1. Introduction

Data fiduciary obligations in healthcare are the legal duties imposed on hospitals, doctors, diagnostic laboratories, health insurers, telemedicine platforms, pharmaceutical companies, and other organisations that determine how patients’ personal data is collected, used, stored, disclosed, or otherwise processed.

Healthcare data is particularly sensitive because it may reveal a person's medical history, genetic characteristics, mental health, reproductive choices, disability, medication use, and family medical risks. Unlawful disclosure or misuse can cause discrimination, financial loss, reputational damage, and violations of personal dignity.

In India, the principal constitutional foundation is the right to privacy under Article 21 of the Constitution, as recognised in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). The statutory framework includes the Digital Personal Data Protection Act, 2023 (DPDP Act), its 2025 Rules, and other applicable laws governing medical confidentiality, information technology, professional conduct, and clinical research.

Indian Kanoon+2

Central legal principle: A healthcare organisation must have a lawful basis for processing patient data, respect applicable confidentiality and consent requirements, implement appropriate security safeguards, and remain accountable for its handling of that data.

An important distinction is that the statutory term Data Fiduciary under the DPDP Act is not identical to the traditional equitable concept of a fiduciary relationship. The former identifies an entity that determines the purpose and means of processing personal data; the latter concerns duties arising from relationships of trust, confidence, and dependence.

2. Meaning and scope of a healthcare data fiduciary

Under Section 2 of the DPDP Act, a Data Fiduciary is the person who, alone or in conjunction with others, determines the purpose and means of processing personal data.

Examples include:

Optimalisasi Pelayanan Pasien melalui Sistem Manajemen SIMRS Terintegrasi -

Hospitals and clinical establishments

They determine how patient registration details, medical histories, prescriptions, diagnostic results, and discharge summaries are collected and maintained.

Qual a ciência por trás da telemedicina?

Telemedicine and health applications

They may process consultation recordings, symptoms, appointment histories, wearable-device readings, and patient account information.

Prime Diagnostic and Polyclinic Kolkata, West Bengal | Diagnostics, Imaging & Multispecialty Care

Diagnostic laboratories and genomic testing companies

They handle test results, biological sample identifiers, genetic information, and associated clinical records.

Healthcare Billing Specialist Carefully Reviews Patient Insurance Claims

Health insurers and healthcare administrators

They process claims, treatment information, eligibility records, and other data necessary for their operations.

An entity that merely processes data on behalf of another entity may be a Data Processor. Under the DPDP Act, outsourcing processing does not generally eliminate the Data Fiduciary's statutory responsibility for compliance with applicable requirements.

3. Applicable legal framework in India

A. Constitution of India

Article 21 protects life and personal liberty, including the right to privacy. Articles 14 and 19 may also become relevant where state action or related fundamental-rights issues arise.

Healthcare data protection is therefore not simply a matter of cybersecurity. It can involve bodily autonomy, informational self-determination, dignity, equality, and the right to make personal medical decisions.

B. Digital Personal Data Protection Act, 2023

The DPDP Act establishes obligations for Data Fiduciaries and rights for individuals, called Data Principals. Important provisions include:

India Code+2

Commencement is important. As of 4 November 2026, the DPDP framework is being implemented in phases. The 2025 Rules were notified in November 2025, but most substantive duties concerning notice, consent, security, and individual rights are scheduled to commence on 13 May 2027; the Consent Manager provisions have an earlier scheduled commencement in November 2026. Organisations must distinguish enacted and notified requirements from provisions that are already operative.

Press Information Bureau+2

C. Other relevant Indian laws

Information Technology Act, 2000 and applicable SPDI Rules, 2011: Relevant to sensitive personal data and reasonable security practices to the extent those provisions remain applicable.

Consumer Protection Act, 2019: May provide remedies where deficient healthcare services or related conduct satisfy the statutory requirements.

Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, where applicable: Historically important for professional confidentiality, subject to subsequent regulatory changes and the rules in force.

Clinical-trial and biomedical-research requirements: Applicable regulations, ethics committee requirements, and consent standards may govern research involving identifiable health data or biological materials.

Information Technology (CERT-In) Directions, 2022: May impose cybersecurity incident-reporting and record-retention requirements on covered entities.

