Published Paper Details:

Healthcare data is one of the most sensitive personal pieces of information that a person creates - it captures not only physical statuses but mental health background, reproductive status, genetic formation, and patterns of behaviour that, when revealed, may lead to discrimination, financial abuse, damaged reputation, and severe abuse of personal dignity. The healthcare industry in India with its fast digitalization and the adoption of electronic health records, telemedicine platforms, insurance portals, and government health schemes like Ayushman Bharat are taking a more appealing form to cybercriminals. There has been a significant increase in the number of data breaches of hospitals, health-tech firms, and state health databases in the country, but the legal framework concerning the protection of health data is fragmented, under-enforced, and, until the recent adoption of the Digital Personal Data Protection Act, 2023, does not include a specific data protection law. In this paper, a thorough review of the Indian healthcare data breach problem is performed using the prism of a cybercrime law and a data protection law. It examines the character and extent of healthcare data breaches, charts out the current legal context such as the Information Technology Act, 2000, the DPDP Act, 2023, and the industry-specific regulations, and critically assesses how these tools are sufficient to prevent breaches and safeguard patients. The paper contends that India is at a crossroad: the IT infrastructure of digital health is being developed on a massive scale and the legal framework of protecting the information that infrastructure produces must be developed equally seriously.