Indian healthtech companies handling patient data navigate two regulatory regimes simultaneously. If you process health data of Indian users, India's Digital Personal Data Protection Act 2023 (DPDP) applies. If you touch health records of US patients or work with US hospitals, insurers, or clinics as a vendor, the Health Insurance Portability and Accountability Act (HIPAA) applies too. This guide breaks down what each law covers, where they overlap, and which controls satisfy both.
What HIPAA Covers
HIPAA, administered by the US Department of Health and Human Services (HHS), applies to covered entities — health plans, healthcare providers, and healthcare clearinghouses — and to their business associates: vendors that create, receive, maintain, or transmit Protected Health Information (PHI) on their behalf.
PHI is any individually identifiable health data in any form — name, date of birth, geographic data, IP address, and 14 other identifiers when combined with health, treatment, or payment information.
The HIPAA Security Rule covers electronic PHI (ePHI) and requires three safeguard categories: administrative (risk analysis, workforce training), physical (device and facility controls), and technical (encryption, audit controls, access management). Full rule at hhs.gov/hipaa/for-professionals/security.
Business Associate Agreements — the trigger for Indian vendors
A BAA is a written contract between a US covered entity and its vendor. If your platform receives PHI from a US hospital or insurer, you need a BAA before data flows begin. Without one, neither party is compliant. The BAA requires the Indian company to use PHI only for the contracted purpose, apply equivalent HIPAA safeguards, notify the covered entity of any breach within a defined window, and return or destroy PHI at contract termination.
What DPDP Covers
India's Digital Personal Data Protection Act 2023 — notified by MeitY — applies to the processing of digital personal data collected in India or processed in India. The Act is at meity.gov.in/data-protection-framework.
Health data is personal data under DPDP. The Act does not create a separate health-data category as HIPAA does, but health records are implicitly high-sensitivity given their direct identification risk.
Key DPDP obligations for healthtech: purpose limitation (collect only what's necessary); explicit, revocable consent before processing; data principal rights of access, correction, and erasure; security safeguards and breach notification to CERT-In and affected individuals; and for government-designated Significant Data Fiduciaries, a mandatory Data Protection Officer and data protection impact assessments.
ABDM and Health Data in India
The Ayushman Bharat Digital Mission (ABDM) creates a national health record ecosystem. Companies integrating with ABDM process ABHA (Ayushman Bharat Health Account) records tied to Aadhaar or mobile identity. Consent for ABDM-linked records must be explicit, granular, and auditable. ABDM's Health Data Management Policy sets additional standards for data minimisation and interoperability that run alongside DPDP.
Key Differences Between HIPAA and DPDP
| Dimension | HIPAA | DPDP Act 2023 |
|---|---|---|
| Jurisdiction trigger | Processing PHI for/with US covered entities | Processing personal data of India-based individuals |
| Who it applies to | Covered entities + business associates | Any Data Fiduciary processing digital personal data |
| Consent model | Largely Notice-and-Acknowledgement (NPP) | Explicit opt-in consent required |
| Data subject rights | Limited (access, amendment, accounting of disclosures) | Strong: access, correction, erasure, grievance |
| Breach notification | To HHS and affected individuals, 60-day window | To CERT-In and data principals (timeline in Rules) |
| Technical safeguards | Prescriptive Security Rule (encryption, audit logs) | Principle-based; security standards in Rules |
| Health-specific category | Yes — PHI with 18 identifiers | No separate health category; health data is personal data |
| Cross-border data transfer | Permitted with BAA | Permitted to whitelisted countries (Rules pending) |
| Governing body | HHS Office for Civil Rights | Data Protection Board of India (being constituted) |
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanWhich Regime Applies to Your Patient Data
The decision is not either/or. The following flowchart maps out which regime — or both — governs a specific data processing activity.
Scope Comparison: HIPAA vs DPDP
The chart below compares key scope dimensions qualitatively across both frameworks.
HIPAA leads on technical prescriptiveness and health-specific rules. DPDP leads on consent strength and data principal rights. Cross-border rules remain pending under DPDP.
India Health Data Context: CERT-In and Breach Reporting
CERT-In's 2022 directions require all entities to report cybersecurity incidents within six hours of detection. DPDP's breach notification obligations layer on top. The effective requirement is the stricter of the two: report patient record breaches to CERT-In immediately, then follow up with affected data principals as DPDP Rules require.
Practical Controls That Satisfy Both Regimes
The good news is that the technical control sets overlap substantially. Implementing a robust security baseline for HIPAA largely satisfies DPDP's principle-based security requirements too.
| Control Area | HIPAA Requirement | DPDP Requirement | Dual-compliant approach |
|---|---|---|---|
| Encryption at rest | Addressable (strongly recommended) | Implied by security obligation | AES-256 for all health record storage |
| Encryption in transit | Addressable | Implied | TLS 1.2+ minimum on all APIs |
| Access control | Role-based, minimum necessary | Purpose limitation + access control | RBAC tied to declared processing purpose |
| Audit logging | Required — user actions on ePHI | Implied by accountability | Immutable audit log with 6-year retention for HIPAA; retain per DPDP Rules |
| Breach detection | Risk analysis required | Security safeguards required | SIEM or log-alerting with 24-hour internal SLA |
| Consent management | Notice of Privacy Practices | Explicit opt-in consent + withdrawal | Consent ledger with timestamp, purpose, and revocation state |
| Vendor contracts | BAA mandatory | Data Processing Agreement | Execute both BAA and DPA for any sub-processor |
| Data deletion | Right to request restriction | Right of erasure | Technical erasure workflow with audit trail |
Risk Analysis: the HIPAA requirement most Indian vendors miss
HIPAA's Security Rule requires a documented risk analysis — an assessment of threats and vulnerabilities to ePHI. Indian business associates often implement the technical controls but skip formal risk analysis documentation, leaving them non-compliant on paper. A VAPT covering APIs, cloud configuration, authentication flows, and data storage addresses this requirement and simultaneously produces evidence for DPDP's security obligation. A free VAPT scan is the practical starting point.
When to Execute a BAA
The BAA is a legal instrument, but the trigger is operational: if your platform receives, stores, processes, or transmits data that includes PHI — even in a de-identified-but-not-fully-safe-harbor form — you need a BAA with the US covered entity before data flows begin.
Common scenarios: diagnostic AI for US radiology groups (DICOM metadata is PHI); revenue cycle management SaaS for US clinics; telehealth platforms connecting US doctors with patients; health data analytics for US insurers where claims data is PHI.
ABDM Integration and DPDP Compliance
Companies integrating with ABDM must align their consent architecture with the ABDM Health Data Management Policy and the emerging DPDP framework. Practically this means using ABDM consent artifacts — structured objects specifying data requester, provider, purpose, and expiry — as the basis for your internal consent records. Consent revocation must propagate to all systems where the health record was shared. Treat ABHA-linked data as high-sensitivity personal data under DPDP, with enhanced access controls and audit logging. Getting ABDM consent right positions you well for DPDP compliance once Rules are finalized.
For more compliance guidance, explore the Bachao.AI blog or the dedicated DPDP compliance page. The platform is built by Dhisattva AI Pvt Ltd, a DPIIT Recognized Startup focused on automated security for Indian businesses.