These laws operate alongside one another. Compliance with one does not automatically satisfy every other applicable obligation.

4. Core fiduciary obligations in healthcare

4.1 Duty of confidentiality

Medical confidentiality is one of the oldest obligations in healthcare law. Doctors and hospitals ordinarily must not disclose information acquired through treatment without a lawful justification.

Confidentiality covers:

Diagnoses, prescriptions, medical histories, and laboratory results.

HIV status, psychiatric records, reproductive health information, and genetic test results.

Consultation notes, medical images, and discharge summaries.

Information that identifies a patient indirectly, including through combinations of demographic and clinical details.

The duty is not absolute. Disclosure may be justified by valid consent, a legal requirement, or a sufficiently compelling public-health or third-party-protection interest, depending on the applicable law and facts.

Example: A hospital should not send a patient's psychiatric diagnosis to the patient's employer merely because the employer pays for the insurance. The hospital must identify an appropriate legal basis and limit any justified disclosure to what is necessary.

4.2 Duty to obtain valid consent

Where consent is the applicable legal basis for processing personal data, it must satisfy the relevant statutory requirements. Section 6 of the DPDP Act specifies that consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action, and limited to data necessary for the specified purpose. The principal consent provisions are scheduled for commencement in May 2027.

IndiaCode+1

Healthcare consent also has a distinct clinical dimension. Consent to a medical procedure is not interchangeable with consent to use a patient's data for advertising, commercial profiling, or unrelated research.

For example, a patient may agree to a blood test for diagnosis without agreeing to have their identifiable genetic information sold to a pharmaceutical marketing company.

4.3 Purpose limitation

Patient data should be processed for a lawful, specified purpose and not casually repurposed for unrelated activities.

Common legitimate purposes may include:

Diagnosis and treatment.

Appointment management and clinical administration.

Billing and insurance claims.

Legally authorised public-health reporting.

Research conducted under applicable legal and ethical safeguards.

A new purpose requires a separate assessment of its legal basis, compatibility with the original purpose, and any applicable consent or notice requirements.

4.4 Data minimisation

Healthcare organisations should collect and disclose only the information reasonably necessary for the relevant lawful purpose.

For example, an appointment-booking application may need a patient's name, contact information, appointment time, and limited clinical information. It would ordinarily have no need to access the patient's entire phone contact list.

This principle becomes particularly important when healthcare services use wearable devices, AI diagnostic systems, and third-party analytics platforms.

4.5 Accuracy and integrity

Incorrect medical information can lead to inappropriate treatment, insurance rejection, or unfair decisions about a patient.

Data fiduciaries should establish procedures for:

Correcting inaccurate demographic and medical information.

Identifying the source of diagnostic results.

Maintaining version histories and audit trails.

Recording amendments without concealing clinically relevant history.

Ensuring that AI-generated information is distinguishable from verified clinical findings.

The right to correct data must be reconciled with legitimate clinical recordkeeping and applicable retention requirements.

4.6 Security and protection against unauthorised access

A healthcare data fiduciary should implement security controls proportionate to the risks of processing.

Technical safeguards

Encryption, multifactor authentication, secure backups, access logging, and vulnerability management.

Organisational safeguards

Staff confidentiality policies, employee training, access restrictions, vendor due diligence, and incident-response procedures.

Governance safeguards

Risk assessments, documented responsibilities, periodic security reviews, retention controls, and evidence of compliance.

The DPDP Act's Section 8 establishes general obligations concerning reasonable security safeguards and breach-related responsibilities. Applicable CERT-In directions and sector-specific requirements may impose additional duties.

India Code+1

4.7 Data breach notification

A healthcare data breach may involve ransomware, stolen devices, misdirected emails, compromised laboratory systems, or unauthorised employee access.

A responsible incident-response process should include:

Containing the breach and securing affected systems.

Determining the categories of data and people affected.

Preserving logs and evidence.

Assessing clinical, financial, privacy, and identity-related risks.

Making notifications required by the applicable legal regime.

Remediating vulnerabilities and documenting corrective measures.

The DPDP Rules, 2025 prescribe breach-intimation requirements for the DPDP regime. The precise duties and deadlines must be applied according to the provisions in force at the relevant time. Organisations should not assume that the entire DPDP breach-notification regime is already operative in November 2026.

