1. Introduction

Data portability rights for patients refer to the legal rights and mechanisms through which patients can obtain, transfer, reuse, or transmit their health information from one healthcare provider, hospital, laboratory, insurer, or digital health platform to another.

The objective is to give patients greater control over their medical information, facilitate continuity of care, reduce dependence on a single healthcare provider, and support informed medical decision-making.

For example, if a patient changes hospitals, they may need their medical history, laboratory reports, prescriptions, diagnostic images, genomic data, and treatment records transferred to the new hospital. Data portability laws determine what information can be obtained, who must provide it, in what format, subject to what safeguards, and what remedies are available if access is refused.

Data portability is related to, but distinct from, the right to access medical records. Access allows a patient to see or obtain information; portability focuses on the ability to transfer or reuse that information, often in a structured, machine-readable format.

2. Legal nature and scope of patient data portability

Patient data portability may arise from several overlapping legal rights.

Right of access: The right to inspect or obtain copies of personal health information.

Right to transfer: The ability to send records to another healthcare provider or service.

Right to interoperability: The ability of different digital health systems to exchange and interpret records.

Right to data correction: The ability to request correction of inaccurate personal information.

Right to informational autonomy: The ability to make meaningful choices about the use and disclosure of personal health data.

Right to privacy and confidentiality: Protection against unauthorized disclosure during transfer.

These rights are not identical. A legal right to receive a copy of a record does not always create an unconditional right to demand direct transmission, a particular technical format, or transfer of every item held by a provider.

What information may be portable?

Clinical records

Medical histories, diagnoses, discharge summaries, prescriptions, referrals and treatment plans.

Diagnostic information

Blood tests, pathology results, radiology reports, ECGs and diagnostic images.

Digital health and wearable data

Relevant heart-rate readings, glucose measurements, activity data and patient-generated monitoring records, subject to the applicable law.

Genomic and specialised data

Genetic test results, molecular diagnostic reports and other specialised clinical data, subject to additional privacy and consent considerations where applicable.

Not every category is automatically transferable under every statute. The legal position depends on the jurisdiction, the entity holding the information, the nature of the data, and any applicable exclusions.

3. Patient data portability under Indian law

In India, patient data portability must be analysed through constitutional privacy principles, digital personal data legislation, medical-record requirements and the developing digital health framework.

A. Constitution of India

Article 21 protects life and personal liberty, and the Supreme Court has recognised privacy as a fundamental right. Medical confidentiality and control over personal health information are important aspects of this protection.

However, Article 21 does not itself expressly create a comprehensive, standalone right to obtain all medical records in a standard machine-readable format or to compel every private provider to transmit them directly to another provider.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) establishes a framework for processing digital personal data. Its relevance to health records includes lawful processing, consent where applicable, obligations of data fiduciaries, and data-principal rights.

A critical distinction is necessary: the DPDP Act does not establish a general, GDPR-style data portability right for patients. Its express rights include access to information about personal data, correction and erasure subject to statutory conditions, grievance redressal, and nomination. These should not be misrepresented as an unrestricted statutory right to transfer all health data to any competing provider.

The Act's applicability and the commencement of particular provisions must be checked against the relevant notifications and rules in force at the time of the request.

C. Digital health framework

India's Ayushman Bharat Digital Mission (ABDM) promotes digital health records and interoperable health information exchange. Its framework is intended to support the linking and exchange of health records with appropriate patient participation and consent mechanisms.

The ABDM ecosystem can make portability more practical, but participation in a digital health exchange is not the same as an unconditional statutory right to transfer every record held by every healthcare institution.

D. Medical ethics and record-keeping requirements

The applicable professional rules, hospital policies, and medical-record requirements may provide a basis for patients to request copies of their records. The precise obligations can depend on the type of provider, the applicable regulations and any rules replacing or modifying earlier professional standards.

Patients should distinguish between a right to receive copies of their records and a right to compel a provider to convert them into a new technical format or integrate them into another institution's software.

4. Leading Indian case laws

The following decisions establish principles relevant to patient confidentiality, privacy, medical records and informational autonomy. They should not all be treated as direct precedents recognising a standalone data-portability right.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1

Facts and issue: The case concerned the constitutional status of privacy under the Indian Constitution.

Judgment: The nine-judge Constitution Bench unanimously recognised privacy as a fundamental right protected by the Constitution, particularly Article 21 and the broader guarantees in Part III.

