Are electronic medical records legally valid in India? Yes. Section 4 of the IT Act, section 63 of the Sakshya Adhiniyam, and what the 2016 EHR Standards add.

Yes. An electronic medical record is legally valid in India. Section 4 of the Information Technology Act, 2000 says that where any law requires information to be in writing or in printed form, an electronic record that is accessible for later reference meets that requirement, so the record duty in regulation 1.3.1 of the 2002 conduct regulations can be met in software. In court, an electronic record is admissible under sections 61 and 63 of the Bharatiya Sakshya Adhiniyam, 2023, which repealed the Indian Evidence Act, 1872, provided the conditions in section 63 are met and a certificate in the form set out in the Act's Schedule accompanies it.

Whether a clinic is required to keep records electronically is a different question, answered in is EMR mandatory for clinics. This post is about whether the electronic record holds up.

What does the IT Act say about electronic records?

Where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is— (a) rendered or made available in an electronic form; and (b) accessible so as to be usable for a subsequent reference.

Section 2(1)(t) defines an electronic record as "data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche". An OPD visit typed into software, a scanned parchi and a photographed report are all electronic records. The two conditions in section 4 are the ones to test your system against: can you produce the record, and can you still read it years later. A record locked inside a product you no longer pay for fails the second test in practice even if it exists on someone's server.

The conduct regulations already lean this way. Regulation 1.3.4 says: "Efforts shall be made to computerize medical records for quick retrieval." Where a signature is needed, as on a prescription, section 5 of the IT Act covers electronic signatures; that is a separate question, covered in doctor's signature and stamp on a prescription.

How is an electronic record proved in court?

Section 61 of the Bharatiya Sakshya Adhiniyam, 2023 (Act 47 of 2023, assented to on 25 December 2023) says: "Nothing in this Adhiniyam shall apply to deny the admissibility of an electronic or digital record in the evidence on the ground that it is an electronic or digital record and such record shall, subject to section 63, have the same legal effect, validity and enforceability as other document." Section 62 says the contents of electronic records "may be proved in accordance with the provisions of section 63".

Section 63(1) treats a printout or copy of an electronic record ("computer output") as a document, admissible "without further proof or production of the original", if four conditions in section 63(2) are met. Put in clinic terms:

Section 63(3) treats all computers used for the purpose over the period, "in standalone mode", "on a computer system", "on a computer network", on a computer resource, or "through an intermediary", as a single device, so cloud software and an office PC count alike. Section 63(4) then requires "a certificate ... submitted along with the electronic record at each instance where it is being submitted for admission", identifying the record and how it was produced, giving device particulars, and dealing with the section 63(2) conditions, "signed by a person in charge of the computer or communication device or the management of the relevant activities (whichever is appropriate) and an expert". The certificate is in the Schedule to the Act: Part A "(To be filled by the Party)" lists the device or source (computer, server, cloud and others), states it was under lawful control and working properly, and records the hash value of the record, with SHA1 and SHA256 among the listed algorithms.

For a clinic the practical consequence is simple. The doctor or clinic owner fills Part A for records the clinic produces; the clinic should be able to say what system the record came from, that it was in regular use, and produce the file whose hash goes on the certificate. A lawyer handles the filing. If the clinic has an export it controls, all of that is easier than chasing a vendor in the middle of a case.

What is the status of the 2016 EHR Standards?

The Ministry of Health and Family Welfare notified EHR Standards for India in September 2013 and revised them in 2016. The 2016 document describes itself as "the recommendations of the Expert Committee" and calls its approach "an incremental approach to adopting standards". It is a technical standard for builders of health record systems, not a rule that a clinic must certify against. Three of its recommendations bear directly on legal weight, because they map onto section 63:

• Immutability: "The data once entered into a health record system must become immutable." Corrections create a new version marked ACTIVE, with the old one marked INACTIVE, so the original survives.
• Audit trail: "A strict audit trail shall be maintained of all activities at all times that may be reviewed by an appropriate authority like auditor, legal representatives of the patient, the patient, healthcare provider, privacy officer, court appointed/authorized person, etc."
• Integrity: "A secure hashing algorithm must be used to verify that electronic health information has not been altered in transit."

A system that meets these makes the section 63(2)(c) and (d) statements easy to sign. More on the audit side is in audit trail in clinic software.

Should a clinic keep paper as well?

The law does not require it. A clinic that has moved to software can stop the paper OPD register once the software record carries the Appendix 3 fields and can be printed within 72 hours under regulation 1.3.2. Two things are worth keeping on paper: anything signed by the patient, such as a consent form, unless you capture an electronic signature; and the original of any document that arrives on paper and will matter later, like a police letter or court summons.