Press Information Bureau+1

4.8 Retention and erasure

Healthcare data should not be retained indefinitely without justification. Equally, medical records cannot always be deleted merely because a patient requests erasure.

A hospital may need to retain records to satisfy applicable clinical, statutory, insurance, or litigation-related obligations. Once the relevant purpose is no longer served, retention and erasure should be assessed under the governing law.

The correct approach is a documented retention schedule that distinguishes ordinary administrative data from medical records subject to specific retention requirements.

4.9 Accountability and governance

Accountability requires more than a written privacy policy. An organisation should be able to demonstrate that its data-processing activities are lawful and adequately controlled.

Useful measures include:

A data inventory and record of processing activities.

Defined roles for clinicians, privacy teams, IT administrators, and vendors.

Procedures for patient requests and complaints.

Contractual controls over outsourced data processing.

Risk assessments for high-impact technologies.

Periodic audits and corrective-action plans.

If an organisation is designated a Significant Data Fiduciary under Section 10 of the DPDP Act, additional statutory obligations apply, including a Data Protection Officer and specified assessment and audit measures. The precise application depends on designation and commencement.

10+1

5. Landmark Indian case laws

The following decisions establish important principles relevant to healthcare data fiduciary obligations. Some concern constitutional privacy or medical confidentiality rather than the DPDP Act itself; they should therefore be treated as foundational or analogous authorities, not as judgments directly interpreting every DPDP provision.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Citation: (2017) 10 SCC 1 · Supreme Court of India

Facts and issue: The Supreme Court considered whether privacy is a constitutionally protected fundamental right.

Held: The nine-judge Bench unanimously recognised privacy as a fundamental right protected by the Constitution, particularly under Article 21 and the freedoms in Part III.

The judgment recognised informational privacy as an important dimension of privacy. It also explained that restrictions on privacy must satisfy constitutional requirements, including legality, a legitimate state aim, and proportionality.

Relevance to healthcare data fiduciaries:

Medical information falls within the broader protection of informational privacy.

State collection and use of medical information must be constitutionally justified.

Healthcare data systems should respect autonomy and minimise unnecessary intrusion.

Public-health objectives do not automatically justify unrestricted access to identifiable patient records.

The judgment is a constitutional foundation for healthcare privacy in India. It does not, by itself, establish a universal statutory consent rule for every private-sector data-processing activity.

Indian Kanoon+1

Case 2. Mr. X v. Hospital Z (1998)

Citation: (1998) 8 SCC 296 · Supreme Court of India

Facts: A hospital disclosed information about a patient's HIV-positive status in circumstances involving a prospective marriage and concerns about the health of another person.

Issue: Whether disclosure of confidential medical information necessarily violates the patient's right to privacy.

Held: The Supreme Court recognised the importance of medical confidentiality but held that the duty is not absolute. In the circumstances before it, the Court did not treat the disclosure as an unlawful violation of privacy, recognising the competing interest in protecting another person's health.

Legal principles:

Doctors have a professional and ethical duty to preserve patient confidentiality.

Disclosure of private medical information may raise a privacy claim even where the information disclosed is true.

Confidentiality may be subject to legally recognised exceptions, including circumstances involving serious risks to others.

Any proposed disclosure must be assessed in its factual and legal context.

Relevance: Hospitals should not disclose sensitive diagnoses indiscriminately. Where a serious third-party risk is alleged, they should identify the applicable legal justification and limit disclosure appropriately.

This case is not authority for a general right to disclose HIV status to family members, employers, or other third parties whenever a hospital considers it useful.

Indian Kanoon+1

Case 3. Samira Kohli v. Dr. Prabha Manchanda (2008)

Citation: (2008) 2 SCC 1 · Supreme Court of India

Facts: A patient consented to a diagnostic procedure, but the surgeon performed additional surgery involving removal of reproductive organs without obtaining the patient's specific consent in circumstances where no qualifying emergency justified it.

Issue: Whether consent to one medical procedure authorises a materially different procedure.

Held: The Supreme Court held that consent must be real and valid. Ordinarily, it must be voluntary and given by a competent patient on the basis of adequate information. Consent for a diagnostic procedure does not automatically authorise additional therapeutic surgery, except in the recognised emergency circumstances.

