DPDP for Hospitals and Healthcare

Can a hospital process my child's health data without going through the usual parental consent process?

In defined situations, yes. Clinical establishments, mental health establishments and healthcare professionals can handle a child's health information outside the usual consent process, but only as far as is necessary to protect the child's health.

Allied healthcare professionals have a narrower version of the same allowance, for carrying out a treatment or referral plan that has already been recommended.

ACT + RULES · Section 9; Fourth Schedule Part A, items 1 and 2.

Can a hospital use my treatment records for marketing or share them with an insurer?

Not automatically. Collecting your details in order to treat you does not, on its own, give the hospital a reason to market to you or to pass your records to an insurer. Each of those is a separate purpose and needs a reason of its own.

ACT · Sections 4 and 6.

Can a hospital share my records with another hospital or specialist without asking again?

Only where the sharing genuinely fits the treatment you came for. A referral to a specialist can sit inside the original purpose. Sending your file somewhere unconnected to your care does not.

The hospital also has to make sure what it passes on is complete, accurate and up to date, because someone is going to make a decision about you using it.

ACT · Sections 4, 6 and 8(3).

Can they keep my records after treatment is over?

Only while there is still a live reason, or while another law requires it. Medical record rules often set their own periods and those apply. Once neither holds, the records should be deleted.

ACT · Section 8(7).

What if I was treated in an emergency and never gave formal consent?

That is expressly allowed. Treating someone in a medical emergency, where life is threatened or health is under immediate threat, is one of the situations where nobody has to be asked first. So is acting during an epidemic or another threat to public health.

It covers the emergency, not everything after it. Once you are stable, the ordinary rules resume for anything else the hospital wants to do with your information.

ACT · Section 7(f) and 7(g).

Can the hospital send my reports over WhatsApp?

No particular app is banned. What the law requires is that the hospital protects your information with reasonable security safeguards, and puts real measures in place rather than assuming things are fine.

That turns it into a practical question. Sending a report to a number nobody checked, or into a group, is exactly how this goes wrong. If it does go wrong it is a breach, and the hospital has to tell you and the Data Protection Board about it.

ACT · Sections 8(4), 8(5) and 8(6).

My employer paid for my health checkup. Can they see the results?

Paying for it does not make it their information. The findings are about you, so you are the person the law protects here, and the hospital or lab holding them answers to you.

An employer can normally be told what it needs to run the benefit it arranged, such as whether you attended. Your actual results are a different purpose, and it needs a reason of its own. There is no situation on the law's short list that covers an employer reading your medical findings, so in practice that means your specific agreement rather than a line buried in the health check package.

Agreement asked for by your own employer is also hard to call freely given, which is a problem for whoever is relying on it.

ACT · Sections 6(1) and 7(i).

You consented at registration, so we can share your records with our insurance or diagnostics partner.

Agreeing at registration covers your treatment. Passing your records to a commercial partner is a different purpose, and it needs a reason of its own.

You were treated in an emergency, so the emergency provision covers everything we do with your data now.

The emergency allowance covers responding to the threat to life, or the immediate threat to health. Once that has passed, the ordinary rules resume for anything further.

We are a hospital, so we never need parental consent for a child's data.

The child health exceptions are capped at what is necessary to protect that particular child's health. Billing analytics, marketing, research and passing data to outside companies all sit outside the cap, and each needs a parent's verifiable consent.