Front desk
Patient registration form: what details to collect. The minimum set, what the DPDP Act asks, and what to leave out.
Every field on the registration form is a question the desk asks a hundred times a week and a piece of data the clinic then has to protect. The right form is the shortest one that lets the doctor find the patient and the clinic bill the visit.
Published · Last reviewed · 5 min read
- Four fields register a patient: mobile number, name, age or date of birth, sex. Address and emergency contact are useful; everything else needs a reason.
- The DPDP Act 2023 allows processing only for a lawful purpose with consent or a legitimate use, requires a notice saying what is collected and why, and limits consent to the data the purpose needs.
- Aadhaar does not belong on a clinic form. The Aadhaar Act makes its use for identity voluntary and conditions authentication on consent and a permitted purpose; a private clinic has no need for it.
- Collect in two layers: the four fields at the desk, the rest on the form the patient fills while waiting, and only what the clinic will use.
A new patient registration form at a small Indian clinic needs the mobile number, the patient's name, age or date of birth, and sex. Add an address and an emergency contact if the clinic uses them, and the referring doctor if any. Leave off Aadhaar, PAN, voter ID, occupation, religion and anything the clinic will not act on. The Digital Personal Data Protection Act, 2023 ties every field to a purpose stated in a notice and limits consent to what that purpose needs, so a form built on "might be useful" is a form that breaks the Act in the usual way.
What is the minimum a clinic must collect to register a patient?
| Field | Why | Collect at |
|---|---|---|
| Mobile number | The key to the file; the number the token and any visit message goes to | Desk, first |
| Full name | The record and the prescription | Desk |
| Age or date of birth | On the prescription; the doctor needs it | Desk |
| Sex | On the prescription; the doctor needs it | Desk |
| Address (area or locality is often enough) | Receipts for reimbursement, referrals, the rare medico-legal case | Form, while waiting |
| Emergency contact (name and number) | The person to call if the patient collapses in the waiting room | Form |
| Referred by | To reply to the referring doctor; leave blank if none | Form |
| Known allergies and current medicines | Clinical; the doctor decides whether the form asks or the consultation does | Form, if the doctor wants it on the form |
The split into desk and form matters on a busy evening. The desk asks four things and issues the token; the patient fills the rest on a clipboard or a phone while they wait. The free patient registration form prints a one-page version with these fields and a consent line.
What does the DPDP Act ask of a registration form?
Three things, from three sections. Section 4(1) of the Digital Personal Data Protection Act, 2023 says a person may process personal data "only in accordance with the provisions of this Act and for a lawful purpose", either with the patient's consent or for certain legitimate uses. Section 5(1) says a request for consent is "accompanied or preceded by a notice" that tells the patient what personal data is collected and for what purpose, how they can exercise their rights, and how to complain to the Data Protection Board. Section 6(1) says consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" and "limited to such personal data as is necessary for such specified purpose".
For the form, that reads as: a short notice at the top in the local language and English (section 5(3) requires the option of English or a scheduled language) saying what the clinic collects and why ("to register you, maintain your medical record and bill your visit"); a signature or tick that is a real yes; and no field the stated purpose does not need. The Act's own illustration under section 6(1) makes the point with a telemedicine app that asks for the phone's contact list: consent does not extend to data the service does not need. A registration form that asks for occupation and religion has the same problem.
The Act is in force in stages. Which obligations apply from when, and what to do before the main obligations arrive, is in the DPDP Act guide for clinics. The form above is good practice now and the shape the Act asks for later; there is no reason to wait.
One more line from a different document: the Charter of Patients' Rights and Responsibilities approved by the National Council for Clinical Establishments (updated 23 August 2021) lists, as right (xiii), that "informed consent of patient should be taken before digitization of medical records". If the clinic registers into software, say so in the notice.
Should the form ask for Aadhaar?
No. Section 4(3) of the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, as amended in 2019, says an Aadhaar number holder "may voluntarily use his Aadhaar number" to establish identity, and its explanation defines voluntary use by authentication as use "only with the informed consent of the Aadhaar number holder". Section 4(4) allows an entity to perform authentication only if the Authority is satisfied it meets privacy and security standards and is either permitted under another law made by Parliament or seeks authentication for a purpose the Central Government prescribes. Section 7 is about proof of Aadhaar as a condition for subsidies and services paid from the Consolidated Fund, which a private clinic's consultation is not. Section 8(2)(a) requires a requesting entity to obtain consent before collecting identity information for authentication.
A private OPD is not a requesting entity and has no subsidy to deliver, so there is no ground for the field. Photocopies of Aadhaar in a drawer are a liability with no use. If a government scheme the clinic is empanelled in requires an ID, collect what that scheme's rules require, for that patient, for that purpose, and say so in the notice. For everyone else, the mobile number is the identifier.
What else should stay off the form?
- PAN, voter ID, passport or driving licence numbers. No purpose at registration.
- Religion, caste, community. No purpose, and a question that costs trust.
- Occupation and employer, unless the clinic issues fitness certificates and the doctor wants it on file; then ask on the certificate form, not the registration form.
- Income or "category". A clinic that waives fees decides case by case with the doctor; the form is not the place.
- Photographs, unless a scheme requires it. A photo on the file is one more thing to protect.
- Marital status, number of children. Clinical history belongs to the consultation, where the doctor asks what is relevant to the complaint.
- A blanket "I consent to all processing" line. Section 6(2) makes any part of a consent that infringes the Act invalid to that extent, and the Act's illustration under section 6(2) treats a waiver of the right to complain as invalid.
Where Vitels fits
Questions
Does the patient have to sign the registration form?
Under section 6(1) of the DPDP Act, consent needs "a clear affirmative action". A signature or a ticked box after a plain notice is that action. Keep the signed form with the file, or the ticked consent in the software.
A family shares one mobile number. How do you register them?
One number, several patients under it, each with their own name, age and sex. The desk picks the right person when the number comes up. Never create a second file to get around a shared number.
Can the clinic ask for an ID to confirm the patient's name?
It can ask to see one; it does not need to copy or record the number. Seeing a name on a card and writing the name is enough. Recording the ID number is collecting data with no stated purpose.
Sources
- Ministry of Law and Justice, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, 11 August 2023, sections 4, 5 and 6 (accessed 30 Oct 2026)
- Unique Identification Authority of India, The Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, as amended by Act 14 of 2019, sections 4(3), 4(4), 7 and 8 (accessed 30 Oct 2026)
- Ministry of Health and Family Welfare, Charter of Patients' Rights and Responsibilities (as approved by the National Council for Clinical Establishments), updated 23 August 2021, right (xiii) (accessed 30 Oct 2026)
This is operational guidance for clinics, not legal or tax advice. Confirm with your state authority, council or CA.
Drafted with AI assistance; every fact checked against the sources listed; reviewed by the Vitels team.