Legal principles:

Patient autonomy must be respected.

Consent to a particular procedure does not authorise every subsequent intervention.

Adequate information should enable the patient to make an informed decision.

An emergency may justify an otherwise unauthorised additional procedure where the legal requirements are met.

Relevance to data fiduciaries: Although this case concerns clinical consent rather than digital data processing, it reinforces the distinction between permission for one purpose and permission for another.

A hospital should not assume that a patient's consent to treatment also authorises unrelated secondary use of their data. The exact legal requirements for such secondary use must be determined under the applicable data-protection and research framework.

Indian Kanoon+1

Case 4. K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar judgment, 2018)

Citation: (2019) 1 SCC 1; judgment delivered 26 September 2018 · Supreme Court of India

Facts and issue: The Court considered the constitutional validity of the Aadhaar framework, including questions concerning the collection, use, and protection of personal information.

Relevant principle: The judgment discussed privacy in the context of data systems and recognised the importance of protecting medical records. Unauthorised disclosure of identifiable medical records can invade privacy, while appropriately anonymised information may support legitimate public-health analysis.

Relevance to healthcare:

Health-data analytics should distinguish identifiable information from properly anonymised datasets.

Public-health research can serve legitimate public interests, but the manner of processing matters.

De-identification should not be treated as a guarantee against re-identification where data can be linked with other sources.

The judgment supports a proportionality-based approach to sensitive information; it should not be read as a blanket authorisation for commercial sharing of anonymised or pseudonymised health records.

Sci API+1

6. Comparative case law: international principles

International decisions are useful for understanding healthcare privacy, although they are not automatically binding in Indian courts.

A. Z v. Finland (1997)

Application No. 22009/93 · European Court of Human Rights

The case concerned the disclosure and retention of confidential medical information relating to an individual with HIV.

The European Court of Human Rights emphasised that confidentiality of health data is a fundamental aspect of private life under Article 8 of the European Convention on Human Rights. Strong safeguards are needed to prevent disclosure that could deter people from seeking medical treatment.

Application: Healthcare institutions should restrict access to sensitive diagnoses, carefully control disclosure to judicial or public authorities, and establish safeguards for medical records.

B. I v. Finland (2008)

Application No. 20511/03 · European Court of Human Rights

The case involved allegations that a hospital had failed to protect the confidentiality of a healthcare worker's HIV-related medical records.

The Court found a violation of Article 8 in the circumstances, highlighting the importance of effective safeguards and remedies for unauthorised access to medical records.

Application: A healthcare organisation cannot rely solely on a general confidentiality policy. It should implement effective access controls, maintain appropriate safeguards, and provide meaningful remedies where privacy is breached.

C. Google Spain SL v. Agencia Española de Protección de Datos (2014)

Case C-131/12 · Court of Justice of the European Union

The case concerned the application of European data-protection law to search-engine indexing and the conditions under which individuals could seek removal of certain search results.

Although it did not concern hospital records directly, it contributed to the development of principles concerning personal-data processing, individual rights, and the balance between privacy and other legitimate interests.

Application: Healthcare data fiduciaries must consider how information is exposed, indexed, or disseminated beyond the original context in which it was collected. The precise rights and remedies depend on the applicable jurisdiction.

These international cases illustrate that meaningful healthcare privacy requires effective safeguards, not merely a promise to keep information confidential.

7. Special obligations for AI, genomics, and digital healthcare

Emerging technologies create additional risks because they can infer sensitive facts from data that appears ordinary or anonymous.

An AI developer and a hospital may have different legal roles. The hospital may be a Data Fiduciary for deciding why patient data is used, while an AI vendor may act as a Data Processor if it processes data solely on the hospital's instructions. If the vendor independently determines its own processing purposes, its legal classification must be assessed accordingly.

8. Liability for breach of fiduciary obligations

Depending on the facts and applicable law, a healthcare organisation may face several forms of liability.

Constitutional remedies

Where state action infringes fundamental rights, constitutional remedies may be available under Articles 32 or 226, subject to the relevant legal requirements.

