Detailed Analysis of Consent, Privacy, and Right to Information of Patients

The recognition of patient rights, which are basic human rights, is essential to ensure the ethical treatment of persons receiving medical and health care services. These rights form the foundation of the fiduciary relationship between a doctor and a patient and are the cornerstone of the healthcare law. In India, these rights are embodied in the Constitution of India, The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, the Charter of Patient Rights, 2018, the Clinical Establishments Act (Standards for Hospital Level 1A & 1B), 2010 and number other laws. The right to privacy or confidentiality, the right to receive medical information, and the right to informed consent is the most fundamental rights afforded to patients.

The article provides a detailed analysis of consent, privacy, and right to information of patients within the Indian framework, highlighting the specific provisions of law and related case laws.


The recognition and delineation of patient rights, which are basic human rights afforded to patients, is essential to ensure the ethical treatment of persons receiving medical and health care services. These rights form the foundation of the fiduciary relationship between a doctor and a patient and are the cornerstone of the healthcare law. The right to privacy, the right to receive proper medical care, the right to make informed decisions regarding medical treatments are fundamental rights of patients. The digitization of health and patient data has proven invaluable to the healthcare sector and has played a phenomenal role in improving the quality of healthcare. However, the ability to easily store, access, and analyze such data has raised a host of concerns. The utilization of patient data by healthcare providers carries an obligation to protect patients’ right to privacy, confidentiality, and data security.

These internationally recognized patient rights have been embodied in the Constitution of India, under Article 19 and 21, and in numerous legislations. The Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 (“MCI Regulations, 2002”), the Charter of Patient Rights, 2018 (the “Charter”), and the Clinical Establishments Act (Standards for Hospital Level 1A & 1B), 2010 (the “Standards”) are the primary laws providing of patients’ rights.

The MCI Regulations, 2002 sets out the duties, responsibilities, and the general standard of conduct of medical practitioners. It regulates doctor-patient confidentiality and establishes rules about the consent of patients. The Ministry of Health and Family welfares ‘Charter of Patient Rights, which was also adopted by the National Human Rights Commissiondraws upon all relevant provisions, inspired by international charters and guided by national level provisions, to consolidate the rights of patients into a single document. Contrary to the MCI Regulations, 2002 which recognizes patients’ rights as incidental to duties of doctors, the Charter marked a milestone as it directly laid down the rights. Analyzed below is the existing framework of consent, privacy, and right to information of patients in India, encompassing specific provisions of law and judicial decisions.

The Right to Privacy and Confidentiality  

Confidentiality and privacy are essential to all relationships based on trust, especially in the healthcare sector, where it forms the foundation of the doctor-patient fiduciary relationship. To receive proper healthcare, patients must disclose their personal information and medical history to doctors and other healthcare providers. If the protection of this information is not secured by adequate laws, its disclosure, misuse, and other medical privacy violations are inevitable. Medical privacy would include informational privacy (e.g., confidentiality, anonymity, secrecy, and data security); physical privacy (e.g., modesty and bodily integrity); associational privacy (e.g., intimate sharing of death, illness, and recovery); proprietary privacy (e.g., self-ownership and control over personal identifiers, genetic data, and bio-specimens); and decisional privacy (e.g., autonomy and choice in medical decision-making).[1]

The MCI Regulations, 2002, and the Standards[2] regulate the collection of personal health data, the purpose of collection, and disclosure of such data, thereby protecting the privacy of patients. These provisions are reinforced in the Charter.

Article 5 of the Charter declares that “all patients have a right to privacy, and doctors must hold information about their health condition and treatment plan in strict confidentiality”. It does, however, provide for special circumstances under which such information can be communicated i.e., in the interest of protecting others or due to public health considerations. All data concerning the patient should be kept under secured safe custody and insulated from data theft and leakage.[3] A fundamental aspect of the privacy of female patients is the right to have another female person present during a physical examination by a male practitioner.[4]

Section 7.14 of the MCI Regulations, 2002 set out the exceptions to the right of non-disclosure of patient’s personal information. They are:

  • In a court of law under orders of the Presiding Judge;
  • in circumstances where there is a serious and identified risk to a specific person and / or community; and
  • notifiable diseases.

In case of communicable or notifiable diseases, concerned public health authorities should be informed immediately.