Relevance to patient data portability:

Medical and genetic information can reveal highly intimate aspects of a person's life.

The handling and disclosure of health information must be assessed against privacy, dignity and autonomy principles.

A patient’s decision to move medical records between providers should be supported by safeguards against unnecessary disclosure.

Legal limitation: The judgment did not establish a specific statutory right to transfer medical records in a machine-readable format. It supplies the constitutional foundation for protecting health information rather than a complete portability procedure.

Case 2: Mr. X v. Hospital Z (1998)

Supreme Court of India · (1998) 8 SCC 296

Facts: The dispute concerned disclosure of a patient's HIV-positive status and the confidentiality of medical information.

Judgment: The Supreme Court considered medical confidentiality alongside competing interests, including the protection of another person's health. The case recognised that confidentiality is important but is not necessarily absolute in every circumstance.

Relevance to portability: Transferring records to another hospital does not authorise indiscriminate disclosure. A provider must distinguish between a disclosure properly authorised by the patient and a disclosure justified by a recognised legal exception.

Principle: Portability should preserve confidentiality and limit access to information to legitimate purposes and authorised recipients.

Case 3: Sharda v. Dharmpal (2003)

Supreme Court of India · (2003) 4 SCC 493

Facts: The case involved a court-ordered medical examination in matrimonial proceedings and the extent to which personal autonomy and privacy could be limited by judicial authority.

Judgment: The Court held that a medical examination is not invariably prohibited merely because it affects privacy; in appropriate circumstances, a court may order one under its lawful authority.

Relevance to portability: Patient control over health information operates within a legal framework. A patient's wishes, the purpose of processing and any valid legal authority must be considered together.

Limitation: This is not a medical-record transfer case. Its relevance is by analogy to the relationship between personal autonomy, medical information and lawful exceptions.

Case 4: Samira Kohli v. Dr. Prabha Manchanda (2008)

Supreme Court of India · (2008) 2 SCC 1

Facts: The case concerned informed consent in medical treatment, including the limits of consent given for a particular procedure.

Judgment: The Court explained the requirements of valid informed consent and the circumstances in which treatment beyond the consent given may be justified.

Relevance to portability: Consent for medical treatment should not automatically be treated as unlimited consent to every subsequent use or disclosure of medical information. A transfer for continuity of care, an unrelated commercial use and disclosure for research may raise different legal questions.

Limitation: The judgment addresses informed consent to treatment, not a freestanding right to data portability. Its relevance to health-data transfers is analogical.

Case 5: K.S. Puttaswamy (Aadhaar) v. Union of India (2018)

Supreme Court of India · (2019) 1 SCC 1; judgment delivered 26 September 2018

Facts and issue: The Court examined the constitutional validity of the Aadhaar framework and restrictions on the use of identity information.

Judgment: The Court upheld parts of the framework while invalidating or limiting other provisions, including certain forms of private-sector use and mandatory linkage.

Relevance to portability: Health-record exchange systems should be designed around purpose limitation, proportionality, security and appropriate legal authority. A patient's need to transfer records should not become a justification for unnecessary identity linkage or excessive data collection.

Limitation: The decision is not a direct ruling on patient medical-record portability.

5. International case laws on portability and access

International decisions can help explain the legal principles involved, although their binding effect in India depends on the applicable law and the court in question.

Case 6: Ciox Health, LLC v. Azar (2020)

United States District Court for the District of Columbia · No. 18-cv-0040 (Jan. 23, 2020)

Issue: The dispute concerned federal guidance extending aspects of the HIPAA right of access and its fee restrictions to certain third-party-directed requests.

Decision: The court vacated parts of the 2016 HHS guidance that extended the HIPAA access-fee limitations to third-party requests outside the scope specified by the HIPAA right of access. The ruling did not abolish the underlying patient right to direct covered entities to send records to designated recipients.

Relevance: The case demonstrates why a patient's right to receive records and a third party's request for those records must be analysed carefully. The applicable fee rules can depend on the legal basis and type of request.

Official guidance: HHS guidance on directing health records to third parties.

HHS.gov+1

Case 7: Österreichische Datenschutzbehörde v. CRIF GmbH (2023)

Court of Justice of the European Union · Case C-487/21 · Judgment of 4 May 2023

Issue: The Court considered what constitutes a “copy” of personal data under Article 15(3) of the General Data Protection Regulation (GDPR).

