crore.
Using AI safely in hospital operations
The safest early uses of AI in hospitals are administrative: answering questions about timings and fees from approved documents, preparing insurance claim packs, checking bills against tariffs and summarising discharge paperwork for staff review. Each keeps a person in control and stays away from clinical advice.
Before any AI tool touches patient data, record it in an AI register with its purpose, data used, owner and review date, and confirm where the vendor stores data.
A 30 day starting plan
Week one: name a data protection owner and an incident owner. Week two: map patient data systems and turn on logs. Week three: publish the privacy notice and test the breach plan. Week four: review access in the HIS and remove stale accounts. XDQ Labs offers a free course on AI, data protection and digital operations for hospitals and clinics that walks teams through each step.
Frequently asked questions
Does the DPDP Act apply to hospitals and clinics?
Yes. Hospitals and clinics process digital personal data of patients, so they are Data Fiduciaries. They must give notice, keep reasonable security safeguards, report breaches to patients and the Data Protection Board, and answer rights requests within ninety days.
How fast must a hospital report a cyber attack in India?
Under the CERT-In directions of 28 April 2022, specified cyber incidents must be reported to CERT-In within six hours of noticing them. Logs of ICT systems must be kept for 180 days within India.
Can AI give medical advice in telemedicine in India?
No. The Telemedicine Practice Guidelines of 2020 say AI platforms cannot counsel patients or prescribe medicines. AI can assist evaluation, but the registered medical practitioner must give the final advice and prescription.
How many ABHA accounts exist in India?
The government announced in May 2026 that more than 90 crore ABHA accounts had been created under the Ayushman Bharat Digital Mission, which shows how much patient data now moves digitally.
Sources
- Ayushman Bharat surpasses 90 crore ABHA accounts, IANS, 2026
- 6 Hours To Report Cyber Incidents To CERT-In, Mondaq, 2022
- Digital Personal Data Protection Rules, 2025 (backgrounder), Press Information Bureau, 2025
- Telemedicine Practice Guidelines, Ministry of Health and Family Welfare, 2020
- India Records Highest Average Cost of a Data Breach, IBM India Newsroom, 2025
- India's Digital Personal Data Protection Act 2023 brought into force, Hogan Lovells, 2025
