Patient Data Breach: Legal Duties of Hospitals in India

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

A hospital holds patient data under a legal duty, not a courtesy. Section 43A of the IT Act, 2000 makes a body corporate liable for negligent security practices, and the DPDP Act, 2023 requires hospitals to protect data and to notify breaches. This guide covers the duties, the first steps after discovery, liability and a patient's remedy.

A hospital in India holds some of the most sensitive personal data there is, and it holds it under a legal duty rather than a courtesy. Section 43A of the Information Technology Act, 2000 makes a body corporate liable to compensate for negligence in maintaining reasonable security practices and procedures where that negligence causes wrongful loss or wrongful gain, and the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary to secure personal data and to notify a breach to the Data Protection Board and to affected patients.

The inquiry that follows a patient data breach has two faces. The regulator asks how the hospital protected the data and how quickly it disclosed the failure. The patient asks who failed and what it cost. This guide sets out what the law requires, what a hospital must do in the first days after discovery, who can be held liable, and how each side should respond.

What the law requires of a hospital

Two regimes run together. The IT Act creates a compensation duty: section 43A attaches liability to a body corporate that is negligent in implementing and maintaining reasonable security practices, and section 43 covers unauthorised access to, downloading from or disruption of a computer resource. The DPDP Act, 2023 creates regulatory duties for the Data Fiduciary, which in a hospital setting is the hospital itself, and imposes obligations of security, accuracy, purpose limitation and breach notification.

Health data is also where the concept of sensitiveness bites hardest. A patient's diagnosis, prescriptions, reports and identifiers are personal data, and often sensitive in ordinary language even where the statute does not use that word. A hospital that treats its patient management system as ordinary business software, and its data as ordinary business data, is already behind the standard the law expects.

One point must be stated plainly because the position is unsettled. The DPDP Act provides, in its Schedule, for the omission of section 43A of the IT Act, but that amendment has not been brought into force. Until it is, section 43A remains the basis on which a patient claims compensation for a negligent breach.

Who can be held liable, and for what

Party	Exposure	Provision
The hospital as body corporate	Compensation for negligent security	IT Act s 43A
The hospital as Data Fiduciary	Notification duty and regulatory penalty	DPDP Act 2023
A staff member who leaks records	Unauthorised access or disclosure	IT Act ss 43, 66, 72
An outsider who intrudes	Unauthorised access, identity theft, impersonation	IT Act ss 66, 66C, 66D
A processing vendor or IT contractor	Breach of contract, negligence	Contract; IT Act s 43A
Anyone who trades records for gain	Criminal breach of trust, cheating	BNS 2023 ss 316, 318

The table explains why a breach rarely has a single defendant. A patient sues the hospital because the hospital is the fiduciary; the hospital sues the vendor because the vendor broke a contract; the police investigate the person who accessed the records. All three can proceed at once, and none of them cancels the others.

The first 72 hours after discovery

Contain the incident. Disable the compromised account or system, but image the affected machines and preserve logs before anything is rebuilt.
Establish the facts in writing: what data was involved, how many patients, which systems and which dates.
Report the personal data breach to the Data Protection Board and to affected patients, as the DPDP Act requires.
Report specified cyber incidents to CERT-In within six hours under its directions, and file on cybercrime.gov.in; dial 1930 if any payment or account has been compromised.
File a written complaint at the police station with jurisdiction. The first information is registered under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023.
Serve a notice under section 94 of the BNSS where records needed as evidence are held by a vendor or another third party.
Record every electronic item in a form that carries the certificate required by section 63(4) of the Bharatiya Sakshya Adhiniyam, 2023.
Brief the clinical and administrative leadership, and fix a single person to speak publicly, so that patients hear one account rather than five.

The order matters. A hospital that notifies before it understands the facts risks telling patients something it later has to correct; a hospital that waits to understand everything risks missing the reporting window. The workable approach is to report within the deadline with what is known, and to update as facts develop.

Consent, purpose and the medical record

The DPDP Act ties processing to a lawful purpose and, ordinarily, to consent. In a hospital the lawful purpose is treatment, and the reach of consent is broader where care is involved, but that breadth is not unlimited. Using patient data for marketing, for research without proper authorisation, or for sharing with a commercial partner goes past the purpose for which the data was collected, and becomes a breach of the statute rather than a matter of clinical judgment.

Retention is the other half. Medical records are to be kept for the period the applicable clinical and professional regulations prescribe, and after that they should be securely destroyed or anonymised. A hospital that keeps decades of records in a system nobody is responsible for has created a liability that grows with every year of storage and every former employee who knows the credentials.

When staff or vendors are the source of the leak

Insider access is the most common path in health data breaches. Where a staff member copies records without authority, section 43 read with section 66 of the IT Act applies, and where the person obtained access under a power conferred by the Act or its rules, section 72 can apply as well. Where the records are sold or used to cause loss, criminal breach of trust under section 316 of the Bharatiya Nyaya Sanhita, 2023 and cheating under section 318 are available, and a civil suit for damages can run alongside.

Vendors present a different problem, because the access they are given is legitimate. A hospital should be able to show what each vendor can reach, what it is contractually forbidden from doing with the data, and how quickly it must report an incident. Where the contract is silent, the hospital's position in the dispute is weaker than it should be, whatever the vendor did.

A patient's route to remedy

A patient who discovers that their records were exposed has three routes, and they are not mutually exclusive. First, a complaint to the hospital itself, recorded in writing with a reference number, which creates the paper trail that everything else depends on. Second, a report to the police and on the national cybercrime portal where a criminal act is suspected. Third, a claim for compensation under section 43A of the IT Act against the hospital as body corporate, which is brought before the appropriate forum and requires the patient to show both the loss and the hospital's negligence.