Decision: A copy must be a faithful and intelligible reproduction of the personal data being processed. Extracts from documents or entire documents may be required where necessary to enable the individual to understand and effectively exercise their rights.

Relevance: A hospital should not necessarily satisfy an access request with a bare summary that omits relevant personal data. The decision supports meaningful access, which is often a practical prerequisite for portability.

Limitation: Article 15 access rights and Article 20 portability rights are distinct. The judgment does not mean that every patient can demand an entire hospital database or every document irrespective of legal limits.

Case 8: Österreichische Post AG (2023)

Court of Justice of the European Union · Case C-154/21 · Judgment of 12 January 2023

Issue: Whether an individual could obtain the identities of recipients to whom their personal data had been disclosed.

Decision: The Court held, in principle, that the controller must provide the actual identities of recipients where requested, rather than merely describing categories of recipients, subject to the applicable legal framework.

Relevance: Patients seeking to understand how health information has circulated may need information about recipients, particularly when records have been shared with laboratories, insurers, technology providers or other institutions.

Limitation: The case concerns access to information about disclosures, not the transfer of medical records themselves.

Official EU guidance on portability is available from the European Commission: Data portability and individual rights.

European Commission+1

6. The European Union: GDPR Article 20

The EU's General Data Protection Regulation provides one of the clearest express statutory data-portability rights.

Under Article 20, a patient may have the right to:

Receive qualifying personal data concerning them that they have provided to a controller.

Receive that data in a structured, commonly used and machine-readable format.

Transmit it to another controller without hindrance from the original controller.

Request direct transmission between controllers where technically feasible.

The right applies only under specified conditions, including automated processing and processing based on consent or contract. It does not automatically cover every item of information generated by a hospital, and it must not adversely affect the rights and freedoms of others.

Data Protection Commission+1

Application to healthcare

A patient moving between two private clinics may be able to request qualifying electronic health data in a reusable format. However, the portability analysis may differ for records processed under a public-interest or statutory healthcare basis rather than consent or contract.

This is a significant limitation: the GDPR does not make every medical record portable under Article 20 simply because it relates to a patient. Separate access rights under Article 15 may still apply.

7. The United States: HIPAA right of access

The Health Insurance Portability and Accountability Act (HIPAA) is particularly relevant because it provides patients with a right of access to protected health information (PHI) held by covered healthcare entities.

Under 45 CFR § 164.524, eligible individuals generally can:

Inspect or obtain copies of health information in a designated record set.

Request an electronic copy where the information is maintained electronically.

Direct the covered entity to transmit a copy to a designated person or organisation through a qualifying written request.

Request a preferred format, where it is readily producible.

The ordinary HIPAA access deadline is 30 calendar days, subject to a permitted extension of up to another 30 days with the required notice. Limited statutory exceptions apply.

HHS.gov+2

HIPAA therefore offers a practical model of patient-directed record transfer, although its access framework is not identical to the GDPR's Article 20 portability right.

8. Comparative legal framework

The table describes the general framework. Specific healthcare-sector laws, regional rules and contractual arrangements may add rights or restrictions.

9. Important clarification: commencement of India's DPDP Act

The commencement notification dated 13 November 2025 specifies a phased implementation schedule. Sections 11–17, including the access, correction, erasure and grievance-redressal provisions, are scheduled to commence 18 months after publication of that notification—on 13 May 2027, unless the applicable commencement position is subsequently changed. Therefore, as of 4 November 2026, these provisions should not be treated as already operative.

MeitY+1

This matters because a provision appearing in an enacted statute is not necessarily enforceable before its notified commencement date.

For present-day Indian patient-record requests, the legal analysis must therefore consider the constitutional principles recognised in Puttaswamy, applicable medical-record and professional obligations, existing sector-specific requirements, and any other operative law. The DPDP Act's future rights should not be used as if they were already in force.

Official source: Government of India commencement notification.

10. When may a healthcare provider refuse portability?

A provider may have a legitimate basis to refuse or limit a transfer in certain circumstances. Whether the refusal is lawful depends on the jurisdiction and the particular right invoked.

Identity or authority cannot be verified

A provider may need to verify that the requester is the patient or a legally authorised representative. Verification should be proportionate and should not create unnecessary obstacles.

