When the network stops, the wards go to paper.

Yes. A hospital or laboratory that holds patient data digitally is a Data Fiduciary under the Digital Personal Data Protection Act, and its core duties apply from about 13 May 2027: reasonable security safeguards under Rule 6 (including keeping logs for a year), breach intimation to the Board and patients without delay with a detailed report in 72 hours, and working notice, consent and rights processes. Clinical establishments get a narrow exemption from some children’s-data restrictions when providing health services — not from the security or breach duties. Penalties reach ₹250 crore. See DPDP Act compliance for how the work is sequenced.

Within six hours of noticing it, to CERT-In, under the April 2022 CERT-In Directions — malicious code such as ransomware, data breaches, data leaks and unauthorised access are all on the list of reportable incidents. From about 13 May 2027 the DPDP Rules add a second track for personal-data breaches: tell the Data Protection Board and each affected patient without delay, then send the Board a detailed report within 72 hours. The two are separate duties with separate content, so the report templates should be drafted before they are needed, not during the incident.

Not directly through Indian law, but in practice yes: an Indian company that handles US patients’ protected health information for a covered entity is a business associate, and signs a business associate agreement that binds it to the HIPAA Security Rule and breach-notification duties. Your US clients audit you against that, and they carry their own OCR exposure — risk-analysis failures featured in 76% of OCR’s 2025 enforcement actions. Business associates accounted for 35.8% of US healthcare breaches in 2025. Our HIPAA readiness work is built for exactly this position.

At least once a year, and after every major change. That is what CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines of July 2025 expect of the ICT estate, and it matches the annual penetration test New York now requires of its general hospitals and the 12-month cycle proposed for HIPAA. In practice, a hospital changes more often than once a year — a new HMS version, a new lab integration, a new patient app — and each is a reason to test. Continuous penetration testing keeps the scope current between annual audits.

Yes, by not testing them the way you would test a web server. Live medical devices and anything connected to patient care are passive-only for us unless you instruct otherwise in writing: we observe traffic, review configuration and architecture, and test the boundary between the office network and the clinical network, which is where most real exposure lives. Where active testing of a device is genuinely needed, it is done on a spare or out-of-service unit, with your biomedical engineering team and, where possible, the manufacturer.

It is a start, not an answer. Under the DPDP Act the hospital is the Data Fiduciary and the vendor is its Data Processor, so the duty to keep safeguards and to report breaches stays with the hospital. Ask the vendor for evidence rather than assurance: when was the system last independently tested, what was found, what was fixed, and how are logs retained. Write security obligations and breach notice into the contract. With the vendor’s permission, test the portal and APIs your staff and patients actually use.

The proposed rule HHS published in January 2025 would remove the distinction between required and “addressable” safeguards, require a technology asset inventory and network map, vulnerability scans at least every six months, a penetration test at least every twelve, and written procedures to restore data within 72 hours. It is not in force. In July 2026 HHS moved the overhaul to its long-term regulatory agenda, pushing a final rule to 2027 at the earliest. Building to it now is still sensible — it describes what auditors already look for.

Not for the laws themselves. There is no DPDP certification, and HHS does not certify anyone under HIPAA — “HIPAA certified” describes a training course, not a legal status. ISO 27001 is certifiable, by an accredited certification body rather than by a consultancy, and it is the certificate hospital groups and health-tech companies are most often asked for. What partners increasingly want alongside it is recent, verifiable testing evidence — which is what an assessment certificate is for.

Because the pressure to restore service quickly is unusually high, the data is unusually valuable, and the estate is unusually hard to patch — legacy devices, vendor-run systems and dozens of integrations. Sophos found exploited vulnerabilities to be the leading technical cause of healthcare ransomware attacks in 2025, at 33%, and a median ransom payment of $150,000. The defensive answer is unglamorous: patch what faces the internet, separate clinical networks from the office, and keep backups you have actually restored.