Healthcare providers, diagnostic labs, hospitals, and telemedicine platforms process intimate patient health data. The DPDP Act introduces strict boundaries around patient consent while explicitly accommodating medical emergencies and life-saving treatments under Section 7.
1. Processing During Medical Emergencies (Section 7(d))
Under Section 7(d), personal data may be processed without prior consent for responding to a medical emergency involving a threat to the life or immediate threat to the health of the Data Principal or any other individual. Hospitals are not legally hindered from rendering emergency triage or life-saving resuscitation due to consent formalities.
2. Non-Emergency Health Records & Consent Notices
For outpatient consultations, elective procedures, and diagnostic reporting, hospitals must provide itemised notices under Rule 3. Clinical records cannot be shared with pharmaceutical marketers, insurance brokers, or health analytics platforms without separate, explicit, unbundled affirmative consent.
3. Paediatric & Minors' Health Data (Section 9)
Processing health records of paediatric patients requires verifiable consent from a parent or legal guardian. Healthcare portals must establish secure guardian-child relationship verifications before granting online access to immunization records and lab reports.