How Presco HOS Helps Hospitals Meet the DPDP Act, 2023

What the DPDP Act means for a hospital

The Digital Personal Data Protection Act, 2023 (DPDP Act) governs how the personal data of individuals is collected, used, stored and protected. In a hospital, three roles apply: the patient is the Data Principal (the person the data is about), the hospital is the Data Fiduciary (it decides why and how patient data is processed and is primarily accountable to the patient), and the software vendor — Presco / Neuralbits — is the Data Processor (it operates the platform and hosts the data on the hospital's behalf).

Getting this right is no longer optional. Patients are increasingly aware of their data rights, insurers and government schemes expect demonstrable controls, and the Act carries real penalties. The practical question for a hospital is simple: which parts of compliance does my software give me out of the box, and which parts must I own as an organisation?

Compliance is shared — and that is the whole point

DPDP compliance in a hospital is a shared responsibility. It splits cleanly into two halves. The technical half — encryption, access control, audit trails, authentication, breach detection, backups — is delivered by the platform. The organisational half — the privacy policy, the designated Grievance Officer, staff training, third-party data agreements — is owned by the hospital, which is the Data Fiduciary.

A good EMR closes the technical half completely, so the hospital only has to focus on its own policies and people. That is exactly how Presco HOS is designed: the platform ships the data-protection controls, and the hospital operates them within its own governance.

The platform half: what Presco HOS delivers

On the platform side, Presco HOS provides role-based access control with hospital-level data isolation, unique user IDs with no shared logins (so every action is attributed to an individual), multi-factor authentication for privileged users, and encryption of data both in transit (HTTPS/TLS) and at rest on secured AWS infrastructure.

It also provides a tamper-evident audit trail that records who did what and when — with before-and-after values, user identity, IP and timestamp — a complete consent-management module with versioned templates and OTP or drawn e-signature, scheduled cloud backups with restore validation, and a breach detection and response capability backed by periodic security testing (VAPT).

Why NABH certification already covers the DPDP technical controls

Here is the part many hospitals miss. Presco HOS is a NABH-certified platform, and NABH's chapters on Digital Access & Communication (DAC), Document & Operations Management (DOM) and Information Management (IMS) are, in substance, information-security and data-governance standards. Because those controls were built and independently assessed for NABH, the corresponding DPDP technical obligations are already met at the platform level.

The mapping is direct: DAC.2.a (encryption) implements DPDP encryption; DAC.2.b and DOM.1.a (role-based access) implement access control; DAC.2.c (audit-log capture) implements the audit trail; DOM.4.e (MFA) and DOM.4.d (centralised user management) implement authentication and unique IDs; DOM.1.e (backup) implements recovery; and IMS.3.a (ISO 27001:2022) provides the overarching security posture. In effect, the same evidence that earned NABH certification demonstrates the technical half of DPDP.

The hospital's half — and formalising the split

That leaves the organisational measures, which sit within the hospital's own policy framework: documenting purpose limitation in a privacy policy, designating and publishing a Grievance Officer, running staff DPDP-awareness training, and executing data-sharing agreements with labs, TPAs and insurers. Presco HOS supports each of these — recording training completion, routing in-app grievances, and providing permissioned data exchange — but the hospital, as Data Fiduciary, owns them.

To align the contract with the Act, a DPDP-specific Data Processing Addendum is recommended on top of the subscription agreement — formalising purpose limitation, breach-notification timelines, sub-processor terms and assistance with patient (data-principal) requests. None of this is legal advice; it should be finalised with the hospital's compliance advisors. But the shape is clear: with an NABH-certified, DPDP-ready platform doing the technical heavy lifting, a hospital's path to DPDP compliance is far shorter than it first appears.