Home
Blog
Is patient data safe in clinic software? Questions to ask under DPDP

Software

Is patient data safe in clinic software? Questions to ask under DPDP A due-diligence checklist for the clinic owner, tied to what the DPDP Act and Rules make your job.

A clinic owner cannot audit a software company's servers. What the owner can do is ask the right questions before signing, get the answers in writing, and know which of them the law makes the clinic's own problem. This is that list.

Shaurya Pratap SinghFounder, Vitels

Published 27 Oct 2026 · Last reviewed 27 Oct 2026 · 11 min read

In short

Under the DPDP Act the clinic is the Data Fiduciary and the vendor is its Data Processor. Section 8(1) keeps the clinic responsible for the vendor's processing "irrespective of any agreement to the contrary".
Section 8(2) allows a Data Processor only "under a valid contract", and rule 6(1)(f) of the DPDP Rules 2025 wants security safeguards written into that contract. A click-through page with no security or breach terms is the gap to close first.
A breach at the vendor is your breach to report: to each affected patient without delay and to the Data Protection Board, with a detailed report within 72 hours (rule 7). Get the vendor's own deadline for telling you in writing.
These duties commence on 13 May 2027 under G.S.R. 843(E) and rule 1(4) of the Rules. Contracts you sign now will still be running then.

Patient data in clinic management software is as safe as the vendor's controls and your contract with the vendor make it; the software being cloud or offline, free or paid, does not settle it. Under the Digital Personal Data Protection Act, 2023, the clinic stays responsible for patient data even when the vendor stores it, so before you sign, ask the vendor who at their company can open your records, how access is logged, how fast they will tell you about a breach, where the data and backups sit, and how you get every record out and deleted when you leave, and get each answer in the contract.

The DPDP Act has no approval or certificate scheme for software, so a "DPDP compliant" badge on a vendor's site tells you nothing on its own. What follows is a set of questions, the answer that should satisfy you, and the provision of the Act or the DPDP Rules, 2025 that makes each one matter. For the duties themselves (notice, consent, patient rights, children's data) read our DPDP Act guide for clinics. For the EMR-specific demo tests, see the EMR software checklist.

Who is responsible if the software vendor leaks patient data?

The clinic is, in law, alongside whatever the vendor owes you under the contract. Section 2(i) of the Act defines a Data Fiduciary as the person who "determines the purpose and means of processing of personal data"; for patient records that is the clinic. Section 2(k) defines a Data Processor as "any person who processes personal data on behalf of a Data Fiduciary"; that is your software vendor, its cloud host and anyone else it uses to run the product.

Section 8(1) then says the Data Fiduciary shall, "irrespective of any agreement to the contrary", be responsible for complying with the Act "in respect of any processing undertaken by it or on its behalf by a Data Processor". Section 8(5) asks the clinic to protect personal data "including in respect of any processing undertaken by it or on its behalf by a Data Processor, by taking reasonable security safeguards to prevent personal data breach". A vendor's terms cannot move that duty off the clinic. They can only tell you whether the vendor will help you meet it.

Timing: G.S.R. 843(E), published in the Gazette on 13 November 2025, brings sections 3 to 17 of the Act (except section 6(9)), including section 8, into force eighteen months after publication, and rule 1(4) of the DPDP Rules, 2025 does the same for rules 3 and 5 to 16. That is 13 May 2027. A software contract signed in late 2026 will almost certainly be in force on that date, so ask these questions now.

What should the contract with the software vendor say?

It should exist, first. Section 8(2) lets a Data Fiduciary use a Data Processor "only under a valid contract". Rule 6(1)(f) lists, among the minimum safeguards, an "appropriate provision in the contract entered into between such Data Fiduciary and such a Data Processor ... for taking reasonable security safeguards". If the only document is a sign-up page you ticked, ask the vendor for its terms of service, privacy policy and any data processing terms, and read them for the clauses below.

