·8 min read
Hospital software and patient privacy: DPDP basics for admins
Health data is sensitive personal data. Role access, encryption, consent, retention and patient rights are the floor for any EMR or HMIS you run in India.
Know what you hold
Hospital systems store names, phones, diagnoses, prescriptions, lab values, invoices and sometimes ID proofs. That mix is sensitive. Map where PHI lives: patient charts, Rx, lab, IPD, referrals and uploaded documents. Superadmin platform tools should not browse tenant clinical rows unless impersonation and audit rules allow it.
Multi-tenant SaaS must isolate every hospital by tenant ID on every query. A missing filter is a breach waiting to happen, not a minor bug.
Least privilege and audit
Give each role only the permissions it needs: front desk books and bills, doctors write Rx, lab publishes results, admin sees the union. Impersonation (admin login as staff, platform login as tenant) must leave a clear audit trail with start and end times.
Log billing changes, refunds, staff create or deactivate, and clinical document share events. Retention policies should purge old audit rows on a defined schedule while keeping enough history for dispute resolution.
Encryption, sharing and patient rights
Encrypt uploaded clinical documents at rest when your platform supports it, and decrypt only in memory when serving downloads or WhatsApp sends. Shared report links need expiry, optional PIN or OTP, rate limits and watermarks. Never email plaintext passwords.
Under India Digital Personal Data Protection rules and related guidance, patients expect clarity on purpose, consent for outreach, and ways to access or close accounts. Portal export and account deletion flows help hospitals meet those expectations. This article is operational guidance, not legal advice; confirm obligations with counsel for your facility type.