Third-party confidentiality

Records may contain information concerning other patients or confidential information requiring lawful redaction or restricted disclosure.

Statutory exceptions

Certain psychotherapy notes, protected information, legally restricted records or information subject to a specific exemption may be excluded from an access or portability right.

Technical limitations

A provider may not be required to create a new database, build a bespoke interface or supply a requested format that the applicable law does not require and that cannot readily be produced. This does not automatically excuse a refusal to provide records in another legally acceptable form.

Valid legal restrictions

A court order, a specific statutory restriction or another lawful ground may affect disclosure. General claims of confidentiality or administrative inconvenience are not necessarily sufficient.

11. Remedies for unlawful refusal or delay

A patient whose transfer request is denied may consider the following steps.

Submit a written request. Identify the records sought, the relevant dates, the preferred format and the receiving provider.

Ask for written reasons. Request the precise legal basis for any refusal, restriction or fee.

Use the provider's grievance mechanism. Escalate to the medical superintendent, records department, hospital grievance officer or relevant data-protection contact.

Approach the appropriate regulator or authority. Depending on the dispute, this may include a competent medical regulator, an applicable data-protection authority once the relevant provisions are operative, or another sectoral authority.

Consider judicial remedies. Where a legally enforceable right is violated, constitutional remedies or other appropriate court proceedings may be available, depending on the parties, facts and applicable law.

In India, the precise remedy depends on whether the dispute concerns access to records, confidentiality, professional misconduct, a data breach, discrimination or a refusal to transfer information. There is no single universal patient-portability complaint procedure that resolves every category.

12. Practical example

Suppose a patient receives cancer treatment at Hospital A and wishes to continue treatment at Hospital B. Hospital A holds pathology reports, radiology images, biopsy findings, prescriptions and previous treatment summaries.

The patient requests an electronic copy and authorises transfer to Hospital B.

A legally and operationally sound process would involve:

Verifying the patient's identity and the recipient's details.

Identifying the relevant records and applicable disclosure rules.

Providing the records in a usable, secure format permitted or required by law.

Preserving the integrity and provenance of diagnostic reports.

Limiting disclosure to the intended recipient and documenting the transfer.

Explaining any lawful exclusion or delay and providing an appropriate alternative where possible.

A refusal based solely on a desire to retain the patient may raise concerns about fairness and continuity of care, but its precise legal consequences depend on the applicable law and facts.

13. Model patient request for medical-record transfer

Subject: Request for Copies and Transfer of Medical Records

To
The Medical Superintendent / Medical Records Department
[Hospital Name]

I am requesting a copy of my medical records relating to my treatment at your hospital.

Please provide the relevant records, including consultation notes, diagnoses, laboratory and pathology reports, radiology reports and images, prescriptions, discharge summaries, and treatment records for the period [date range].

My preferred format is electronic, where available. I also authorise the transfer of the specified records to the following healthcare provider:

Receiving provider: [Hospital/Doctor Name]
Contact details: [Secure email or approved transfer address]

Please inform me of any applicable charges, identity-verification requirements, lawful restrictions or technical limitations. If any portion of my request cannot be fulfilled, please provide the reasons and explain what alternative access or transfer method is available.

Kindly acknowledge receipt of this request and advise me of the expected completion date.

Yours faithfully,
[Patient Name]
[Patient/Registration ID, if applicable]
[Contact Details]
[Date]

Use a secure channel and include only the identifying information the hospital reasonably needs. Avoid sending sensitive records to an unverified email address.

14. Conclusion

Patient data portability is essential to continuity of care, patient autonomy, informed choice and competition between healthcare providers. However, the right to access records, the right to direct their transfer and the right to obtain machine-readable data are legally distinct.

Indian constitutional jurisprudence, particularly Justice K.S. Puttaswamy v. Union of India, supplies important privacy protections, while international frameworks such as GDPR Article 20 and HIPAA's right-of-access provisions offer more explicit transfer mechanisms. Their rules cannot simply be imported into Indian law.

The central legal question in any dispute is whether the patient has an enforceable right to the particular information and transfer method requested, whether the provider has a lawful basis for limiting the request, and what remedy is available under the law currently in force.

This is a general legal research overview, not an opinion on a specific patient's case. Applicable legislation, commencement notifications and sector-specific rules should be verified before relying on a particular remedy.