Concerning (ii), a physician must determine whether his duty to society requires him to employ knowledge, obtained through confidence as a physician, to protect a healthy person against a communicable disease to which he is about to be exposed.[5] In such cases, disclosure would be necessary. For example, people with HIV/AIDS are stigmatized and discriminated against in society, and it becomes essential to protect their privacy and prevent the disclosure of such sensitive information.  On the other hand, it is a fatal disease that can be sexually transmitted.

In the case of Mr. X v. Hospital Z[6],the Supreme Court of India dealt with the right to confidentiality and privacy of HIV/AIDS infected patients. In this case, the petitioner was engaged to be married to his fiancée. However, he was later diagnosed with HIV and this was disclosed by the doctor to the fiancée, who called off the engagement. The petitioner filed a suit contending that the hospital and doctor had breached their duty under medical ethics by disclosing the information. The Court, while stating that doctors are morally and ethically bound to maintain confidentiality and that public disclosure may amount to an invasion of the Right of Privacy, held that “the right, however, is not absolute and may be lawfully restricted for the prevention of crime, disorder or protection of health or morals or protection of rights and freedom of others.” The disclosure of the HIV(+) status by the doctor was held not to be violative of either the rule of confidentiality or the right of Privacy as the fiancée was saved from being infected by the disease due to the marriage by such disclosure. Therefore, according to this ruling, disclosure to a person at risk of contracting a communicable disease would warrant a violation of the privacy of a patient.

Concerning (iii), a notifiable disease is required by law to be reported to governmental authorities, to allow them to monitor it and take precautions during possible outbreaks.

The recently discovered COVID-19 Virus has been declared a notifiable disease by a few states in India. The Epidemic Diseases Act, 1897, and the Disaster Management Act, 2005, have been invoked across the country to handle the pandemic. These Acts empower the state government to implement necessary measures to prevent the outbreak or spread of disease.

Some state governments have made public the disclosure of data of those under quarantine, and there have been instances of lists of COVID patients circulating social media. This has raised concerns over balancing the requirements of public health, doctor-patient confidentiality, and the right to privacy. The Ministry of Health guidelines released during the pandemic provides for sharing of patient information only with the state or district level surveillance units of the Integrated Disease Surveillance Programme. It does not warrant such disclosure to the public.

A division bench of the Bombay High Court[7], while hearing a petition filed by two people seeking disclosure of names of coronavirus patients to enable contact tracing and prevent others from getting infected, stated that “how far can one go in revealing the identity of the person who has tested positive for COVID-19? Privacy rights are involved.” It observed that there is a risk of ostracisation if the names of Covid-19 patients are revealed. In another petition filed before the Orissa High Court, the petitioners raised concerns over the disclosure of the identity of COVID-19 patients and even cited instances where the Government of Orissa itself had played a part in such disclosure. He court directed the State to ensure that the identity of any person, who is admitted to COVID centres-any Government Hospital/private Hospital, or any Quarantine center in the State, found infected with Covid-19 is not disclosed/publicized either in any intradepartmental communication or in any media platform including social media. It further stated that “we hope and trust that the State shall take further steps if not already taken to keep the   personal information masked by applying appropriate method if not there, such as providing code number for keeping the details in anonymity and keep utmost  confidentiality of such information in different intradepartmental   communication.”

There are various other provisions of law that secure the privacy of patients. The Mental Health Act, 1987 empowers an Inspecting Officer to inspect psychiatric hospitals/nursing homes, their records and to visit and interview patients receiving treatment and care therein. However, it requires that the personal records of a patient so inspected to be kept confidential.[8] Therefore, the law protects the privacy of individuals living with mental illnesses.

Decisional autonomy lies at the heart of privacy. In Justice K S Puttaswamy v Union of India[9], a nine-judge bench of the Supreme Court of India held that “privacy safeguards individual autonomy and recognizes the ability of the individual to control vital aspects of his or her life”, and also recognized the constitutional right of women to make reproductive choices, as a part of personal liberty under Article 21 of the Indian Constitution.[10] The Medical Termination of Pregnancy Act, 1971, which governs abortions in India, places several restrictions on personal autonomy and the right to make reproductive choices. This Act has drawn severe criticism for years from women’s rights activists.

