One signature cannot explain five decisions. Yet clinic forms often place examination, treatment, data use, WhatsApp reminders, marketing, and ABHA linking under a single “I agree” line.
Split the decisions before choosing paper, tablet, or portal. The evidence becomes easier to read, honour, withdraw, and audit.
Draw the consent map first
| Decision | Example purpose | Approval owner |
|---|---|---|
| Clinical consent | Examination, procedure, treatment, teleconsultation | Clinical and legal leadership |
| Data notice and lawful processing | Registration, care record, billing, required operations | Privacy and legal leadership |
| Optional patient communication | Appointment or follow-up messages through a chosen channel | Privacy and operations |
| Marketing | Promotions unrelated to the immediate care workflow | Privacy and marketing, separately |
| ABDM or other network action | A specific linking, sharing, or network request | Authorised ABDM and privacy owner |
The map prevents a clinic from promising that refusal of an optional message channel means refusal of care. It also stops staff from treating a treatment signature as permanent permission for every future data use.
Put the notice before the choice
The Digital Personal Data Protection Act, 2023 creates India’s statutory framework for digital personal data. The DPDP Rules, 2025 set out the implementation framework, including requirements for notices in clear and plain language with itemised descriptions of personal data and specified purposes.
Do not hide the notice behind a link nobody can open at the desk. Give the patient a readable version in the language and format the clinic has approved. Record which version was shown.
PATIENT DATA NOTICE RECORD
Clinic legal name and contact: ___________________________
Notice version and effective date: _______________________
Language and format presented: ___________________________
Personal data described: ________________________________
Purpose or purposes described: ___________________________
Service or use connected to each purpose: _______________
Rights, grievance, and complaint routes provided: _______
Withdrawal route where consent is relied on: ____________
Retention or source-policy reference: ____________________
Presented by or through: _________________________________
Date and time: ___________________________________________
Evidence location: _______________________________________This record proves what the patient saw. It is not a substitute for the clinical consent or the patient’s affirmative choice.
Use one purpose per optional choice
OPTIONAL PATIENT COMMUNICATION CHOICES
Appointment reminders by approved channel: Yes / No
Care follow-up messages by approved channel: Yes / No
Patient-selected channel: ________________________________
Marketing or promotional messages: Yes / No
Each choice can be changed through: ______________________
Changing an optional choice does not alter completed care records.
Patient or representative: _______________________________
Representative authority, if applicable: _________________
Signature or approved affirmative action: _________________
Date and time: ___________________________________________
Form version: ____________________________________________Do not pre-tick boxes. Do not treat a phone number as consent for every message. If the clinic relies on another lawful ground for a required communication, label that route correctly instead of manufacturing consent.
Keep clinical consent clinical
The Ministry of Health and Family Welfare’s Clinical Establishments standards include requirements for consent in hospital care settings. The actual consent needed depends on the examination, procedure, treatment, patient, capacity, emergency, facility, profession, and applicable state or central rules.
The treating team must explain the clinical decision under the approved process. Software can display a form and preserve an event. It cannot decide capacity, substitute for the clinician’s explanation, or turn a generic signature into informed consent for a specific procedure.
When a representative signs, record the identity, relationship, authority, and reason under the clinic’s policy. A parent, guardian, attendant, nominee, and informal caregiver are not interchangeable roles.
Keep ABDM choices separate
ABHA and ABDM workflows have their own actors, purpose, consent, and technical evidence. Do not claim that a general clinic registration form authorises every future health-information exchange.
Patient Square does not claim ABDM certification or live connectivity. If the clinic uses another certified system for an ABDM action, keep the network evidence with that system and link only the minimum local reference the approved workflow needs.
The clinic should be able to answer: which network action occurred, which record set was involved, who requested it, what consent artefact or lawful route applied, when it occurred, and how the patient can inspect or change future choices where supported.
Make withdrawal a workflow, not an inbox
When the clinic relies on consent for a purpose, a withdrawal must reach the systems and people using that consent. Record the request, identity check, purpose, time, downstream tasks, completed actions, and patient response.
Withdrawal does not erase clinical facts or records that another law requires the clinic to retain. Nor does it undo processing already completed under the applicable framework. Legal and privacy owners must decide the effect on each purpose and record class.
Test four cases:
- Patient stops marketing but keeps appointment reminders.
- Patient changes the phone number used for reminders.
- Representative authority expires or changes.
- Patient withdraws an optional data-sharing choice while a mandatory medical record remains under retention.
The system should not answer all four by deleting the patient account.
Preserve the version and the action
A consent table needs more than true or false.
| Field | Why it matters |
|---|---|
| Purpose | Shows what the choice covered |
| Text and version | Shows what was presented |
| Language and format | Shows how it was communicated |
| Patient or representative | Shows who acted |
| Authority evidence | Supports representative action |
| Affirmative action and time | Shows how and when the choice was made |
| Source channel | Paper, tablet, portal, or other approved route |
| Withdrawal or change history | Preserves the lifecycle |
| Downstream completion | Shows that systems honoured the change |
Never rewrite an old consent event when the wording changes. Create a new version and keep the old evidence tied to the period when it applied.
Product boundary
Patient Square can support documentation and configured practice workflows within the confirmed product scope. It does not provide legal advice, decide the lawful basis for data processing, obtain informed clinical consent on the clinician’s behalf, judge representative authority, or certify ABDM participation.
Review the current India security posture and product pages before deployment. Have qualified clinical, privacy, and legal owners approve the consent map, form text, languages, accessibility, system evidence, retention, and withdrawal path.