HIPAA vs DPDP for Indian Healthtech: Patient Data Guide

Indian healthtech companies handling patient data navigate two regulatory regimes simultaneously. If you process health data of Indian users, India's Digital Personal Data Protection Act 2023 (DPDP) applies. If you touch health records of US patients or work with US hospitals, insurers, or clinics as a vendor, the Health Insurance Portability and Accountability Act (HIPAA) applies too. This guide breaks down what each law covers, where they overlap, and which controls satisfy both.

What HIPAA Covers

HIPAA, administered by the US Department of Health and Human Services (HHS), applies to covered entities — health plans, healthcare providers, and healthcare clearinghouses — and to their business associates: vendors that create, receive, maintain, or transmit Protected Health Information (PHI) on their behalf.

PHI is any individually identifiable health data in any form — name, date of birth, geographic data, IP address, and 14 other identifiers when combined with health, treatment, or payment information.

The HIPAA Security Rule covers electronic PHI (ePHI) and requires three safeguard categories: administrative (risk analysis, workforce training), physical (device and facility controls), and technical (encryption, audit controls, access management). Full rule at hhs.gov/hipaa/for-professionals/security.

Business Associate Agreements — the trigger for Indian vendors

A BAA is a written contract between a US covered entity and its vendor. If your platform receives PHI from a US hospital or insurer, you need a BAA before data flows begin. Without one, neither party is compliant. The BAA requires the Indian company to use PHI only for the contracted purpose, apply equivalent HIPAA safeguards, notify the covered entity of any breach within a defined window, and return or destroy PHI at contract termination.

What DPDP Covers

India's Digital Personal Data Protection Act 2023 — notified by MeitY — applies to the processing of digital personal data collected in India or processed in India. The Act is at meity.gov.in/data-protection-framework.

Health data is personal data under DPDP. The Act does not create a separate health-data category as HIPAA does, but health records are implicitly high-sensitivity given their direct identification risk.

Key DPDP obligations for healthtech: purpose limitation (collect only what's necessary); explicit, revocable consent before processing; data principal rights of access, correction, and erasure; security safeguards and breach notification to CERT-In and affected individuals; and for government-designated Significant Data Fiduciaries, a mandatory Data Protection Officer and data protection impact assessments.

ABDM and Health Data in India

The Ayushman Bharat Digital Mission (ABDM) creates a national health record ecosystem. Companies integrating with ABDM process ABHA (Ayushman Bharat Health Account) records tied to Aadhaar or mobile identity. Consent for ABDM-linked records must be explicit, granular, and auditable. ABDM's Health Data Management Policy sets additional standards for data minimisation and interoperability that run alongside DPDP.

Key Differences Between HIPAA and DPDP

Which Regime Applies to Your Patient Data

The decision is not either/or. The following flowchart maps out which regime — or both — governs a specific data processing activity.

graph TD
    A[Patient data being processed] --> B{Data principal based in India?}
    B -- Yes --> C[DPDP applies]
    B -- No --> D{Data from US covered entity or US patient?}
    D -- Yes --> E[HIPAA applies]
    D -- No --> F[Check other jurisdictions]
    C --> G{Also received via BAA with US entity?}
    G -- Yes --> H[Both HIPAA and DPDP apply]
    G -- No --> I[DPDP only]
    E --> J{Also processing Indian residents data?}
    J -- Yes --> H
    J -- No --> K[HIPAA only]
    H --> L[Implement dual-compliant controls]
    I --> M[DPDP controls sufficient]
    K --> N[HIPAA controls sufficient]

    style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style C fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style E fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style F fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style G fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style H fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style I fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style J fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    style K fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style L fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    style M fill:#1e3d2f,stroke:#10B981,color:#e2e8f0
    style N fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

Scope Comparison: HIPAA vs DPDP

The chart below compares key scope dimensions qualitatively across both frameworks.

xychart-beta
    title "HIPAA vs DPDP - Scope Comparison"
    x-axis ["Consent Strength", "Data Subject Rights", "Technical Prescriptiveness", "Cross-border Reach", "Breach Notification Speed", "Health-specific Rules"]
    y-axis "Relative Stringency" 0 --> 10
    bar [4, 3, 9, 6, 7, 10]
    bar [9, 9, 5, 7, 8, 4]

HIPAA leads on technical prescriptiveness and health-specific rules. DPDP leads on consent strength and data principal rights. Cross-border rules remain pending under DPDP.

India Health Data Context: CERT-In and Breach Reporting

CERT-In's 2022 directions require all entities to report cybersecurity incidents within six hours of detection. DPDP's breach notification obligations layer on top. The effective requirement is the stricter of the two: report patient record breaches to CERT-In immediately, then follow up with affected data principals as DPDP Rules require.

Practical Controls That Satisfy Both Regimes

The good news is that the technical control sets overlap substantially. Implementing a robust security baseline for HIPAA largely satisfies DPDP's principle-based security requirements too.

Risk Analysis: the HIPAA requirement most Indian vendors miss

HIPAA's Security Rule requires a documented risk analysis — an assessment of threats and vulnerabilities to ePHI. Indian business associates often implement the technical controls but skip formal risk analysis documentation, leaving them non-compliant on paper. A VAPT covering APIs, cloud configuration, authentication flows, and data storage addresses this requirement and simultaneously produces evidence for DPDP's security obligation. A free VAPT scan is the practical starting point.

When to Execute a BAA

The BAA is a legal instrument, but the trigger is operational: if your platform receives, stores, processes, or transmits data that includes PHI — even in a de-identified-but-not-fully-safe-harbor form — you need a BAA with the US covered entity before data flows begin.

Common scenarios: diagnostic AI for US radiology groups (DICOM metadata is PHI); revenue cycle management SaaS for US clinics; telehealth platforms connecting US doctors with patients; health data analytics for US insurers where claims data is PHI.

ABDM Integration and DPDP Compliance

Companies integrating with ABDM must align their consent architecture with the ABDM Health Data Management Policy and the emerging DPDP framework. Practically this means using ABDM consent artifacts — structured objects specifying data requester, provider, purpose, and expiry — as the basis for your internal consent records. Consent revocation must propagate to all systems where the health record was shared. Treat ABHA-linked data as high-sensitivity personal data under DPDP, with enhanced access controls and audit logging. Getting ABDM consent right positions you well for DPDP compliance once Rules are finalized.

For more compliance guidance, explore the Bachao.AI blog or the dedicated DPDP compliance page. The platform is built by Dhisattva AI Pvt Ltd, a DPIIT Recognized Startup focused on automated security for Indian businesses.