Health data is among the most sensitive personal data you can hold, and patients expect confidentiality. The Act has no separate 'sensitive' tier in the text, but risk, security expectations and potential Significant Data Fiduciary designation make care essential.
Consent and legitimate uses
Some healthcare processing may rest on legitimate uses (for example responding to a medical emergency). Document which ground applies to which activity rather than assuming one ground fits all.
Children
Paediatric care involves children's data. The Rules provide prescribed exemptions for certain healthcare purposes - confirm the exact conditions in the notified Rules.
Security basics
- Role-based access to records.
- Encryption and secure backups.
- Access logs for patient files.
- Vendor contracts for lab, imaging, billing and cloud providers.
Retention
Medical-records rules and other laws may require retention. A deletion request does not automatically override a legal retention duty.
Frequently asked questions
Do patients have the right to erasure?+
Subject to legal retention and other exceptions. Record the legal checks performed before erasing.
- Section 7Legitimate uses (alternative to consent)
- Section 8(5)Rule 6 · pending verificationReasonable security safeguards
- Section 8(7)Rule 8 · pending verificationErasure when purpose is served or consent withdrawn
- Section 9Rule 10 · pending verificationChildren's personal data
See where your business stands.
Run a free evidence-based website scan or talk to a compliance specialist about implementation.