Industries · Healthcare
Patient records outlive the visit. Know who can see them and why.
A patient's record at a hospital starts at registration and grows with every consultation, lab test, scan and discharge. It is read by doctors, nurses, billing staff, the pharmacy, insurers and TPAs, and often by an outside lab or a teleconsultation vendor. Old records sit in the HIS, the PACS archive and paper files for years.
What you hold
The personal data in a typical week
The register every duty starts from. In TrustOS each category is linked to the systems that hold it, the purposes it serves and an owner.
Data register · Healthcare6 categories
- Registration details and ABHA numbers
- Consultation notes, prescriptions and discharge summaries
- Lab reports and imaging studies
- Billing, insurance and TPA claim records
- Records of children, collected through a parent or guardian
- CCTV footage and visitor logs
Pressure points
Where the DPDP Act bites in healthcare
Wide internal access
In many hospitals anyone with an HIS login can open any patient's record. The Rules expect access control and logs, so you need to know who looked at what and be able to show it.
Medical emergencies and consent
The Act allows processing without consent for a medical emergency. Teams still need to record when they relied on that ground, and go back to consent once the emergency has passed.
Children and patients who cannot consent
Paediatric wards, ICU patients and patients with a guardian all bring consent from someone other than the patient. The Rules exempt some care given to children by clinical establishments, so record which ground applies to each flow.
Records that must be kept, and those that need not be
Medical records have retention rules of their own. Marketing lists built from patient phone numbers and old health camp registrations usually do not, and should be erased when their purpose ends.
How TrustOS helps
The modules that matter most here
List what the HIS, LIS, PACS, pharmacy system and teleconsultation app hold, and who owns each one.
Let patients and guardians request a copy of their information or raise a grievance online, without a trip to the medical records counter.
Keep clinical records for the period your medical records policy sets, while marketing and camp lists get their own, shorter rules.
If a lab vendor's portal leaks reports, record what was exposed, whom to tell and when each notice went out.
Produce an evidence pack for an accreditation visit or a Board query showing notices, consents and access reviews.
What it looks like in TrustOS · sample data
An example scenario
Illustrative example: a patient asks who saw her reports
Suppose a patient at a multi-speciality hospital raises a grievance that a relative working in billing knew her diagnosis. In this hypothetical, the privacy officer opens a grievance in TrustOS, asks IT for the HIS access log, records the finding and the corrective action, and replies to the patient within the timeline in the hospital's published policy.
Rules that sit alongside the Act
- ABDM health data management policy
- Medical Council regulations on maintenance of medical records
- Clinical establishment rules on records, where a State has adopted them
- ICMR ethical guidelines for biomedical and health research
TrustOS helps you keep these obligations in the same record. Your counsel decides how they apply to you.
Watch the film
Clinics, labs and hospitals
Patients trust you with their health. What the DPDP Act asks of a clinic, and how proof for audits becomes everyday work.
For organisations · Healthcare
Clinics, labs and hospitals
Patients trust you with their health. What the DPDP Act asks of a clinic, and how proof for audits becomes everyday work.
Questions
From healthcare teams
We are part of ABDM. Does that cover the DPDP Act?
Partly. ABDM consent flows cover sharing records through the health network. The DPDP Act applies to all personal data you handle, including staff data, billing, marketing and vendors outside ABDM.
Can a patient ask us to erase their medical records?
They can ask. Where a law or your records policy requires you to keep them, you can decline and explain why. TrustOS keeps the request, the decision and the reason together.
Does TrustOS store clinical records?
No. It records what data exists, where, why, and what has been done with it. The clinical records stay in your HIS and other systems.
For healthcare teams
See TrustOS run on healthcare data
Bring the systems that hold your registration details and ABHA numbers, and the requests your team handles today. We will show the work moving through TrustOS, from the first request to the evidence.
Or get a rollout proposal in two minutes- Step 1A 30 minute demo on Google MeetWith someone who knows the Act and the product.
- Step 2Your systems and purposesWe walk one product's personal data through TrustOS.
- Step 3A first phase you can planModules, owners and effort, written down for you to keep.