A six-doctor clinic digitising patient records, WhatsApp reminders, UPI and an AI symptom chatbot
A six-doctor neighbourhood clinic in Pune wants to go digital within a month. It plans to (1) upload about 9,000 patient records, including names, phone numbers, diagnoses and prescriptions, to a SaaS practice-management app whose servers are in Singapore and whose free plan states that the data 'may be used to improve the service'; (2) send appointment reminders and lab reports to patients over WhatsApp from the receptionist's personal number; (3) accept UPI payments through a printed QR code at the counter; and (4) pilot an AI chatbot that asks patients about their symptoms and suggests 'possible conditions' before they book. All six doctors share one login on the clinic's desktop computer, and a part-time helper who also acts as accountant keeps the passwords in a notebook. The clinic's IT helper says patient data rules apply only to government hospitals, and that a consent checkbox on the registration form is enough.
1. Assess the clinic's plan against India's digital personal data protection framework and list the gaps that must be closed before go-live.
Read the worked answer
The IT helper is wrong on both counts. The Digital Personal Data Protection Act, 2023 applies to digital personal data about individuals processed in India, whoever the data fiduciary is; a six-doctor private clinic is a data fiduciary, and no exemption turns on being a government hospital. A pre-ticked or bundled checkbox is not valid consent either: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, limited to the stated purpose, and withdrawable as easily as it was given.
Gaps to close before go-live:
- An itemised, plain-language notice: what is collected, why, for how long, who it is shared with, and how to complain.
- A separate, unbundled consent for uploading records to the Singapore-hosted SaaS. Cross-border transfer is permitted unless the government restricts a destination by notification, but the clinic remains fully accountable for the vendor, so it needs a written processing agreement, security commitments, breach-notification duties and a paid plan if the free tier trains the vendor's models on patient data.
- Retention: records must be kept for the period required by medical-council rules and tax law, and the patient's erasure right yields to those legal obligations, so the policy must say this rather than promise deletion it cannot perform.
- Security safeguards and a breach process: notify the Data Protection Board and affected patients.
- Named grievance redressal, per-doctor accounts with multi-factor authentication, and a password manager instead of the notebook. Penalties for inadequate security safeguards run to Rs 250 crore, which is existential at this scale.
2. The AI symptom chatbot suggests 'possible conditions'. What are the risks and what safeguards would you require before the pilot?
Read the worked answer
The chatbot changes the clinic's risk profile, not just its convenience. A tool that prints 'possible conditions' after a symptom conversation is read by patients as medical advice, and the harm from a missed emergency falls on the clinic even when the tool is a third-party plug-in. The hard case to design for is a patient describing chest pain or breathlessness and being told it is likely acidity.
Safeguards before any pilot:
- Reposition it as triage and navigation, not diagnosis: no disease names in its output, only urgency and which service to use.
- Red-flag routing: chest pain, breathlessness, stroke signs, bleeding in pregnancy, high fever in an infant and similar patterns bypass the chatbot entirely and show a call-the-doctor or emergency number.
- Persistent, unmissable disclaimer, and never let the bot delay access to a human.
- A doctor reviews every escalation, and a weekly sample of ordinary conversations is audited.
- Written clinical sign-off and a documented check on whether the specific claims make the software a regulated medical device, which is a legal question, not a vendor's assurance.
- Data protection: symptom data is health data collected for a new purpose, so it needs its own specific consent; no training or 'improvement' on real patient conversations without a separately obtained, unbundled consent; and never paste identifiable records into a free public chatbot.
3. Recommend the practical operational controls for the WhatsApp reminders, the UPI QR code and the shared login, explaining the specific fraud or leakage each control prevents.
Read the worked answer
WhatsApp: move off the receptionist's personal number. That account is tied to one employee who may leave, exposes her personal number to every patient, and disappears with her phone. Use a dedicated clinic number and, as volume grows, the WhatsApp Business API so messages are logged and templates approved. Send the minimum: a time, a date, and 'your report is ready, please collect it'. Sending diagnoses or lab values risks disclosure to a shared family phone or a wrong number, and screenshots circulate.
UPI: the printed QR must be a static merchant QR bound to the clinic's business account, not a personal VPA, so receipts land in the clinic's books and a departing staff member cannot redirect them. Staff must never confirm payment from a patient's screenshot, and must never approve a UPI 'collect request' at the counter: the common fraud is a fake payment screenshot, or a collect request that debits the clinic rather than paying it. Verify in the merchant app's own transaction list.
Login: one shared account means no accountability and no way to tell who viewed a celebrity's or a relative's record. Issue one account per doctor and per staff role, apply least privilege so reception cannot open clinical notes, enable multi-factor authentication, and put credentials in a password manager with a named owner. Restrict and log export of patient data, and revoke access the day a locum or helper leaves.