The next shift in healthcare governance: DPDP and NABH are converging
NABH consultants frequently characterize their role as assisting hospitals in moving from practices to organised systems. From processes driven by ease to those marked by order, clarity and uniformity. Gradually accreditation has formalised domains, like medication safety, infection control, medical records management and patient rights. Naturally as the Digital Personal Data Protection Act 2023 is being implemented in stages healthcare organisations are starting to experience the onset of a discipline: data governance.
Hospitals have traditionally managed amounts of personal data but their methods have mostly developed in a piecemeal manner with procedures varying across departments. Admission desks use one system diagnostic units operate another and clinical teams frequently create their informal communication methods. While these variations might appear minor they expose deficiencies when examined through the lens of the DPDP Act.
NABH standards those concerning Information Management Systems and Patient Rights & Education already emphasise confidentiality, accuracy and controlled access. The DPDP Act reinforces these principles. It introduces detailed responsibilities. For instance hospitals are now required to inform patients about the data being collected the purposes, behind its collection, its intended use and how long it will be retained. This is not merely a guideline; it is an obligation.
Typically embedding privacy statements into sign-up forms is unlikely to fulfill the expectation of providing information that’s both reachable and significant. Consent has acquired a significance: Traditionally, hospitals linked consent to medical treatments. Under the DPDP Act consent now extends to processes, data sharing inside and beyond the institution and even standard tasks such as uploading reports, to external platforms. If consent is merged or unclear it might fail to fulfill the requirements.
NABH consultants assisting hospitals in preparing patient-related paperwork will have a role here. Internal access systems represent another point of convergence. The majority of hospitals depend on computers and universal logins that often lack access regulations. The Act brings in the principle of purpose limitation. Access ought to be granted to individuals requiring specific information for a clearly specified reason. This will certainly impact how NABH consultants evaluate the management procedures of records laboratory workflows and staff duties.
Data retention, a matter concerning organisations will also need revision. Hospitals have traditionally kept records indefinitely driven by requirements and partly due to the absence of deletion protocols. The DPDP Act mandates that hospitals define retention periods based on the purpose and erase data once that purpose is fulfilled. This requirement corresponds with NABH’s focus, on record management. Calls for more precise documentation and regular audits.
Vendor partnerships also represent an aspect between the two frameworks. Hospitals depend on their suppliers, collaborators, cloud PACS, insurance platforms and outsourced administrative functions. NABH mandates that hospitals guarantee agreements do not jeopardise patient safety. The DPDP Act broadens this duty to encompass data management, obliging hospitals to confirm that vendors adhere to data protection regulations, apply security protocols and handle data solely following documented directives.
For consultants this introduces a scrutiny element during vendor audits and contract evaluations. Breach management highlights a change in procedures: Numerous data breaches in hospitals occur unintentionally. A misplaced file, a printed report left unattended or a screenshot shared through a messaging app. According to the Act such situations might necessitate informing authorities and those impacted.
NABH consultants, who assist hospitals in developing incident reporting and quality enhancement systems must now include privacy-related provisions, within these systems. This evolving scenario reveals not a clash but a harmonious integration. NABH aims to strengthen hospital processes to enhance patient safety and organisational reliability.
The DPDP Act seeks to strengthen data practices to protect patient dignity and privacy. Together, they form a more holistic vision of healthcare quality. As the law reshapes expectations around patient information, NABH consultants may play an important role in helping hospitals integrate these requirements seamlessly into their existing accreditation pathways.
Tapesh Raghav is an Independent Litigation Advocate before the Delhi High Court with expertise in civil, commercial, banking, and cyber law disputes. A recognised cyber policy expert, he advises clients on technology regulations, data governance, digital compliance, and emerging cyber risks, integrating legal strategy with evolving digital frameworks
