DPDP Act in Practice – Policy to Practice for Mission Hospitals

Organized by: Christian Medical Association of India (CMAI) in partnership with The Centre for Bioethics (TCB) and CIHSR.

The Christian Medical Association of India (CMAI) successfully conducted the fifth session of its "Understanding Practical Bioethics" series. This session, titled "Policy to Practice: Real-Life Scenarios for Mission Hospitals & Clinical Teams," moved beyond legal theory to address the practical implementation of the Digital Personal Data Protection (DPDP) Act in resource-constrained settings.

Recap: Moving from Theory to the Bedside
The session was hosted by Atemla Anichari (CIHSR) and moderated by Dr Abhijeet Sangma (CMAI). Resource persons Dr Joy Mammen and Ms Anisha Koshy from CMC Vellore returned to lead the discussion through a clinical case study following "Meera," an antenatal patient, from her first registration to her follow-up care.

Key Discussion Points & Case Study Insights

Operationalizing Itemized Consent: The experts detailed that consent must be "valid"—meaning it is free, specific, informed, unambiguous, unconditional, and revocable. For mission hospitals, this means moving away from "blanket signatures" to forms where patients can opt-in to specific uses of their data (e.g., clinical care vs. research).
The Data Lifecycle: Hospitals were guided on the importance of data minimization (collecting only what is necessary), secure storage (encryption), and clear retention policies. A significant point of discussion was the "right to erasure," where patients can request data deletion, provided it is not a medico-legal case.

Institutional Safeguards in Resource-Poor Settings:

Role-Based Access: Implementing individual logins for staff to prevent unauthorized data viewing.
Physical Privacy: Simple moves like angling computer screens away from public corridors and avoiding discussing sensitive results in crowded areas.
The WhatsApp Dilemma: The experts reiterated that WhatsApp remains a "no-go" for official clinical data sharing due to the risk of unauthorized forwarding and lack of institutional control.

Six Practical Moves for Compliance:

1. Name your Lead: Appoint a Data Protection Officer (DPO).
2. Redesign Forms: Create itemized, one-page consent notices.
3. Close the Access Gap: End shared logins and passwords.
4. Train Briefly: Conduct regular privacy sensitization for all staff.
5. Write Retention Rules: Define how long data is kept.
6. Map your Data: Know exactly where your digital "data lakes" live.

Engagement and Reach
The webinar demonstrated strong community interest and active participation. 108 healthcare professionals registered for the Webinar and 107 attendees remained logged in for more than 30 minutes, showing high engagement with the case studies. The audience included Nurses (37%), Doctors (31%), Healthcare Managers (17%), Allied Health Professionals (13%), and Chaplains (3%). Participants joined from more than 21 states, highlighting the universal concern across Indian mission hospitals regarding digital compliance and data protection.

Conclusion
Compliance is not just an IT issue but a shift in institutional culture. Protecting patient data is a modern extension of the "Do No Harm" principle and is vital for maintaining the trust that sits at the heart of bioethics.