Privacy risk lives between systems

In healthcare environments, patient information rarely stays in one place.

It can move from an enquiry channel into registration, appointment systems, EMR or EHR platforms, diagnostics, billing, pharmacy, WhatsApp, CRM, cloud storage, spreadsheets and third-party services.

That creates an engineering problem.

An organisation may already have privacy policies, access rules and documented retention requirements.

The more important assurance questions are operational:

• Which systems actually hold patient information?
• Who can access each copy?
• What happens when access should be revoked?
• Can a patient request be traced across connected systems?
• Does deletion or retention policy actually execute?
• Can the organisation produce evidence showing what happened?

The broader lesson is that compliance cannot be demonstrated simply through the existence of policies.

Privacy, access control, retention and auditability ultimately need to appear in the behaviour of the systems themselves.

Why this matters beyond DPDP

The same engineering evidence can become relevant across multiple assurance programmes.

Whether an organisation is preparing for:

• DPDP
• ISO 27001
• SOC 2
• HIPAA
• GDPR
• an internal security review
• a customer security assessment

the underlying questions often become similar:

• What controls exist?
• Are those controls actually operating?
• Can the organisation demonstrate what happened?

That is why privacy and compliance increasingly become engineering-assurance problems rather than documentation exercises alone.