Deploying healthcare AI in India requires navigating two distinct privacy regimes: the Digital Personal Data Protection (DPDP) Act and HIPAA. DPDP applies broadly to Indian providers processing patient data, requiring data-layer consent enforcement, local residency, and a strict 72-hour breach reporting window to the Data Protection Board. Conversely, HIPAA applies specifically when processing Protected Health Information (PHI) for US-linked entities (e.g., teleradiology, coding). Successful implementation demands technical verification of tamper-evident audit logs, in-country API model hosting, and CERT-In compliance, alongside robust contractual controls like Data Processing Agreements (DPAs) and prohibitions on secondary model training without explicit consent.
Compliance is where a healthcare AI project is most likely to be approved in a meeting and then quietly stall in legal review. The reason is simple: two very different legal regimes get discussed as if they were one. India's Digital Personal Data Protection Act, 2023, and its Rules notified in November 2025, apply to nearly every Indian provider that processes patient data digitally. The US Health Insurance Portability and Accountability Act applies only in specific circumstances, but when it does apply, it carries obligations a DPDP-only mindset will miss.
This guide separates the two, lays out what each requires in practice, and gives hospital IT, compliance, and business leaders a verification list they can use with any AI vendor. Technical teams will find the control-level checks. Business and legal teams will find the contractual and governance checks.
This article is general information, not legal advice. Confirm applicability and timelines with qualified counsel before relying on any of it.
First, Which Law Actually Applies to You?
DPDP applies to almost everyone: If you process digital personal data of individuals in India, you are a Data Fiduciary under the DPDP Act, and the AI vendor processing data on your behalf is a Data Processor. Health data is personal data. The Act does not create a separate "sensitive data" category, but in practice health information should be handled at the highest level of care, because the harm from exposure is greatest and enforcement attention will follow.
HIPAA applies only in defined situations: HIPAA binds US covered entities (health plans, healthcare clearinghouses, and providers who transmit health information electronically in standard transactions) and their business associates. An Indian provider or AI vendor therefore needs HIPAA alignment when it handles protected health information on behalf of a US covered entity, for example in teleradiology, transcription, medical coding, revenue cycle services, clinical research, or US-linked telehealth. If you never touch US patient data, HIPAA is not your legal obligation, though many Indian vendors adopt its safeguards as a recognised security baseline.
Other frameworks sit alongside both: ABDM's health data management and consent architecture applies to facilities participating in the national digital health ecosystem. ICMR's ethical guidelines for AI in biomedical research and healthcare set expectations for validation and oversight. CERT-In directions impose a six-hour window for reporting certain cyber incidents. A compliant AI deployment satisfies all that apply at the same time.
What DPDP Requires Where Healthcare AI Is Concerned
Consent and Notice
Processing generally needs free, specific, informed, and unambiguous consent, with a clear notice describing what data is collected and why. The Rules require that withdrawing consent be as easy as giving it. For AI, this means consent has to be enforceable at the data layer, not just recorded in a form. If a patient withdraws consent, the system must be able to stop using that patient's data for the stated purpose.
Purpose Limitation and Data Minimisation
Data collected for treatment cannot casually be reused to train a commercial model. If a vendor proposes to improve its own models using your patients' data, that is a separate purpose requiring a separate legal basis and clear contractual terms.
Security Safeguards and Breach Notification
The Rules require reasonable security safeguards and prescribe breach handling: affected individuals must be told, and a detailed report must go to the Data Protection Board within 72 hours, unless the Board grants an extension. Penalty ceilings are steep: up to INR 250 crore for failing to maintain reasonable security safeguards and up to INR 200 crore for failing to notify a breach. These can stack for a single incident. Sources differ on how soon each obligation bites, so the safest planning assumption is to treat breach readiness as already required.
Timelines
The Rules were notified in November 2025 with a phased rollout. Consent Manager registration opens around the twelve-month mark (November 2026), and full compliance across the core obligations is expected by roughly eighteen months from notification (May 2027). The Data Protection Board is already established, so complaints can be filed and processes started now.
Significant Data Fiduciaries
Large hospital groups processing high volumes of sensitive data may be notified as Significant Data Fiduciaries. That brings additional duties: appointing a Data Protection Officer based in India, an independent data audit, periodic Data Protection Impact Assessments, and further controls. Plan as if your organisation may be designated.
Children's Data and Healthcare Exemptions
Processing children's data requires verifiable parental consent, but the Rules carve out limited exemptions for healthcare professionals and clinical establishments when processing is necessary for health services. Do not assume the exemption covers an AI vendor's secondary uses, and confirm the scope with counsel.
Cross-Border Transfers
The Act permits transfers outside India except to countries the government restricts by notification, and sector laws may impose stricter localisation. For AI, the practical risk is subtler: a vendor routing prompts to a foreign-hosted model API is transferring data abroad even if the application itself runs in India.
What HIPAA Requires When It Applies
HIPAA's Privacy Rule governs use and disclosure of protected health information and enforces the "minimum necessary" principle. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI, including access controls, audit controls, integrity controls, and transmission security. A Business Associate Agreement must be in place with any vendor handling PHI on your behalf. The Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery, with additional reporting duties depending on the size of the breach.