Statutory penalties

Once the relevant DPDP provisions are operative, contraventions may attract penalties under the Act. The statutory schedule includes a maximum penalty of ₹250 crore for failure to take reasonable security safeguards under Section 8(5), and up to ₹200 crore for specified breach-notification failures under Section 8(6). Other contraventions have separate statutory limits. These are maximums, not automatic fines for every incident.

India Code+1

Professional and consumer liability

Unauthorised disclosure, deficient security, or negligent handling of records may lead to professional disciplinary proceedings or consumer claims where the applicable legal elements are established.

Civil or criminal proceedings

Depending on the conduct, other applicable laws may support claims or proceedings involving breach of confidence, negligence, unauthorised access, fraud, or other legally defined wrongdoing. A data breach does not automatically establish every form of liability.

9. Practical compliance checklist for hospitals

A healthcare organisation can use the following checklist to evaluate its data-governance arrangements.

Healthcare data compliance review

0/9

Map all patient-data flows

Identify what is collected, why it is collected, where it is stored, and who receives it.

Document the legal basis

Distinguish treatment-related processing, consent-based processing, and other legally authorised uses.

Review patient notices and consent

Separate clinical consent from consent or another legal basis for secondary data uses.

Restrict access to medical records

Apply role-based access, authentication, logging, and periodic access reviews.

Assess vendors and cloud services

Check contractual responsibilities, security controls, subprocessors, and relevant cross-border rules.

Create a breach-response plan

Define escalation, evidence preservation, risk assessment, required notifications, and remediation.

Set retention and correction procedures

Apply appropriate retention periods, correction workflows, and lawful erasure practices.

Audit research and AI projects

Review the legal basis, research ethics, de-identification, model use, and potential re-identification risks.

Prepare for DPDP commencement

Track phased commencement dates and implement applicable requirements before their effective dates.

Reset checklistCopy checklist

This checklist is a practical governance aid, not a substitute for a legal audit or a determination of which statutory provisions currently apply.

10. Critical legal issues and unresolved questions

A. Is the hospital a fiduciary in every sense?

Not necessarily. A hospital may qualify as a statutory Data Fiduciary because it determines the purposes and means of processing personal data. Whether it also owes a particular equitable or common-law fiduciary duty depends on the relationship, applicable law, and facts.

B. Does patient consent authorise all data uses?

No. Consent is purpose-specific where the applicable law requires it. Consent to diagnosis, surgery, or telemedicine does not automatically authorise unrelated advertising, data sales, or unrestricted research.

C. Can a hospital share data without consent?

Sometimes. A lawful disclosure may be permitted or required under applicable law, including in specified public-health or emergency circumstances. The organisation must establish the relevant legal justification rather than treating healthcare status as a blanket exemption from privacy obligations.

D. Can anonymised health data be commercially exploited?

The answer depends on the legal regime, the effectiveness of anonymisation, contractual restrictions, research obligations, and whether the data can reasonably be linked back to individuals. Removing names alone is not necessarily sufficient to anonymise a dataset.

E. Does the DPDP Act automatically create compensation for every privacy breach?

No. The Act provides a statutory enforcement and penalty framework, but a contravention does not automatically establish an entitlement to compensation under every possible cause of action. Available remedies depend on the applicable statute, procedural requirements, and facts.

11. Conclusion

Data fiduciary obligations in healthcare combine constitutional privacy, medical confidentiality, valid consent, responsible data use, cybersecurity, and organisational accountability.

The most important Indian authorities are Puttaswamy (2017), which establishes the constitutional foundation for informational privacy; Mr. X v. Hospital Z (1998), which explains confidentiality and its limited exceptions; and Samira Kohli (2008), which reinforces patient autonomy and the limits of consent.

For practical compliance, healthcare organisations should adopt a documented, risk-based data-governance system, respect purpose-specific permissions, restrict access to medical records, carefully assess disclosures, and prepare for the phased implementation of the DPDP Act.

The essential legal lesson is that trust in healthcare requires more than keeping records secret: it requires lawful, transparent, proportionate, and accountable use of patient information.

Legal note: This explanation is for academic and general informational purposes. For a specific dispute or compliance decision, the exact facts, applicable sectoral regulations, and commencement status of the relevant provisions should be verified.