WCAG and DPDP Compliance for Hospital Apps in India: A Checklist for Hospital IT Heads

Short answer: an Indian hospital's patient app, website and booking flow should meet WCAG 2.1 or 2.2 Level AA for accessibility, and its systems must be ready for the DPDP Act, 2023, whose main obligations under the DPDP Rules apply from 13 May 2027. Start with an audit of both, because the fixes overlap: the same registration, consent and booking screens fail on both counts.

General information, not legal advice. Your legal team or DPO sets the hospital's legal positions.

Why accessibility is now a board-level issue

• The Rights of Persons with Disabilities Act, 2016 requires service providers to make their services accessible.
• In Amar Jain v. Union of India (30 April 2025) the Supreme Court held that digital access is part of the right to life under Article 21 and directed accessible e-KYC.
• Many patients are older or live with a disability: if they cannot book, pay or read reports, the hospital loses them.

Accessibility checklist

1. Every registration and booking field has a label a screen reader announces.
2. OTP and session time-outs warn the user and can be extended.
3. CAPTCHAs have an accessible alternative.
4. Lab reports and bills are tagged PDFs or HTML, not images of text.
5. Text and buttons meet contrast requirements; links say where they go.
6. Calendars, dropdowns and pop-ups work with a keyboard alone.
7. Videos have captions.
8. The app works with TalkBack and VoiceOver, and with large text.

DPDP Act checklist

1. Map the personal data: patients, relatives and staff, in every system.
2. Clear notices before collecting data, available in English and Indian languages.
3. Consent recorded with time and purpose, and withdrawal as easy as giving it.
4. Requests to access, correct and erase data handled and tracked, with a grievance contact.
5. Retention rules: data deleted when its purpose is served, unless another law requires keeping it.
6. Reasonable security safeguards: encryption, access control, two-step sign-in, logs. Failing to take them can draw penalties of up to ₹250 crore.
7. A breach playbook: the Data Protection Board and affected people informed, with a detailed report to the Board within 72 hours under the Rules; CERT-In's 6-hour reporting rule for specified incidents also applies.
8. Large chains: prepare for possible notification as a Significant Data Fiduciary (a DPO in India, impact assessments, audits).

Where healthcare is different

• Personal data may be processed without consent to respond to a medical emergency (section 7 of the Act).
• The Rules allow clinical establishments and healthcare professionals to process a child's data, without verifiable parental consent, to the extent needed to provide health services.
• ABDM consent for sharing health records works alongside DPDP obligations, not instead of them.

A sensible order of work

1. A combined audit of accessibility, DPDP readiness and security of the patient-facing apps.
2. Fix the shared screens first: registration, login, consent, booking, payment, reports.
3. Then data rights, retention and breach response in the back-end systems.
4. Retest and document, well before 13 May 2027.

We audit and fix hospital applications without replacing them: WCAG accessibility audit, DPDP Act compliance, ABDM integration and healthcare software.

Sources: Supreme Court: Amar Jain v. Union of India (2025 INSC 599); W3C: WCAG 2.2; MeitY: data protection framework; Mondaq (HSA): the notified DPDP Rules, 2025; CERT-In directions, 28 April 2022.