DPDP and HIPAA Side by Side
Dimension | DPDP Act and Rules (India) | HIPAA (United States) |
|---|---|---|
Scope | Digital personal data of individuals in India, all sectors | PHI held by covered entities and business associates |
Legal basis | Consent, or defined legitimate uses | Permitted uses for treatment, payment, and operations, with authorisation for others |
Data subject rights | Access, correction, erasure, grievance redressal, nomination | Access, amendment, accounting of disclosures |
Vendor contract | Processor contract under Data Fiduciary control | Business Associate Agreement |
Breach reporting | Individuals notified, detailed report to the Board within 72 hours | Without unreasonable delay, no later than 60 days |
Penalties | Up to INR 250 crore for security failures, up to INR 200 crore for notification failures | Tiered civil penalties and potential criminal liability |
AI-specific rules | None dedicated; general obligations apply | None dedicated; general obligations apply |
Neither regime has a dedicated statute for AI. Both apply to AI systems through their general rules on data, security, and accountability, which is why the AI-specific questions below matter so much.
The Verification Checklist for Technical Teams
Ask the vendor to demonstrate, not just assert, each of the following.
Data flow diagram- a complete map of where patient data enters, is processed, is stored, and exits, including every subprocessor and every external API.
Residency and transfers- confirmation that data is stored and processed in India, and a clear answer on whether any identifiable or de-identified data reaches a foreign-hosted model.
Encryption- strong encryption at rest and in transit, with documented key management and rotation.
Access control- role-based access, least privilege, multi-factor authentication for administration, and periodic access reviews.
Audit logging- tamper-evident logs of every access and every automated decision, retained for a defined period that satisfies the Rules' log retention requirements.
Consent enforcement- a technical mechanism linking consent status to data use, including propagation of withdrawal to the AI pipeline.
De-identification- method and re-identification risk assessment where data is used for training or analytics.
Model training boundaries- written confirmation of whether your data is ever used to train shared or vendor-owned models, and the ability to opt out.
Prompt and output handling- for generative systems, how prompts, completions, and embeddings are stored, who can read them, and how long they persist.
Incident response- a tested runbook that can produce a notification-ready summary quickly enough to meet the 72-hour DPDP window and CERT-In's six-hour direction.
Independent assurance- ISO 27001 or SOC 2 Type II reports and a recent penetration test with remediation evidence.
The Verification Checklist for Business and Legal Teams
Processor agreement that defines roles, limits processing to your documented instructions, and requires the vendor to support data principal rights and breach response.
Business Associate Agreement where HIPAA applies, aligned to the Data Processing Agreement so the two do not conflict.
Audit and inspection rights exercisable on reasonable notice, including the right to review the vendor's subprocessors.
Subprocessor list with change notification and a right to object.
Breach clause with a vendor notification timeline much shorter than your own regulatory deadline, so you have time to act.
Retention and deletion commitments, including certified deletion at contract end.
Indemnity and insurance proportionate to the penalty exposure and the sensitivity of the data.
Governance ownership. A named accountable person on each side, a Data Protection Impact Assessment where processing is high risk, and a defined path for complaints.
Clinical oversight. A policy that AI output affecting care is reviewed by a qualified clinician, consistent with ICMR expectations.
AI-Specific Risks That Standard Compliance Reviews Miss
Third-party model APIs. A tool built on a public generative AI service may send patient text to servers outside your control. Insist on contractual no-retention and no-training terms, or on in-country hosting.
Memorisation and leakage. Models fine-tuned on identifiable records can reproduce fragments of them. Require de-identification and testing for leakage.
Shadow AI. Staff pasting patient notes into consumer chatbots is a breach waiting to be reported. A sanctioned tool and clear policy are better than an unenforceable ban.
Silent model changes. A vendor updating a model version can change behaviour and data handling without notice. Require change notification and versioned releases.
Bias and explainability. Where AI influences access to care or claims, document how performance varies across patient groups and how decisions can be explained.
A Practical Sequence for the Next Six Months
Map your data and AI use cases in a register, noting which involve US data and which involve children.
Classify your organisation: likely Data Fiduciary, possible Significant Data Fiduciary, and HIPAA business associate where applicable.
Fix the contracts first. Update processor and business associate agreements before new AI systems go live.
Build breach readiness. Name an incident lead, rehearse a 72-hour response, and test log quality.
Prepare for consent infrastructure as the Consent Manager ecosystem opens.
Choose vendors who design for compliance, not those who promise to retrofit it.
How Prognos Labs Builds for Both Regimes
Prognos Labs builds healthcare AI with DPDP and HIPAA alignment designed into the architecture from the first sprint: consent-aware data pipelines, audit-ready logging, role-scoped access, in-country hosting options, and defined breach-response procedures. Systems are built to run inside your existing EMR and operational stack, with one accountable team covering strategy, build, deployment, and monitoring, so governance does not get lost between vendors.