Clauses to look for in a clinic software contract
Clause	What it should say	Why (Act or Rules)
Role and purpose	The vendor processes patient data only on the clinic's behalf and only to run the service	s.2(k), s.8(1)
Security safeguards	The measures the vendor takes: encryption, access control, logging, backups	s.8(5), rule 6(1)(a)–(d), (f)
Breach notice to the clinic	A deadline in hours for telling the clinic, and what the notice will contain	s.8(6), rule 7 (you need the facts to report on time)
Logs and retention	Personal data and processing logs kept for at least one year from processing	rule 6(1)(e), rule 8(3)
Sub-processors	A list of the companies the vendor uses (cloud host, SMS or messaging provider) and notice before it changes	s.8(1), s.8(5): their processing is still yours
Other uses of data	No sale, licensing or analysis of patient or prescription data for anyone else, including in aggregated form	Purpose limits in s.4 and s.6; see who owns clinic data
Export	The clinic can export every record itself, in a format it can open, at any time	rule 6(1)(d) continuity; your exit plan
Deletion at exit	Deletion of the clinic's data after export, subject to the retention periods the law sets, with written confirmation	s.8(7)(b), rule 8(3)

Rule 8(3) has an illustration worth showing a vendor. A company that uses a cloud service provider as its Data Processor "is required to ensure that the C also retains the data and associated logs for at least one year before erasure". So a vendor that keeps access logs for a few weeks and discards them leaves you short of a rule that applies to you.

Which security questions should a clinic ask, and what is a good answer?

Ask each of these in writing, and ask for the answer to be specific. "Bank-grade security" is not an answer. A good answer names the control and who can switch it off.

Security questions for a clinic software vendor, with rule 6(1) of the DPDP Rules 2025
Ask	A good answer sounds like	Red flag	Rule
How is one clinic's data kept apart from another clinic's on the same system?	A control in the database itself, tested, that the application cannot bypass	"Our developers are careful"	6(1)(b)
Is data encrypted in transit and where it is stored, including backups?	Yes for both, and they can say where backups are kept	Only "we use HTTPS"	6(1)(a)
Does each doctor and receptionist get their own login?	Yes, with roles that limit what the front desk sees	One shared clinic password	6(1)(b)
Is there a record of who opened which patient record, and can the clinic see it?	Yes, kept for at least a year, readable by the clinic admin	Logs only the vendor sees, or none	6(1)(c), (e)
How often is data backed up, and has a restore been tested?	A stated frequency, retention period and a date of the last restore test	"The cloud handles it"	6(1)(d)
What happens to data saved on the clinic's own computer for offline use?	What is stored, whether it is encrypted, and how it is cleared on sign-out	No answer, or "nothing is stored" from software that works offline	6(1)(a)
How are staff removed when they leave the clinic?	Access ends at once, and open sessions are signed out	Removal takes a support ticket	6(1)(b)

Who at the software company can see your patients' records?

This is the question vendors answer least clearly, and the one that matters most for a clinic. Engineers, support staff and anyone with database access are all people outside your clinic who could open a record. Ask for the answer as a list:

Which roles at the vendor can open a patient record at all, and is that access standing (always on) or granted per case?
If support needs to look at a record to fix a problem, who approves it, for how long, and is the reason written down?
Is every such access logged, and can the clinic read that log without asking?
Do contractors or offshore support teams have access?
Is any patient data copied into test or analytics systems, and if so, is it stripped of names and numbers first?

The patient's secrets are also the doctor's legal duty. Regulation 7.14 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 says a registered medical practitioner "shall not disclose the secrets of a patient that have been learnt in the exercise of his / her profession", with three narrow exceptions. A vendor's support team browsing records is not one of them.

What happens when the breach is at the vendor?

You report it. Section 8(6) requires the Data Fiduciary to inform the Data Protection Board and "each affected Data Principal" of a personal data breach. Rule 7(1) asks for notice to each affected patient "without delay", in plain language, covering what happened, the likely consequences, what is being done, what she can do, and a contact person. Rule 7(2) asks for a first report to the Board without delay and a detailed one "within seventy-two hours of becoming aware of the breach", unless the Board allows longer on a written request.

You cannot meet a 72-hour clock if the vendor tells you on day four. So ask:

How many hours after the vendor becomes aware of a breach will it tell the clinic, and through which channel and to whom?
What will that notice contain: which patients, which data, when, and what has been done?
Will the vendor help the clinic notify patients, for example with a list of affected phone numbers?
Has the vendor named a point of contact with CERT-In? CERT-In's directions of 28 April 2022 under section 70B(6) of the IT Act require service providers, data centres and body corporates to report the listed cyber incidents to CERT-In "within 6 hours of noticing such incidents", to keep logs of their ICT systems "for a rolling period of 180 days" within India, and to designate a Point of Contact. A software company that has not heard of this is a warning sign.

