Teleconsultation Consent Under NMC Rules and the DPDP Act

The guidelines draw a simple and useful line. If the patient initiates the teleconsultation, consent to the consultation is implied by that act. If anyone else initiates it, consent must be explicit and recorded. That covers the health worker who sets up a consult from a rural centre, the practitioner who calls a patient back to discuss a report, and the corporate health programme that schedules a session on an employee's behalf. Any of these needs a recorded yes, not an assumption.

Implied consent is not, however, blanket consent. It covers this consultation with this practitioner. It does not authorise recording the session, does not authorise sharing the record with a third party, and does not extend to a different practitioner picking up the case later. Hospitals that build on implied consent as though it were a general authorisation are relying on the least defensible reading of the least demanding regime.

The practical design consequence is that your system must know who initiated. A booking made through the patient app, a booking made by the call centre after an outbound campaign, and a session created by a doctor from the follow-up worklist are three different origins with two different consent requirements. Capture origin as a field on the appointment and let it drive whether the explicit consent step appears.

The DPDP Act 2023 makes the hospital a Data Fiduciary and the patient a Data Principal, and it requires that consent be preceded by a notice which states the personal data being collected, the purpose of processing, how the person may withdraw, how they may complain to the Data Protection Board, and how to exercise their rights. The notice must be available in English or any language in the Eighth Schedule, which for most Indian hospitals means at minimum the local language of the catchment area alongside English.

One point deserves stating plainly because it surprises people: the Act does not create a separate, heavier category for health data the way some foreign regimes do. Clinical information is personal data and sits under the same consent architecture as a phone number. That does not make it less sensitive in practice, and it does not relieve you of the security safeguards obligation, but it does mean you should not go looking for a special health provision that is not there.

The obligation that most changes hospital system design is withdrawal. Consent must be as easy to withdraw as it was to give, and withdrawal has to actually stop the processing it applied to. If your only withdrawal path is an email address monitored by nobody in particular, you have a written policy and no capability. Commencement of the Act's provisions has been phased, so confirm with your compliance lead which duties are live for you now rather than assuming all or none.

A notice that runs to eleven screens on a phone is legally present and practically absent. Write the teleconsultation notice as a short primary layer of five or six lines covering what you collect, why, and how to withdraw, with the full text one tap away. Layering is not a loophole; it is the only format that produces genuine awareness on a five-inch screen held by a seventy-year-old in an OPD queue.

Write it in purpose language rather than data-category language. Patients understand to let the doctor see your previous test results and to send your prescription to your registered mobile number. They do not understand for the purposes of service delivery and operational administration, and a notice written that way invites the argument that consent was not informed. If you cannot describe a purpose in one clear sentence, you probably have not decided what it is.

Translation is a real project, not a machine-translation pass. A poorly translated consent notice is worse than an English one because it creates the appearance of comprehension. Get the local-language versions reviewed by staff who counsel patients daily, keep every language version under the same version number, and store which version the patient actually saw. That last field is the one nobody builds and everybody later needs.

Recording a teleconsultation is not covered by the consent to have the consultation. It is a distinct processing activity with its own purpose, its own retention question, and its own risk profile, and it needs its own affirmative capture from both the patient and the practitioner. Some hospitals record everything by default on the theory that it protects them. It cuts both ways: a recording you hold is a recording that can be produced against you, and one you promised to keep and then lost is worse than never having recorded.

Before you enable recording, answer four questions in writing. Why are you recording, who may retrieve it, how long is it kept, and what happens when the patient asks for a copy or asks for deletion. If the honest answer to the first question is because the platform has the feature, switch it off. Quality assurance and training are legitimate purposes, but they are purposes you must state in the notice and then actually confine yourself to.

Practitioner consent matters here too. Consultants have a reasonable interest in knowing whether their clinical conversations are being retained and who inside the organisation can play them back. Settle this at credentialing, not at the first complaint, and put the retention period and the access list in the SOP the doctor signs.

A consent that cannot be produced with its context is close to worthless. The artefact you store should be reconstructable: not just a boolean, but the version of the notice displayed, the language it was displayed in, the timestamp, the origin of the consultation, the identity of who granted it, and whether it was granted by the patient or a named caregiver. If your database column is patient_consent set to true, you have recorded an opinion, not evidence.

Bind the artefact to the encounter, not only to the patient. Consent granted for a dermatology teleconsultation in March is not evidence of consent for a psychiatry consultation in September, and a patient-level flag will quietly assert that it is. Encounter-level binding also makes withdrawal tractable, because you can identify precisely which processing a withdrawal applies to and which historical records lawfully remain.

Keep the withdrawal events in the same log as the grants. An audit trail that shows only positive consents reads as curated. HealUDoc activity logs can carry grant, change, and withdrawal events against the encounter with the acting user and timestamp, which is the form that answers both a NABH documentation review and a data-protection query without a manual reconstruction exercise.

The most common break is the call centre. An agent books the appointment, reads a compressed script, ticks the box on the patient's behalf, and the system records a consent the patient never saw. This is a fabricated artefact and it is more dangerous than a missing one, because it will be produced confidently and then contradicted by the call recording. If agents book, the consent step must happen at the patient's own device before the consultation opens.

The second break is the repeat patient. Systems that remember consent forever will stop showing the notice, and eighteen months later the version the patient agreed to no longer describes what you do. Re-display when the notice version changes, when the purpose expands, and at a sensible interval regardless. Yes, this adds friction to a returning patient's flow. It is the friction that makes the record true.

The third is the caregiver case, where the consultation is booked under the patient and conducted with a relative who consents in their own name without any recorded authority. Build an explicit caregiver path that captures relationship and basis, and train the front-line team that using it is normal rather than an exception. A consent trail that quietly attributes a daughter's agreement to her mother is the kind of detail that unravels an otherwise good defence.