Picture a busy clinic on a Monday morning. The doctor is in consultation. The receptionist is answering the appointment line, which is really a smartphone in a drawer, logged into a messaging app. Patients send their names, their symptoms, sometimes a photo of a rash or a scanned prescription. A second staff member checks the same phone when the receptionist is at lunch. Last month's locum read it too, and nobody has taken the app off his own handset.

None of this feels like a data protection problem. It feels like running a clinic. But under the Digital Personal Data Protection Act, that one phone is probably the most exposed point of patient data in the practice.

Why a Phone Is Not Just a Phone

The messaging app itself is rarely the issue. The issue is everything around it. Whose phone is it? Who knows the passcode? Who can read the chats? What happens when someone leaves? Where do the photos patients send end up, and are they backed up somewhere nobody remembers setting up?

Health details in a chat are personal data, and the clinic that decides how they are used is the Data Fiduciary. Section 8(5) of the Act requires reasonable security safeguards to protect that data, and Rule 6 of the DPDP Rules, 2025 spells out the minimum. Three of its measures bear directly on the reception phone: controlling access to the systems that hold the data, keeping visibility on who accessed it through logs and monitoring, and keeping those logs for a year. A drawer phone with a shared passcode meets none of them. Nobody can say who read a given chat, and nobody can cut off a person who has left.

Three Ways It Goes Wrong

These scenarios are illustrative, but each is the kind of thing that happens in small practices every week.

The wrong number. A receptionist types a patient's number slightly wrong and sends a prescription or a lab result to a stranger. Under the Act, accidental disclosure of personal data to someone not entitled to it is a personal data breach, and there is no minimum size. Section 8(6) and Rule 7 then require notification to the Data Protection Board and the affected patient, with an initial alert without delay and a detailed report within 72 hours.

The departed employee. A receptionist leaves on bad terms. The chats are still on her own handset, because the clinic used her phone. The clinic has no way to see what she kept, and no way to prove it did what a reasonable clinic would do.

The reminder that becomes a promotion. The same number that sends appointment reminders starts sending a festive discount on a cosmetic procedure. A reminder for a booked visit sits within the purpose the patient gave their number for. A promotion is a different purpose and needs the patient's consent. Mixing the two on one channel makes it easy to cross the line without noticing.

What a Small Clinic Can Do This Week

None of this needs a technology budget. It needs a few deliberate choices.

• Give the clinic its own number on a clinic-owned device. Not a doctor's personal handset and not a receptionist's. When someone leaves, the number stays and only their access goes.
• Give each staff member their own login where the tool allows it. A business messaging tool that supports several users, each signing in as themselves, gives you the access control and the record of who did what that Rule 6 expects.
• Lock the device and turn on encryption. A passcode that two people share is a placeholder, not a safeguard.
• Write a three-line staff rule. No patient chats on personal phones, no forwarding screenshots, no photos saved to personal galleries.
• Separate reminders from marketing. Use appointment messages for care. For promotions, keep a list of patients who have said yes, with the date and what they agreed to, and honour a withdrawal as easily as they gave the consent.
• Check what the app backs up and where. Chats and photos often sync to personal cloud accounts that the clinic does not control.
• Prepare for the wrong-number day. Decide now who confirms it is a breach, who contacts the patient and who files with the Board.

Why Not Wait

The Rules' core operational provisions, including security safeguards and breach notification, take effect on 13 May 2027. The ceilings in the Schedule run up to ₹250 crore for failing to maintain reasonable safeguards and up to ₹200 crore for failing to notify a breach. Those are ceilings, not predictions for a small clinic, and the Board is directed to weigh the circumstances, including the steps a clinic took to limit harm. A practice that can show it separated its patient line from personal phones and controlled access is in a far better position than one that cannot.

The fix is also cheap right now and expensive later. Moving a patient line to a managed number is a one-afternoon job today. Doing it after a complaint, with years of chats scattered across personal devices, is not.

For the full picture on roles, legal basis, record retention, security and breach response for small practices, see RuleExpert's complete guide to DPDP compliance for clinics. This article reflects publicly available regulatory information at the time of writing and does not constitute legal advice.