1. Endpoint Security Failures on Personal Staff Devices
When a technician downloads a patient's lab report on their personal smartphone and forwards it on WhatsApp, the file stays on that phone, often syncs to a personal cloud backup, and leaves with the employee when they quit. Section 8(5) requires a clinic to take reasonable security safeguards to prevent personal data breaches. Uncontrolled copies on personal phones make that very hard to show.
2. The Risk of Misdirected Dispatches
Front-desk staff handling dozens of calls sometimes mix up phone numbers, and confidential pathology results land with the wrong person. That is a personal data breach. From May 2027, Section 8(6) and Rule 7 of the DPDP Rules, 2025 require the clinic to inform the Data Protection Board and each affected patient when a breach happens.
3. Transitioning to Compliant Tokenized Delivery
Clinics do not need to stop using messaging apps altogether; they need a safer delivery method. Instead of attaching raw PDFs, send a secure, time-limited link that asks for an OTP before the report opens, and keep a log of who accessed it.