01 · Digital records
Hospitals: Why are we still defaulting to paper?
Physical copies are often retained because teams assume that paper is inherently safer or more defensible. The more useful question is whether the digital record's integrity, origin and history can be demonstrated.
MythNABH or NMC always requires a duplicate physical copy.
Operational realityHospitals need records that remain available, retrievable and protected. The exact retention format must follow the applicable standard, legal requirement and hospital policy.
MythOnly a later forensic examination can establish authenticity.
Operational realityCryptographic hashes, timestamps, attributable user activity, device details and complete audit trails can provide routine evidence for integrity and authenticity review.
What changes with Kaagazz Secure
- Tamper-evident digital documents across clinical and non-clinical departments
- Fast, parameter-based retrieval with attributable activity
- Evidence preparation supported by document hashes and forensic-grade traceability
- Reduced dependence on bulk physical and third-party storage, subject to approved retention policy
02 · DPDP and healthcare
Medical records: Has DPDP changed the rules for hospitals?
Digitisation alone does not create privacy. Patient information can exist in an HIS, scanned PDFs, shared folders, emails, downloads and physical records that are later digitised. Each location creates a governance responsibility.
Practices to reassess- Sharing reports through uncontrolled channels
- Keeping records on widely accessible shared drives
- Using photocopies without accountable handover
- Limited visibility during audits
Controls to establish- Purpose-linked consent or another applicable lawful basis
- Controlled sharing or redaction where appropriate
- End-to-end accountability and traceability
- Protection of both legacy and current records
Kaagazz supports these controls through PII discovery, document-level security, AI-assisted rule-based redaction, consent evidence and attributable audit trails. The organisation remains responsible for its notices, lawful basis, policies and legal decisions.
03 · Legacy records
Discovering PII is only the first step.
A discovery exercise answers an important question: where does personal or sensitive information exist today? But hospitals create new information every day through registrations, reports, scans, emails, exports and shared documents.
DiscoverLocate PII and PHIAssessReview exposure and permissionsSecureApply protection and redactionGovernRepeat as information changes
Kaagazz Discover provides continuing visibility across relevant repositories. Kaagazz Secure adds controlled access, document protection and traceable handling. Together they help turn a one-time inventory into an ongoing governance process.
04 · Document security
Cybersecurity is not document security.
Network, endpoint and perimeter controls are essential. Yet a document may still be downloaded, copied, printed, shared or accessed outside the workflow in which it was created. Document security focuses on the record itself and its continuing lifecycle.
Can you identify it?Know where sensitive documents and exposed PII reside.
Can you control it?Apply access, viewing, download, print, sharing and redaction rules.
Can you trace it?Record who performed which action, when and from which system.
Can you prove integrity?Preserve hashes, timestamps and attributable document history.
Kaagazz is designed to add this document-level control and evidence layer without requiring an organisation to replace every existing business or clinical system.
05 · Electronic evidence
Are your digital records evidence-ready?
The Bharatiya Sakshya Adhiniyam, 2023 recognises electronic and digital records. Sections 61–63 address electronic records and their admissibility, while Section 57 addresses primary evidence, including specified electronic-record situations.
Forensic-grade traceability can help an organisation prepare and verify an electronic record by preserving the document's origin, integrity and activity history.
User or roleAction performedDate and timeDevice or systemOS and machine detailsDocument hash
Kaagazz supports integrity review and evidence preparation. It does not independently determine admissibility; the statutory conditions, applicable certificate and judicial assessment continue to apply.
View the legal capability mapping →
06 · Consent
Every patient registration creates a privacy and consent responsibility.
Registration is often treated as a routine administrative step. In reality, it begins the collection of personally identifiable information and should connect the privacy notice, purpose and consent evidence to the resulting patient record.
Privacy noticeLanguage choiceIdentity and consentEvidence recordHIS integration
How Kaagazz Consent can support the workflow
- Multilingual presentation of notice and consent content
- Configured authentication and consent capture
- Voice-assisted processes where appropriate for accessibility
- Secure preservation of the consent artefact and activity history
- Integration with the existing HIS to reduce duplicate entry
The exact authentication method and consent design should be configured according to the organisation's legal assessment and operating context.