Once a pregnancy has been terminated, The Act and the Medical Termination of Pregnancy Regulations, 2003 prohibits the disclosure of matters relating to treatment for termination of pregnancy to anyone other than the Chief Medical Officer of the State. Admission Register, which contains the details of the admissions of women for the termination of their pregnancies, is a secret document, and the information contained therein as to the name and other particulars of the pregnant woman cannot be disclosed to any person.[11] Further, such a Register can only be kept for five years. The Regulations emphasize the security of information collected in the Registers.

Right to Information and Informed Consent

Patients are faced with making complicated and difficult medical decisions, often life-threatening ones. It, therefore, becomes crucial for them to have complete information regarding their health conditions and treatments to enable them to make an informed medical decision. The related term ‘health literacy’ has been defined as the degree to which individuals can obtain, process, and understand the basic health information and services they need to make appropriate health decisions.

Article 1 of the Charter declares that “every patient has a right to adequate relevant information about the nature, cause of illness, provisional/confirmed diagnosis, proposed investigations and management, and possible complications to be explained at their level of understanding in a language known to them.” The information is required to be provided in a simple and intelligible language. The patient and his/her caretaker have the right to information on the rates charged for each type of service provided and facilities available[12], factual information regarding the expected cost of treatment, and any additional cost that will be incurred.

Patients have the right to ask for medical records and reports of their case, which should be provided to them within 3 days.[13] Not maintaining such records or not complying with the patient’s request for records in the stipulated time will amount to professional misconduct[14] and the doctor shall be liable to disciplinary action.

From a consumer perspective, the Consumer Protection Act, 1986 protects consumers in their capacity as patients as well. In a landmark judgment in  Indian Medical Association v V.P Shantha[15], the Hon’ble Supreme Court of India categorically stated that   “Service”   rendered by a Medical Practitioner is covered under Consumer Protection Act. The Consumer Protection Act protects the right to information and imposes a duty on medical professionals to give proper information and not to resort to unfair trade practices.  Patients can sue doctors or hospitals for breach of duty under the mechanism provided under the Act.

The right to information is the corollary to the duty of medical practitioners to receive informed consent of patients. Consent in the context of a doctor-patient relationship means the grant of permission by the patient for an act to be carried out by the doctor, such as a diagnostic, surgical, or therapeutic procedure.[16]

Article 4 of the Charter declares that “every patient has a right that informed consent must be sought before any potentially hazardous test/treatment (e.g. invasive investigation/surgery/chemotherapy) which carries certain risks.” It further states that after giving such information, the doctor may proceed only if consent has been given in writing by the patient or caregiver. Patients must be competent to give such voluntary ‘informed consent’. To have the competency to make decisions, a patient must have complete medical information to understand the consequences associated with various possible options and conduct an analysis of the costs and benefits. Patients also have the right to seek a second opinion from a clinician of patients’ choice, with records and information being provided by the treating hospital, and to choose alternative treatment if options are available.[17]

These rights have also been categorically affirmed by the judiciary. In the case of Samaira Kohli vs Dr. D Manchanda[18], the plaintiff had consented to and was admitted only for a laparoscopy test. During the laparoscopic examination and while she was under general anesthesia, the doctor sought the consent of the plaintiff’s mother to perform a hysterectomy. The plaintiff’s mother gave her consent and the plaintiff’s uterus was removed.  The plaintiff subsequently sought damages for the loss of her reproductive organs and the performance of the surgery without her consent. The Court ruled in favor of the plaintiff, holding that there was no valid consent for the radical surgery.

The Court further reiterated the principles relating to consent which are summarized as follows:

  • A doctor has to seek and secure the consent of the patient before commencing treatment. The consent so obtained should be real and valid, which means that the patient should have the capacity and competence to consent; his consent should be voluntary, and his consent should be based on adequate information concerning the nature of the treatment procedure so that he knows what is consenting to.
  • Adequate information is to be furnished by the doctor, including disclosure of the (a) nature and procedure of the treatment and its purpose, benefits, and effect; (b) alternatives if any available; (c) an outline of the substantial risks; and (d) adverse consequences of refusing treatment.
  • Consent given for a specific treatment procedure will not be valid for conducting some other treatment procedure The only exception to this rule is where the additional procedure though unauthorized, is necessary to save the life or preserve the health of the patient and it would be unreasonable to delay such unauthorized procedure until the patient regains consciousness and takes a decision.
  • The nature and extent of information to be furnished by the doctor to the patient to secure the consent should be of the extent which is accepted as normal and proper by a body of medical men skilled and experienced in the particular field.