Write the vendor's answer into your own one-page breach plan, with the vendor's support number next to your lawyer's. The plan itself is covered in our DPDP guide.

Does patient data have to be stored in India?

Not as a general rule under the DPDP Act. Section 16(1) lets the Central Government "restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified", and section 16(2) keeps any other law that sets stricter limits. So the question for the vendor is factual: in which country, and which region, are the live data and the backups kept, and does any sub-processor (an email, SMS or analytics service) send data abroad? If the answer changes later, you want to hear before it happens, which is a contract clause.

What about the computers and phones inside the clinic?

Most leaks at small clinics start at the desk, not at the vendor: a shared login, an unlocked computer at lunch, a staff member's phone full of report photos. Rule 6(1)(b) asks for measures "to control access to the computer resources used by such Data Fiduciary", which includes the clinic's own machines.

Every person signs in as themselves. Do not share one login or forward one OTP around the desk.
Screen lock on every computer and phone that opens the software, and device encryption switched on where the operating system offers it.
Keep the operating system and browser on versions that still get security updates. Our hardware guide covers what to check.
Remove a departing staff member's access on their last day, and sign them out of every device.
No patient photos or report scans on personal phones. If the clinic uses WhatsApp, see WhatsApp for clinics.

What happens to your data when you leave the vendor?

Test the exit before you need it. Ask the vendor to show you a full export in the demo, open the files on your own computer, and check that every patient, visit, prescription and bill is there. Then ask what the vendor does with your data after you leave.

Section 8(7)(b) asks the Data Fiduciary to "cause its Data Processor to erase any personal data that was made available by the Data Fiduciary" once the purpose is served, unless a law requires it to be kept. Rule 8(3) separately requires personal data and processing logs to be kept for at least one year from the date of processing. The answer you want is a written sequence: export, then retention for the period the law requires, then deletion, with a confirmation in writing. How long a clinic must keep medical records is its own question, covered in how long to keep medical records, and moving to another product is covered in switching clinic software.

The vendor due-diligence checklist

Send these to every vendor on your shortlist and compare the written answers side by side.

Send us your terms, privacy policy and data processing terms. Do they say you process our patients' data only on our behalf?
Which security safeguards do you commit to in the contract: encryption, access control, logs, backups?
Which roles at your company can open a patient record, and is that access standing or granted per case? Is each access logged and visible to us?
How is our clinic's data separated from other clinics' data?
Within how many hours will you tell us about a breach, and what will the notice contain?
Who is your point of contact with CERT-In?
How long do you keep access logs and processing logs? Is it at least one year?
Which sub-processors do you use, in which countries, and will you tell us before that changes?
Where are the live data and the backups stored? How often are backups taken, and when did you last test a restore?
Do you sell, license or analyse patient or prescription data for anyone, even aggregated?
What is stored on our computers for offline use, and is it encrypted?
Can our admin export every record, at any time, without asking you? Show us.
When we leave, what do you keep, for how long, and will you confirm deletion in writing?

Questions

Is a clinic responsible for a data breach at its software vendor?

Yes. Section 8(1) of the DPDP Act makes the Data Fiduciary (the clinic) responsible for processing done on its behalf by a Data Processor (the vendor), irrespective of any agreement to the contrary, and section 8(6) puts the duty to inform the Board and each affected patient on the clinic. These sections commence on 13 May 2027.

Does the DPDP Act require a written contract with clinic software vendors?

Section 8(2) allows a Data Fiduciary to use a Data Processor only under a valid contract, and rule 6(1)(f) of the DPDP Rules 2025 asks for security safeguards to be provided for in that contract. Read the vendor's terms for security, breach notice, logs and deletion.

Is there a government certificate that shows clinic software is DPDP compliant?

The DPDP Act and the 2025 Rules do not set up any approval or certificate for software. Judge a vendor on its written answers and its contract, not on a badge.

Must clinic software store patient data in India?

Not as a general rule under the DPDP Act. Section 16 lets the government restrict transfers to countries it notifies, and keeps stricter laws in place. Ask the vendor where the live data and backups are stored and to tell you before that changes.

Sources

This is operational guidance for clinics, not legal advice. Have your lawyer read the vendor contract before you sign.

Drafted with AI assistance; every fact checked against the sources listed; reviewed by Shaurya Pratap Singh.