Health Department Data: Handle With Extreme Care

A teaching-hospital superintendent forwarded a vendor mail with the subject line 'summarise all discharge cards in 24 hours'. The attached architecture sent HL7-ish text to a public large-language-model API 'only for summarisation'. The DPO asked where the copies would live, who could compel the host, and whether the model trainer had a rights clause. The vendor said the region was Mumbai. The superintendent, who had spent thirty years not discussing patients in corridors, understood the rest without a statute.

Health is not another departmental backlog. It is a professional-secrecy culture that predates DPDP, plus a statute that now names digital personal data, plus facilities that already leak through WhatsApp groups of residents. An agent does not get a lighter duty because the workload is noble. It gets a heavier one because the harm is intimate.

This guide is dated 17 August 2026. It is not medical advice and not legal advice. MeitY's India AI Governance Guidelines of 5 November 2025 speak of accountability and safety as principles. They do not authorise a public API for discharge notes. Neither does a cloud region's name.

Two duties, not one

A government doctor is not free to chat about a named patient because a processor contract exists. Professional conduct rules and facility standing orders still bind. The DPDP Act, 2023 still binds the Data Fiduciary that processes digital personal data — typically the hospital or the health department, not the intern who pasted the note. You need both sentences on the file. A DPA without secrecy language is incomplete. A Hippocratic slide without a processor map is theatre.

Section 7 may support certain State health benefits or legal functions where the limb actually applies. A scheme that pays a dialysis entitlement is not the same workflow as a psychiatrist's note. Do not staple Section 7 to the EMR. Write the basis per workflow. Where consent is used, remember that a person on a trolley is not in a great position to bargain. Make the yes as easy as the no, and do not bundle research-training rights into admission.

• No clinical text, images, or audio to public model APIs. Not for OCR. Not for 'just a summary'. Not for a hackathon.
• No training on patient packets by the vendor. Write the sentence. Test the sentence.
• No agent authorship of diagnosis, prescription, or discharge. Drafts only, signed by a registered professional.
• No Aadhaar numbers in clinical prompts. Health ID or facility IDs if you must key; vault Aadhaar if a scheme forces you to touch it.

What you may still automate

Extreme care is not a ban on every agent. It is a ban on careless ones. Completeness checks on scheme files for Janani or state insurance, retrieval of the hospital's own circulars, draft discharge summaries inside the perimeter, coding assistance that a records officer accepts, and queue-management text that contains no clinical detail are all discussable. Each still needs a purpose, a role map, and a refused public-egress test.

ABDM and facility EMRs are not toys. If you connect, connect as a guest with a purpose tag. Do not scrape a clinician portal. Do not store a national health identifier in a vector database 'for better retrieval' unless counsel and the current NHA rules say that is a permitted store. When in doubt, retrieve inside the facility and leave identifiers in the EMR.

Health-department agent jobs and the default answer.

Job	Default	Condition that can change the default
Public-API summary of discharge notes	Refuse	None we would sign
On-prem draft discharge for the treating doctor	Discuss	Doctor signs; text never leaves; no vendor training
Scheme eligibility on a health entitlement	Discuss	Human gate; Section 7 limb if true; no auto-deny
Research fine-tune on last year's EMR	Refuse as operations	A separate ethics and legal path, not the same contract
Citizen chatbot on OPD timings	Discuss	No intake of symptoms that become an undeclared record

Two wards after the same CM announcement

Objections you will hear — and what to do with them

Other countries do this with cloud AI

Other countries have other statutes, other contracts and other political metabolisms for a leaked celebrity file. You have DPDP, professional secrecy, RTI, and a newspaper industry that can read a URL. Design for this country.

We stripped names so it is anonymised

Names are one identifier. Dates, rare diagnoses, ward, employee status and a district will re-identify. If you cannot defend anonymisation to a sceptical DPO, you do not have it.

Doctors will not type if we block the public tools

Then give them a fast tool inside the perimeter, and treat unofficial paste as a conduct issue. Blocking without a replacement is how WhatsApp becomes the EMR.

Section 7 covers public health

Write the limb. Outbreak functions under law are not a licence to train a vendor model on psychiatric notes. Purpose limitation survives emergencies; it becomes more important, not less.

A four-week playbook before any clinical text is touched

1. Week 1: list workflows. Split clinical, scheme-benefit, and facilities. Assign a lawful-basis sentence to each. Kill any workflow that needs a public API.
2. Week 2: packet-capture the proposed environment. If the vendor runtime phones home, stop. Do not negotiate that as a 'telemetry exception' on health data.
3. Week 3: write the no-training, no-egress, doctor-signs clauses. Run them past medical administration, not only IT.
4. Week 4: tabletop a journalist query and a patient-access query. If you cannot say what left the building, you are not ready.

File note you can paste

Subject: Processing of health-department personal data by agents — prohibition on public APIs.

Clinical notes, images, audio and discharge summaries shall not be sent to public model APIs. Agents, if any, will run in a facility- or SDC-controlled environment with refused egress proven by packet capture. Drafts of clinical documents will be signed by a registered professional. Scheme-benefit workflows will keep a human gate and a recorded lawful basis; Section 7 will be cited only where the limb applies. Vendor training on patient packets is forbidden. Unofficial paste into public chatbots is a conduct issue.

This note is an internal aid. It is not legal or medical advice.

Prcept AI will not take your discharge notes as a demo pack. If we cannot show the work on synthetic or properly governed facility data inside your perimeter, we should lose the file. Health is where sovereign, on-prem language stops being a slogan.

WhatsApp is already your shadow EMR

Before you buy an agent, ask where discharge cards already go. In many teaching hospitals they go to resident groups, to a personal drive, to a public chatbot the intern used at 2am. An official on-prem draft tool that is slower than those paths will lose. Speed inside the perimeter is a security control, not a luxury. So is a conduct note that unofficial paste is a disciplinary fact, not a quirk of training.

Do not connect the official agent to a consumer messenger 'to meet doctors where they are'. You will have met them in a place you cannot retain, cannot redact, and cannot refuse to produce when a court asks. If you need a mobile surface, it is a managed app on a facility identity with a retention map. Anything else is a second incident waiting for a celebrity admission.

Tabletop the journalist query with the medical superintendent in the room. If the only honest answer is 'we cannot know what left on phones', write that as the risk register's first line. Then decide whether you are buying an agent or buying a phone policy. Many files need the second before the first.

This article is informational field guidance for Indian public institutions, not legal, medical, ABDM or procurement advice. Confirm against DPDP and its Rules, current professional-conduct regulations, facility standing orders, NHA / ABDM documentation, CERT-In directions, and counsel before you file it.

How to sequence this in a state, not a slide

“Health Department Data: Handle With Extreme Care” is a department problem. A P6 Compliance/DPO should name the legacy system, the officer who owns the file, and the citizen charter clock before buying “health data AI government India”.

A discharge note is not a prompt. Professional secrecy and the DPDP Act both reach health data. If your design requires pasting clinical text into a public API, the design is finished: refuse it. Do not invent league tables of states. Read tenders and policies. Election Model Code of Conduct can freeze a rollout. NIC is a partner, not a villain. SDC readiness is GPU, power, ops and egress — not a logo.

• Audit the legacy store first.
• Keep mutation and money as officer actions.
• Map SLAs to the citizen charter.
• Budget change requests after go-live.

Close this loop before the next CAB

Put “Health Department Data: Handle With Extreme Care” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P6 Compliance/DPO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “health data AI government India” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.