ABSTRACT

The rapid change to digital deployment in India’s healthcare sector has changed the way how healthcare services are provided. This includes telemedicine, electronic health records, health apps, digital health care platforms, and online consultations. Although these technological advances in this field have made it easier and more efficient to deliver healthcare, they have also created important concerns about how the personal health data is collected, processed, stored, and shared. Health data is very sensitive and also require a strong legal framework to protect the privacy, confidentiality, and to prevent misuse of such data. The Digital Personal Data Protection Act, 2023 is a crucial step towards establishing a solid legal structure for managing the personal data in India.

However, implementing this Act in the healthcare sector creates several legal and regulatory challenges. This paper will also examine the legal framework that governs the healthcare data under the Digital Personal Data Protection Act, 2023. It will also check whether the current rules are sufficient to protect patient’s personal data in the fast-changing digital healthcare industry. When we look into the current healthcare situation, we can see that digital health projects like the Ayushman Bharat Digital Mission, electronic health records, telemedicine platforms, and AI-based healthcare services rely heavily on processing large amounts of personal health data.

Although the Act provides rules for protecting personal data, there are still many issues in the healthcare sector. These include obtaining patient consent, sharing health data securely, protecting it from cyberattacks, sending health data outside India, and ensuring that hospitals and healthcare providers protect patients’ information properly. This research paper will also discuss the responsibilities of hospitals, healthcare professionals, digital health platforms, and other stakeholders in adhering to the Digital Personal Data Protection Act, 2023.

Also, the paper suggests that managing the healthcare data in India needs a regulatory approach that focuses on the sector itself. This includes the factors such as improving patient consent mechanisms, enhancing cybersecurity standards, ensuring more transparency in data processing practices, and creating effective oversight mechanisms to protect sensitive healthcare data. These actions would help balance technological progress with the right to privacy and strengthen public trust in India’s digital healthcare system.

KEYWORDS: Digital Personal Data Protection Act, 2023, Healthcare Data Governance, Patient Privacy, Digital Health, Data Protection.

I. INTRODUCTION

India finally got data privacy law. After more than two years and 5 attempts of drafting, Parliament passed the Digital Personal Data Protection Bill and it was approved then got president signature on August 11, 2023[1]. It wasn’t easy. but it’s now the law which enshrined In K.S. Puttaswamy v. Union of India,[2] the Supreme Court declared that privacy is a fundamental right of every Indian citizen. This Act turns that court ruling into an actual working law. This is India’s first law specifically built to protect people’s personal data online.

There is a dedicated legal structure that tells everyone, individuals and organizations have their rights and responsibilities are when it comes to data. It covers only digital personal data. The Data Protection Board of India is the central authority set up to handle complaints and violations. Once it comes into full effect, it will override Section 43A of the IT Act 2000 and the IT (Sensitive Personal Data) Rules 2011[3].

The DPDP Act 2023 is a general law but this paper ecifically deals with health care data. Healthcare is not general and that gap creates real problems. India’s healthcare system has gone heavily digital. Programmes like Ayushman Bharat Digital Mission, electronic health records, telemedicine, and AI-driven medical tools all run on large volumes of personal health data. That data is sensitive, and the risks of mishandling it are serious.

Does the DPDP Act 2023 actually protect patients in India’s fast-changing digital healthcare environment or does it fall short. The key problem areas this paper looks at Consent of patients genuinely informed before their health data is collected and used or not. When hospitals, labs, and platforms exchange patient data, is it done securely and whether the Act deals with it.

Healthcare systems are frequent targets so the current protections are strong enough to protect the privacy of health care data and whether the Act gives a specific rules regarding that. The hospitals, doctors, and digital health platforms clear on what the law requires of them and the how law requires them to implement it and what is the punishment it provided when such stakeholders didn’t comply with the law.

[1]Subhajit Saha, Surjashis Mukhopadhyay, a new age of data privacy laws in india: review of digital personal data protection act, 2023,International Journal of Law and Social Sciences (IJLS) Volume 10, Issue 1, 2024 Print ISSN: 2454-8553, Online ISSN: 2583-8644

[2]Justice K.S.Puttaswamy(Retd) And Anr. vs Union Of India And Ors. on 24 August, 2017, https://indiankanoon.org/doc/91938676/

[3]Saha, supra note 1