Is it safe to use AI to message patients? Privacy and the DPDP Act explained simply

What should an assistant never have access to?

Clinical records. Diagnoses, test results, imaging, prescriptions and case notes have no business in a messaging assistant, and a provider suggesting otherwise should give you pause.

What it legitimately needs is small: the patient's name, their phone number, what they are booked in for, when, and the messages exchanged about that appointment. That is enough to run a front desk.

What does India's DPDP Act expect from a clinic?

The Digital Personal Data Protection Act, 2023 treats your clinic as responsible for the personal data of your patients. If you use a provider to process it, that does not transfer the responsibility — you remain accountable for what they do with it.

In practice that means four things you should be able to answer about any assistant running on your number.

• Consent: patients know what you are collecting and why, and agreed to it
• Purpose limitation: the data is used to run their care and nothing else
• Withdrawal: a patient can stop messages and ask for deletion, and it actually happens
• Security: the data is encrypted, access is limited, and it is deleted when you end the arrangement

Should patients be told they are talking to an assistant?

Yes, plainly, and it costs you nothing. An assistant that introduces itself as the clinic's assistant and offers a person at any time is received far better than one discovered to be automated.

The failure mode to avoid is a system designed to pass as human. When a patient works it out — and they do — the trust lost extends to the clinic, not just the software.

What happens in an emergency?

The assistant must not attempt to handle it. The correct behaviour is to recognise urgency and tell the patient immediately to call the clinic or emergency services, without triage and without reassurance.

Ask any provider to show you exactly what their assistant does with an urgent message. If they cannot demonstrate it, that is an answer in itself.

What should you ask a provider before signing?

Five questions, and you should get direct answers to all of them.

• What patient data do you store, and for how long?
• Who at your company can read our patients' conversations?
• What happens to the data if we leave?
• How do you handle a patient asking to be deleted?
• Can you show me what the assistant does with a medical question and with an emergency?

What about clinics outside India?

Different rules apply and they are stricter in places. UK and EU clinics fall under GDPR, with specific requirements for health-related data. US clinics handling protected health information need HIPAA compliance and signed business associate agreements with every vendor in the chain.

If a provider offers to work with a US clinic without mentioning HIPAA, treat that as disqualifying.