Healthcare Contracting in India: What Applies Instead of HIPAA, and the Agreements a Hospital or Diagnostics Chain Must Get Right

Search for "healthcare e-signature compliance" and most results explain HIPAA, a United States statute with no application to an Indian hospital, laboratory or clinic. Indian healthcare providers have their own rules, and three contract types that carry most of the risk: agreements with vendors who touch patient data, agreements with visiting consultants and doctors, and the consents and documents patients sign. This guide sets out the law that actually applies and the clauses that follow. Position as of October 2026.

What applies instead of HIPAA

• Today: IT Act section 43A and the SPDI Rules, 2011. A body corporate holding sensitive personal data (which includes "medical records and history" and "physical, physiological and mental health condition" under rule 3) must implement reasonable security practices or compensate for negligence. These remain in force until the DPDP Act's section 44(2) omits section 43A on 13 May 2027.
• From 13 May 2027: the DPDP Act, 2023 and Rules, 2025. Consent that is specific and affirmative (section 6(1)), or a legitimate use such as responding to a medical emergency (section 7(f)-(g)) or employment (section 7(i)); notice (section 5); security safeguards (section 8(5), rule 6); breach reporting to the Data Protection Board without delay and in detail within 72 hours (rule 7); processor contracts (section 8(2)); verifiable parental consent for children's data (section 9, rule 10); and erasure when the purpose ends (section 8(7)), subject to retention required by other law. Large providers may be notified as Significant Data Fiduciaries with audit and impact-assessment duties (section 10).
• Clinical and accreditation rules. State clinical establishment legislation and NABH accreditation standards impose record-keeping and documentation requirements on providers; these set retention floors that the DPDP erasure duty defers to. ****
• Telemedicine. The Telemedicine Practice Guidelines, 2020 under the National Medical Commission framework require consent and record-keeping for teleconsultations. ****
• Incident reporting. CERT-In's 2022 Directions apply to healthcare providers as body corporates: six-hour reporting of listed incidents, 180-day logs in India.

Agreement 1: Vendors that touch patient data

Laboratory information systems, hospital information systems, billing and TPA processors, cloud hosting, teleradiology, outsourced transcription and call centres all process patient data. The hospital is the Data Fiduciary; the vendor is the Data Processor. Clauses that follow:

• Processing only on documented instructions for stated purposes.
• Security safeguards aligned to rule 6 (encryption or masking, access control, logs, backups, one-year log retention).
• Breach notification to the hospital within a fixed number of hours so the hospital can meet rule 7's 72-hour report.
• Sub-processor approval; hosting location; erasure and return on termination (section 8(7)(b)).
• Audit rights; indemnity for regulatory penalties caused by the vendor (the DPDP Schedule provides for penalties up to Rs 250 crore for failing to take reasonable security safeguards).

Agreement 2: Visiting consultants and doctors

Many hospital doctors are engaged as independent consultants, not employees. The Supreme Court's tests in Sushilaben Indravadan Gandhi v. New India Assurance (15 April 2020) look at control, integration into the organisation and economic reality, weighing "a conglomerate of all applicable tests". Draft for the real relationship: fee structure, scheduling autonomy, professional indemnity insurance, confidentiality, patient-data handling under hospital policies, and no post-term non-compete (void under section 27 of the Indian Contract Act, 1872). Where the doctor is really an employee, use an employment contract.

Agreement 3: Patient-facing documents

Admission consents, procedure consents, telemedicine consents and data-processing notices. Three points:

1. Separate the consent to treatment from the consent to data processing; section 6(1) requires data consent to be specific.
2. For minors, obtain verifiable consent of the parent or lawful guardian (section 9(1), as clarified by the Removal of Difficulties Order of 5 October 2026).
3. E-signature is appropriate for consents; keep the audit trail with the record, since the document may be evidence in a medical negligence claim and is proved under section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

Obligation tracking for a healthcare provider

• Vendor breach-notification windows and audit dates.
• Consultant agreement renewals and insurance expiries.
• Data retention and erasure schedules by record type.
• Accreditation documentation deadlines.
• MSE vendor payment timelines (section 15, MSMED Act, 2006; 45 days).

Where Legatio fits. Legatio holds the vendor DPA, consultant and consent templates, executes them electronically with the audit trail, and tracks breach windows, renewals and retention dates. The regulatory requirements apply to the provider regardless of platform.

Position stated as of October 2026. General information; healthcare providers should confirm state clinical establishment and accreditation requirements with their compliance adviser.