AI in Indian Healthcare: HIPAA + DPDP-Compliant Assistants

Indian healthcare AI projects are uniquely tricky. You may be serving patients in India under the DPDP Act, handling data that flows to US partners under HIPAA, and integrating with ABDM (Ayushman Bharat Digital Mission) standards for health records. Three regimes, one app. Here is an architecture pattern that keeps them apart, and the places where AI helps without creating new risk.

The three regimes in plain terms

• HIPAA — applies to US covered entities (health plans, most healthcare providers and clearinghouses) and their business associates. If you handle protected health information on behalf of a US covered entity, you are likely a business associate and need a business associate agreement (BAA). HIPAA requires administrative, physical and technical safeguards, including access controls and audit logs, and notification of affected individuals no later than 60 days after a breach is discovered.
• DPDP Act — India's data protection law: consent-first, purpose-limited, with erasure once the purpose is served or consent is withdrawn. Broadly similar in spirit to GDPR, though simpler; it has no separate category for sensitive data. The DPDP Rules were notified in November 2025, with most obligations taking effect around May 2027, so build to them now.
• ABDM — India's national digital health framework. Health records are exchanged as FHIR resources through a consent manager, and patients are identified by an ABHA (Ayushman Bharat Health Account) number. The ABDM site publishes the specifications and sandbox process.

Architecture: separate the data planes

Don't try to make one data store satisfy all three regimes. Split it into:

• Patient interaction store (DPDP) — chat history, voice transcripts, preferences. Stored in an India region with explicit consent and a deletion API.
• Clinical record store (ABDM-aligned FHIR) — observations, encounters, conditions. Accessed through the consent gateway.
• Cross-border claims store (HIPAA-aligned) — only when needed for US partner integrations, with a BAA in place.

Logically separated stores let each regime apply cleanly without one regime's rules contaminating the others. Give each store its own encryption keys, access roles and retention rules. The AI layer should read from them through narrow services that check consent and purpose on every call, rather than holding broad database credentials.

Where AI fits without violating anything

• Appointment scheduling and triage. Conversational AI that books slots and classifies urgency against a clinician-approved protocol. No clinical decision-making.
• Document intake. Vision-LLM extraction from prescriptions, lab reports and insurance cards, with low-confidence fields sent to a person. Output flows into FHIR resources.
• Patient education. Retrieval over a hospital-approved knowledge base, scoped to "informational, not advice".
• Clinician copilot. Summarises patient history and drafts notes for clinician review. Always signed off by a human.

Where AI should not go yet

Direct clinical advice without a clinician in the loop, autonomous medication recommendations and diagnostic claims. The regulatory framework isn't there, the liability isn't there, and the models aren't reliable enough. Software that diagnoses or recommends treatment may also be regulated as a medical device — by CDSCO in India or the FDA in the US — which brings its own approval process. We decline these scopes.

Consent flows that actually work

DPDP requires explicit, granular consent. ABDM requires consent-gateway-mediated access. Layer them: the patient consents in your app (DPDP), and that consent triggers a gateway request for any clinical data fetched from the wider ABDM network. A typical flow:

1. The patient sees a short notice: what data, for which purpose, and how to withdraw.
2. The patient grants consent per purpose (booking, reminders, record access), each stored with a timestamp and the notice version.
3. When the assistant needs clinical records, it raises an ABDM consent request, which the patient approves in their consent manager app.
4. Every read checks the consent record and purpose; expired or withdrawn consent blocks access.
5. Withdrawal triggers deletion or anonymisation of interaction data that is no longer needed.

Multilingual matters more in healthcare than anywhere

Many patients are more comfortable describing symptoms in their first language, even if they use English every day. Plan Hindi, Tamil, Bengali, Telugu and Marathi support from the start. Indic models and speech services such as Sarvam, Krutrim and Bhashini have improved considerably; test them on real clinical vocabulary, drug names and regional accents before committing. Don't ship English-only.

Checklist before you go live

• A data map showing which store holds what, under which regime.
• A BAA with every vendor that touches US protected health information, including your LLM provider where applicable.
• Documented hosting-region decisions for each store.
• Prompt and response logging that does not leak health data into general-purpose log tools.
• Red-team tests for medical-advice requests and prompt injection.
• A clinician sign-off process for all clinical content in the knowledge base.

FAQ

Does HIPAA apply to an app used only by Indian patients?

Generally not, unless you handle protected health information for a US covered entity or business associate. DPDP applies either way when you process personal data in India.

Can we use a hosted LLM API for patient data?

Possibly, if the provider's terms, data residency and retention settings meet your obligations and, for US data, the provider will sign a BAA. Check this before building, not after.

How we approach this at Velura Labs

Our Custom LLM Applications and Agentic Systems services cover patient-facing assistant design across these regimes, and Document Processing handles the document-intake side. Read our guardrails playbook for the broader compliance pattern. Talk to us before designing the architecture; data-plane decisions are much cheaper to get right up front.

Whether you are in California, Texas or Washington in the US, France or Italy in Europe, the UAE or Saudi Arabia in the Gulf, or here in India, Velura Labs delivers this end to end. Talk to us about your context.