• Under MCI Regulation 1.3.2, if a patient or authorized attendant formally requests their records, the hospital must provide certified copies within 72 hours.
• NABH-accredited hospitals typically retain records for 5+ years, beyond the statutory 3-year minimum.
• With India's Ayushman Bharat Digital Mission (ABDM) rollout, discharge summaries, lab reports, and prescriptions are increasingly being linked digitally to a patient's ABHA health ID, though the physical/statutory documents above remain the compulsory baseline.

• 1.3.1: Every physician must maintain indoor patient (IPD) records for a minimum of 3 years from the date treatment started, in the standard proforma (Appendix 3).
• 1.3.2: If the patient, an authorized attendant, or a legal authority requests records, the hospital must acknowledge and issue them within 72 hours.
• 1.3.3: A register of all medical certificates issued must be maintained, with patient identification and signature.
• 1.3.4: Hospitals are encouraged to computerize records for faster retrieval.
• Regulation 7.2: Failure to maintain records for 3 years, or refusing to hand them over within 72 hours, is treated as professional misconduct, actionable by the State Medical Council.

• Rule 9(iv) requires registered clinical establishments to maintain Electronic Medical Records/Electronic Health Records per government-issued EHR Standards, as noted in this analysis of health data privacy laws.
• The draft/proposed CE Rules also state records must be kept for at least 3 to 5 years, or longer if another applicable law demands it.
• Important caveat: the CE Act is a central law but only applies in states that have specifically adopted it (several states, including large ones like Maharashtra and Tamil Nadu at various points, have not fully adopted it or run parallel state-specific clinical establishment acts).

• OPD records: retain for 5 years
• IPD case sheets (both MLC and non-MLC): retain for 10 years This isn't binding legislation but is treated as the operational benchmark in many hospital manuals and is cited in hospital administration literature.

• In S.A. Qureshi v. Padode Memorial Hospital (2000, Bhopal), the hospital's claim that it destroyed the case sheet "as per general practice" was rejected - the court held the hospital should have retained records until the complaint was resolved, and found negligence partly on this basis.
• In Raghunath Raheja v. Maharashtra Medical Council (Bombay HC, AIR 1996), the court strongly upheld a patient's right to their own medical record.
• More recently, Jothi v. State (Madras HC, 2023) held that a government hospital withholding records amounts to professional misconduct and reaffirmed the 72-hour rule.

• PNDT Act, 1994 (Section 29): records must be kept for 2 years, or until any legal proceeding under the Act is disposed of - relevant for ultrasound/sonography clinics.
• Similar sector-specific rules exist under drug/pharmacy laws for certain registers.

1. Who is who under the Act

• Data Principal - the patient (the individual the data belongs to).
• Data Fiduciary - the entity that decides why and how data is processed. Hospitals, clinics, diagnostic centres, telemedicine platforms, and health-tech companies are Data Fiduciaries with respect to patient data, since they determine the purpose of collection.
• Data Processor - entities that process data on behalf of a fiduciary, following its instructions. EMR/EHR vendors, cloud hosting providers, billing software, and lab-integration platforms are typically Data Processors, per this breakdown of healthcare data compliance under DPDPA.
• Significant Data Fiduciary (SDF) - a category the government can notify based on volume/sensitivity of data, risk to rights of individuals, and other factors under Section 10. Large hospital chains or health-tech platforms handling data at scale could be notified as SDFs, which brings extra obligations (mandatory Data Protection Officer, Data Protection Impact Assessments, independent audits).

2. What hospitals (as Data Fiduciaries) must do

3. What this means specifically for EMR/health-tech companies

• The hospital remains the liable party, not the EMR vendor, even when the vendor's system is what actually leaks data. Per the interlegal.net analysis of vendor liability: "statutory liability rests with the healthcare entity as Data Fiduciary, not the cloud vendor... regardless of any contractual arrangement." If an EMR vendor's cloud infrastructure is breached, the hospital still faces the full DPDPA penalty exposure.
• Because of this, hospitals need proper Data Processing Agreements (DPAs) with every EMR vendor, cloud host, lab-integration partner, and billing processor - contracts that impose matching security obligations, confidentiality terms, breach-cooperation clauses, and indemnification. A hospital relying on a vendor's generic SaaS terms-of-service, not calibrated to DPDPA, still carries the compliance risk itself.
• EMR vendors' own obligations: as Data Processors, they must follow the fiduciary's instructions, implement the security measures contractually required, support audit trails and access logs (critical for demonstrating tiered access control by department/specialty), and cooperate on breach investigation and Data Protection Board inquiries.
• When an EMR company can become a Data Fiduciary in its own right: if it independently decides to use patient data for its own purposes - e.g., aggregating de-identified data for a commercial analytics product, training an AI model, or selling insights - it stops acting purely as a processor for that specific use and takes on fiduciary obligations (its own consent basis, notice, and liability) for that processing activity.
• Health-tech/EMR companies operating at scale (large patient volumes, multiple hospital clients) are prime candidates for being notified as Significant Data Fiduciaries, triggering mandatory DPO appointment, periodic DPIAs, and independent data audits.

4. How DPDP interacts with the older framework

• NMC Code of Ethics Regulations 2002 (3-year retention, 72-hour access) still governs retention duration and the patient's right to get their own records.
• Clinical Establishments Act 2010 + Rules 2012 (EMR/EHR maintenance standards) now needs updated breach-reporting and record-management practices to align with DPDP.
• IT Act 2000, Sections 43A and 72A (compensation for negligent handling of sensitive data, and penalty for disclosure in breach of contract) continue to apply alongside DPDP, not instead of it.
• Mental Healthcare Act 2017 and Rights of Persons with Disabilities Act 2016 protections for particularly sensitive categories (psychiatric records, disability data) are reinforced, not superseded, by DPDP.
• The Ayushman Bharat Digital Mission (ABDM)/ABHA ecosystem, where records increasingly move between hospitals digitally with patient consent, now operates under the DPDP consent framework as its legal backbone.

5. Practical compliance checklist