Telemedicine Consent Adequacy Checker

Check your telemedicine consent adequacy

How is consent for the teleconsultation itself obtained (Telemedicine Guidelines 2020)?

Is the consultation recorded, and if so, is separate consent obtained for the recording?

Is patient data (prescription, notes, history) shared with a pharmacy, lab or insurer after the call?

Does your platform/practice have a documented data retention period for consultation records?

Telemedicine consent — what the two frameworks each require

Telemedicine Practice Guidelines 2020: explicit patient consent to the teleconsultation itself, recorded before the session
DPDP Act S.6: separate, specific consent for processing personal data collected during the consultation
Recording consent: if a session is recorded, that requires its own specific consent — not covered by consultation consent
Downstream sharing: pharmacy, lab and insurer handoffs each need their own consent basis, not an implied one
Retention: define how long consultation records, prescriptions and recordings are kept, and why
Doctor identity and registration disclosure remains a Telemedicine Guidelines 2020 requirement, separate from data consent

Two consents, not one: consultation consent vs data consent

Since the Telemedicine Practice Guidelines were issued in 2020, doctors and platforms have focused on getting consent for the teleconsultation itself — confirming the patient wants to proceed with a remote consultation. The DPDP Act 2023 adds a second, distinct requirement: specific consent for processing the personal data generated during that consultation — chat logs, video recordings, prescriptions, and any data shared with pharmacies or labs afterward. Many telemedicine platforms built their consent flow around the 2020 Guidelines alone and have not layered in the DPDP-specific consent step.

This matters because the post-COVID telemedicine boom means a large and growing base of platforms, individual doctors and hospital teleconsultation desks are operating with consent flows designed for an older, narrower regulatory requirement. Retrofitting DPDP-adequate consent — without disrupting a smooth, fast teleconsultation user experience — is a common project Niti Bharat runs for telemedicine platforms and hospital telehealth desks.

What changes with DPDP Rules 2025 for telemedicine

The DPDP Rules 2025, notified in November 2025, add operational detail to breach notification timelines and consent documentation standards that telemedicine platforms should incorporate — particularly given that a breach involving consultation recordings or prescription data would likely trigger the higher penalty band (up to Rs 200 crore) associated with sensitive-context breaches. With enforcement expected from May 2027, telemedicine platforms and individual practitioners have a limited window to align their consent flows to both frameworks and document the change.

Get the Telemedicine Consent Adequacy Guide (free)

A side-by-side mapping of Telemedicine Practice Guidelines 2020 requirements against DPDP Act consent requirements, with a sample dual-consent flow.

Frequently Asked Questions

Is consenting to a teleconsultation the same as DPDP consent?+

No. Consent to the teleconsultation under the Telemedicine Practice Guidelines 2020 is about agreeing to receive care remotely. DPDP consent is a separate requirement covering how the personal data generated in that consultation is collected, stored and shared.

Does recording a telemedicine consultation need separate consent?+

Yes. Recording introduces a new processing purpose — storage and potential future use of the recording — which needs its own specific consent under Section 6 of the DPDP Act, distinct from consent to the consultation itself.

Do e-prescriptions shared with a pharmacy need separate patient consent?+

Generally yes, if the sharing is not something the patient was specifically told about and consented to. Automatic handoff of prescription data to a partner pharmacy without a specific consent step is a common gap.

Who is responsible for DPDP compliance in a telemedicine platform: the doctor or the platform?+

Typically both share responsibility depending on their role. The platform, as the entity determining the purpose and means of processing (a Data Fiduciary), usually carries the primary DPDP obligation, while doctors retain professional and Telemedicine Guidelines obligations for the clinical consultation itself.

Quick Answer