Breach Response & Ransomware Readiness (DPDP for Healthcare)
Hospitals can’t afford downtime—and patients can’t afford exposure. Here’s a practical breach-response playbook aligned to DPDP Rules: what to do in the first 30 minutes, what to notify patients, and what to report to the Board within 72 hours.
What you must do when a personal data breach happens
A) Inform affected patients (Data Principals) — without delay
On becoming aware of a breach, the Data Fiduciary must intimate each affected Data Principal in a concise, clear and plain manner and without delay, through their user account or any registered communication mode. The intimation must include specific elements (what happened, consequences, mitigation, safety steps, and contact).
B) Inform the Board — immediate + detailed within 72 hours
On becoming aware of a breach, you must inform the Board without delay with a description and likely impact, and then provide updated and detailed information within 72 hours (or a longer period if allowed by the Board upon written request).
Who this page is for
- Hospitals & multi-speciality chains (HIS/EHR, IPD/OPD, billing, discharge)
- Labs + imaging centres (LIS/PACS + report delivery)
- Telemedicine platforms (video consults, chat, prescriptions)
- Healthcare SaaS vendors processing patient data (CRM, call centers, WhatsApp/SMS, analytics)
30-minute “first response” checklist
Trigger: Any suspicious access/exfiltration, ransom, leaked credentials, exposed bucket, compromised vendor.
1) Contain (stop the blast radius)
2. Preserve evidence (don’t destroy your timeline)
3. Classify impact (patient harm first)
4. Start the DPDP breach record
What your patient notification must contain
our message to each affected patient must include all five items below:
- What happened (nature, extent, timing)
- Likely consequences relevant to them
- Mitigation measures you implemented / are implementing
- Safety measures the patient can take
- Business contact info of a person who can respond to queries
Micro-template (short, plain-English)
Subject: Important update about your data security
• What happened: [brief description + timing window]
• What data may be affected: [high-level categories only]
• What this could mean for you: [likely consequences]
• What we’re doing: [containment + recovery steps]
• What you can do: [password reset, vigilance, contact channels]
• Contact: [name/role + phone/email]
Your Board report sequence should cover
- Immediate description without delay (nature, extent, timing, location, likely impact)
- Detailed update (within 72 hours): Provide updated and detailed information including:
- Broad facts: events, circumstances, reasons leading to breach
- Mitigation measures implemented/proposed
- Findings (if any) about person who caused the breach
- Remedial measures to prevent recurrence
- Report of intimations given to affected Data Principals
Ransomware readiness (resilience-by-design)
Healthcare ransomware is not just “data exposure”—it’s availability compromise, which DPDP Rules explicitly anticipate via continued processing measures like backups.
Minimum safeguards checklist (what to implement)
DPDP Rules list minimum “reasonable security safeguards” that should exist to prevent breaches, including:
“Hospital-grade” ransomware controls (practical)
DPDP Rules list minimum “reasonable security safeguards” that should exist to prevent breaches, including:
One-page operational SOP
- Incident response team + on-call matrix
- Backup + restore test schedule
- Vendor escalation contacts and SLAs
- Centralised logging and monitoring
- Contain systems + disable compromised credentials
- Preserve evidence snapshots
- Decide service continuity path (downtime procedures)
- Impact classification (systems + patients + data types)
- Draft patient notification (plain-English)
- Prepare Board “without delay” intimation
- Submit detailed Board update: causes, mitigation, findings, preventive actions, patient intimation report
- Root cause analysis + hardening plan
- Retention/cleanup of exposed artifacts
- Post-incident tabletop drill + lessons learned
Vendor / Processor checklist
Because many healthcare systems rely on processors (cloud, HIS vendor, WhatsApp/SMS vendor, call center, lab systems), ensure:
Quick compliance checklist
Is your Incident Response Team ready?
We can set up your breach kit: patient notification templates, Board reporting pack, ransomware SOP, and vendor incident clauses—tailored to HIS/EHR + lab + telemedicine workflows.