Where the exposure also amounts to professional negligence in treatment, the patient may separately raise the matter before the consumer forum under the Consumer Protection Act, 2019. The two claims address different wrongs, and choosing one does not close off the other.

Duties beyond the two statutes

Data protection law is not the only source of a hospital's obligations. Clinical establishment and medical professional regulations govern how medical records are created, maintained, shared and released, and they operate alongside the DPDP Act rather than beneath it. A hospital that satisfies its IT security but releases records to the wrong person, or destroys them too early, is still in breach of its professional duties. The two questions, who may see the record and how it is secured, need separate answers.

Secondary use: research, registries and analytics

Hospitals increasingly share data with registries, insurers, research partners and analytics vendors. Each of those arrangements is processing for a purpose different from treatment, and each needs a lawful basis and a clear boundary. Anonymisation done carelessly is not anonymisation, and a dataset that can be re-identified by combining a date of birth with a rare diagnosis is still personal data. A hospital should be able to state, for every external data flow, what is shared, why, with whom, and how it is protected.

How the investigation actually runs

Once a complaint is registered, the investigating agency will ordinarily seek the hospital's logs, access records and system configuration, and will use the BNSS provisions on production of documents and electronic records to reach material held by vendors and cloud providers. The agency's real question is attribution: which account, which device, which person. A hospital that preserved its records properly helps the investigation even when it is also defending a civil claim, and a hospital that did not preserve them ends up unable to prove either its diligence or the intruder's identity.

What decides the outcome

For compensation under section 43A the deciding questions are whether the hospital had reasonable security practices and whether they were maintained. A policy that exists but was never enforced, a system with shared logins, and an audit trail that cannot be produced all push the same way. Access control, encryption and logging that can be demonstrated are what defensible security looks like in practice.

For the regulatory enquiry under the DPDP Act, the decisive conduct is speed and candour. A hospital that notified patients promptly and honestly stands in a very different position from one that learned of the breach and said nothing until a patient or a journalist did. For the criminal case, the decisive question is attribution: whether an investigating agency can connect a device or an account to a person, which is why the hospital's logs matter even when the hospital is not the accused.

What not to do

Do not reset or rebuild affected systems before they are imaged.
Do not tell patients less than you know in order to control the message.
Do not let a single external vendor hold the only copy of the logs.
Do not treat the breach as a reputational problem before treating it as a legal one.
Do not assume the cloud provider of the hospital system has taken care of the compliance.
Do not wait for the full picture before making the statutory notifications.

When to involve a lawyer

For a hospital, the moment to take advice is the moment a breach is discovered, because the first decisions decide what can still be defended. For a patient, the moment to take advice is when the hospital's account of the incident stops adding up, or when a loss needs to be quantified for a claim. A cyber crime lawyer in Kolkata can advise on both sides, from notification obligations to a compensation claim, and the firm's contact page is the place to raise a specific matter rather than discuss it in the abstract.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What are a hospital's legal duties after a patient data breach?

Under the DPDP Act 2023 a hospital, as Data Fiduciary, must notify the Data Protection Board and affected patients of a personal data breach, and must maintain reasonable security for personal data. Specified cyber incidents must also be reported to CERT-In within six hours, and a police complaint should be filed where an offence is suspected. Records must be preserved in an admissible form.

Is a hospital liable if patient records are leaked?

Potentially yes, under section 43A of the IT Act, 2000, which makes a body corporate liable to compensate where negligence in maintaining reasonable security practices causes wrongful loss. Liability turns on whether reasonable practices existed and were maintained, not on whether a breach occurred. A hospital that documented and enforced its controls is in a far stronger position than one that did not.

Must a hospital tell patients about a data breach?

Yes, where the DPDP Act 2023 applies. The Data Fiduciary must notify a personal data breach to the Data Protection Board and to each affected Data Principal. Patients should be told what data was involved and what risk it creates. Delay in notification weighs against the hospital in any later claim, and concealing a breach is treated more seriously than the breach itself.

Can a hospital be prosecuted, not just sued, over patient data?

The hospital itself is primarily exposed to compensation under section 43A of the IT Act and to penalties under the DPDP Act 2023. Criminal liability usually attaches to individuals: a staff member who leaks records may face sections 43 and 66 of the IT Act, an intruder may face sections 66, 66C and 66D, and trading records for gain may attract sections 316 and 318 of the BNS 2023.

Who is responsible when an employee leaks medical records?

The employee can be charged under sections 43 and 66 of the IT Act for unauthorised access and disclosure, and under section 72 where the access came from a power conferred by the Act. The hospital remains answerable to the patient as Data Fiduciary, and can recover from the employee or vendor in contract or negligence. The hospital's logging is often what makes the case provable.

How does a patient file a complaint about a data leak?

Complain in writing to the hospital and keep the reference number, then report the matter on cybercrime.gov.in and at the police station with jurisdiction, where the first information is registered under section 173 of the BNSS 2023. If the police decline to register it, apply to the Magistrate under section 175(3) of the BNSS. A compensation claim can run alongside.

Does the DPDP Act 2023 apply to hospital and health records?

Yes. The Act applies to digital personal data, and a patient's diagnosis, prescriptions, reports and identifiers fall within it. The hospital is the Data Fiduciary and must follow the Act's rules on notice, purpose limitation, security and breach notification. Its vendors are Data Processors, which does not reduce the hospital's own obligations to the patient.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact