AI
Patient Privacy and AI: What the DPDP Act Means for Doctors and Clinics in India
By Abhiram Chandramohan · · 4 min read
Short answer: India's Digital Personal Data Protection Act, 2023 (the DPDP Act) sets rules for how organisations collect, use, store and share personal data, which includes patient information. For doctors and clinics using AI, the safe default is simple: never enter identifiable patient data into a general-purpose AI tool, use AI only on de-identified information, and keep a clear written policy on which tools staff may use for what.
This article is general information for clinicians, not legal advice. For your specific situation, speak to a lawyer who works on data protection.
What does the DPDP Act cover?
The Act applies to digital personal data: information about an identifiable individual, in digital form, or collected offline and later digitised. A patient's name, phone number, address, ID numbers, photographs, and medical details linked to them all fall within its scope. Organisations that decide how and why personal data is processed have obligations, including using data for a lawful purpose, generally with the person's consent, keeping it secure, and protecting it from breaches.
Detailed rules and their timelines are notified by the government, so clinics should keep an eye on official updates and take professional advice as they apply.
Why is AI a specific privacy risk?
When you paste text into a public AI chatbot, that text is sent to the provider's servers. Depending on the product and your settings, it may be stored and, in some consumer products, used to improve models. Even if a provider has strong protections, sharing identifiable patient data with a third-party tool without a proper basis and safeguards is a risk you do not need to take.
What counts as identifiable?
More than most people think. Beyond names and phone numbers, a combination of age, locality, rare condition, dates and employer can identify someone, especially in a smaller community. De-identification means removing or generalising all of these, not just the name.
Safe and unsafe uses of AI in a clinic
| Usually safe | Unsafe without proper safeguards |
|---|---|
| Drafting a general leaflet on managing hypertension | Pasting a named patient's history to "summarise" |
| Summarising a published research paper | Uploading lab reports or scans with patient details |
| Writing a referral letter template | Writing a letter with the patient's identifiers in the prompt |
| Preparing a CME presentation | Sharing case photos where the patient can be recognised |
| Drafting appointment reminder templates | Exporting your patient list into an AI tool |
A simple AI policy for your clinic
- List approved tools and the account type (personal, team or enterprise) staff should use.
- Ban identifiable patient data in any tool that is not specifically approved and contracted for it.
- Turn off training on your data where the tool offers that setting.
- Teach de-identification with examples, not just a rule.
- Require human review of anything AI drafts before it reaches a patient.
- Keep a short log of how AI is used in the clinic, and review it every few months.
What about AI tools built for healthcare?
Some products are designed for clinical settings, with contracts, data processing terms and hosting choices suited to healthcare. They can be appropriate for tasks involving patient data, but check the contract, where data is stored, who can access it, and whether it meets your obligations. "Built for doctors" in marketing is not the same as compliant.
Practise safe AI workflows
The fastest way to use AI confidently is to practise on real tasks with someone showing you where the risks are. Our AI training for doctors in Bangalore builds privacy into every workflow, from de-identification to tool settings, so you save time without putting patients at risk. For practical uses to start with, read 7 practical ways doctors in India can use AI.
Frequently asked questions
Does the DPDP Act stop doctors from using AI?
No. It sets obligations for handling personal data. Using AI on de-identified information or for general tasks is a different matter from feeding it patient records.
Is health data treated differently?
Health data is among the most sensitive personal information and deserves the strictest care, whatever the precise legal category. Treat it that way.
What should I do if patient data was entered into a chatbot by mistake?
Delete the conversation, review the tool's data settings, record what happened, and take advice on whether any further steps are needed.