The consent should be obtained in writing from the husband or wife, parent or guardian in the case of a minor, or the patient himself as the case may be. Therefore, the law provides instances where the consent of persons other than the patient, are required to be taken. For example, in an operation which may result in sterility, the consent of both husband and wife is needed.[19] For any act of in-vitro fertilization or artificial insemination, the informed consent of the female patient, her spouse as well as the donor is required.[20]

The right to informed consent is enshrined in other provisions of law as well.  The Medical Termination of Pregnancy Act, 1971 requires a pregnancy of a woman below the age of eighteen years or a lunatic to be terminated only with the consent in writing of her guardian. In other cases, a pregnancy can be terminated only with the consent of the pregnant woman.[21] Therefore, the husband’s consent is not required where the woman is married. The law includes the principles about the choice and consent of the patient to undergo an abortion.

Consent of the patient also has to be obtained for research purposes. Publication of photographs or case studies without consent by patients is prohibited. However, If the identity of the patient cannot be discerned then consent is not needed.[22] Section 81(2) of the Mental Health Act prohibits a mentally ill person under treatment from being used for purposes of research except with his consent, or if he is incompetent to provide such consent, the consent of his guardian is required.


Patients’ rights are an integral aspect of the right to health, grounded in human rights considerations. These rights include access to health information, safeguarding confidentiality, privacy, and autonomy in making medical decisions. There is a well-established framework in India for the protection of such rights. There are numerous provisions of law, which have been reinforced by judicial decisions to this effect. The Charter, a milestone document, draws upon the various provisions relevant to patients’ rights that were previously scattered across the Constitution of India, the MCI Regulations, 2002, the Clinical Establishment Act of 2010, and various judgments by the Indian judiciary. However, much progress is yet to be made in the healthcare sector, especially in terms of access to medical care and ensuring data security. 

A fundamental aspect of patients’ rights in India today is the right to file a complaint about a violation of any of these rights and hold doctors, who breach their fiduciary duties, liable. Further improving the quality of healthcare by focusing on the protection of patients’ rights is the need of the hour in healthcare law.


  1. What are Patient Rights?
  2. What is the legal framework governing patient rights in India?
  3. How does the law protect the right to privacy and confidentiality of patients?
  4. How does the law protect the right to information of patients?
  5. How does the law protect the right to informed consent of patients?


  • [1] Allen, A. (2011). Privacy and Medicine, The Stanford Encyclopedia of Philosophy (1st ed.)
  • [2] Annexure 8, Clinical Establishments Act (Standards for Hospital Level 1A & 1B), 2010
  • [3] Article 5, Charter of Patient Rights, 2018
  • [4] Article 5, Charter of Patient Rights, 2018
  • [5] Section 2.2, MCI Regulations, 2002
  • [6] AIR 1999 SC 495
  • [7] Vaishnavi Maruti Gholave and Anr v. UOI and ors, PIL no. 43 of 2020
  • [8] Section 13, Mental Health Act, 1987
  • [9] (2017) 10 SCC 1
  • [10] Ibid.
  • [11] Section 5, Medical Termination of Pregnancy Regulations, 2003
  • [12] Annexure 8, Clinical Establishments Act (Standards for Hospital Level 1A & 1B), 2010
  • [13] Section 7.1, MCI Regulations, 2002
  • [14] Section 7.2, MCI Regulations, 2002
  • [15] [1995(6) SCALE
  • [16] Samaira Kohli vs Dr D Manchanda, (2008) 2 SCC 1
  • [17] Annexure 8, Clinical Establishments Act (Standards for Hospital Level 1A & 1B), 2010
  • [18] (2008) 2 SCC 1
  • [19] Section 7.16, MCI Regulations, 2002
  • [20] Section 7.21, MCI Regulations, 2002
  • [21] Section 3(4), Medical Termination of Pregnancy Act, 1971
  • [22] Section 7.17, MCI Regulations, 2002

Leave a Reply

Your email address will not be published. Required fields are marked *