Healthcare Marketing Compliance: HIPAA, DPDP Act, and What You Can Say in Ads

The Fine for Getting Healthcare Advertising Wrong Is Not a Slap on the Wrist

Let us start with numbers that focus the mind.

India's Digital Personal Data Protection Act (DPDP Act), which received Presidential assent in 2023 and began enforcement proceedings in 2025, carries penalties of up to ₹250 crore per data breach or violation. The Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954 carries criminal penalties including imprisonment. The National Medical Commission's advertising guidelines of 6 October 2026 set out graded penalties for doctors, from a warning up to removal from the medical register for one to three years for repeated violations.

Healthcare marketing compliance in India is not a suggestion. It is a legal architecture with real consequences, and most hospital marketing teams are operating in it with significant blind spots.

This guide covers the major compliance frameworks relevant to Indian healthcare marketing and gives you specific guidance on what the rules mean for your ads, content, and data practices.

The DPDP Act: What Healthcare Marketers Need to Know

The Digital Personal Data Protection Act is India's comprehensive data privacy legislation. For healthcare marketers it matters because almost everything a clinic holds about a patient is personal data. The Act has no separate "sensitive data" tier, but health information is exactly the kind of data where consent, purpose limits and security failures do the most damage.

What counts as health data under the DPDP Act:

• Any information about a person's physical or mental health
• Information about a person's medical history
• Biometric data (fingerprints, retinal scans)
• Genetic data
• Any data that could reasonably be used to infer health status

What this means for healthcare marketing specifically:

Patient data you collected for one purpose cannot be used for another purpose without explicit consent.

If a patient filled out a form to book an appointment, you collected their name, contact, and health condition. You may use that data to send appointment reminders. You may NOT use that data to:

• Send marketing messages for other services they did not inquire about
• Add them to a retargeting audience without specific opt-in
• Share with a third-party diagnostic partner for their marketing
• Use for personalized ad targeting without explicit marketing consent

Consent must be specific, informed, and withdrawable.

The "agree to our terms and conditions" checkbox that includes marketing permissions buried in the T&C is not DPDP-compliant consent. Marketing consent must be:

• Separately obtained from service consent
• Clearly worded in plain language
• Specific to the types of communications being authorized
• Easy to withdraw at any time

Practical implementation: Your patient intake forms, website contact forms, and appointment booking flows need a clearly separated checkbox: "I consent to receive health tips, promotions, and updates from [Hospital Name] via WhatsApp/SMS/Email." Patients who do not check this box cannot receive marketing communications.

Data processors (your agencies and vendors) are also liable.

If your CRM provider, email marketing platform, or WhatsApp API vendor processes your patient data in a way that violates the DPDP Act, you share regulatory liability. Review contracts with all third-party vendors handling patient data to ensure data processing agreements (DPAs) are in place.

The Drugs and Magic Remedies Act: What You Cannot Say in Healthcare Advertising

The Drugs and Magic Remedies (Objectionable Advertisements) Act, 1954 prohibits advertising that:

• Claims to cure diseases listed in the Act's schedule (includes cancer, diabetes, tuberculosis, HIV/AIDS among others)
• Uses misleading statements about the effectiveness of treatments
• Makes "magic cure" claims without clinical evidence

Specific phrases you cannot use in ads or on your website:

"Cures cancer" — prohibited "Guaranteed recovery" — prohibited "100% success rate" — prohibited unless backed by rigorously defined clinical data "Permanent cure for diabetes" — prohibited "Reverses Alzheimer's" — prohibited

Phrases that are compliant:

"Evidence-based treatment protocols for diabetes management" "Our oncology team specializes in breast cancer care with outcomes-focused treatment" "Comprehensive cardiac rehabilitation program" "Minimally invasive procedure with faster recovery times" (with specific data if you claim specific timelines)

The line is between advertising care capabilities (acceptable) and advertising guaranteed outcomes (not acceptable).

The NMC's 2026 Advertising Guidelines: Doctor and Hospital Rules

Doctors' conduct is governed by the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, which the National Medical Commission administers. On 6 October 2026 the NMC added detailed Guidelines on Ethical Advertising and Public Communication by Hospitals/Medical Institutions and Registered Medical Practitioners, in force immediately and read with the 2002 Regulations. They cover every medium, including websites, social media, WhatsApp, influencer marketing, search and AI-generated promotion (paras 3.2, 3.5). Our NMC guidelines hub summarises every clause.

What doctors and hospitals can still publish:

• Public-health education in the doctor's own name and designation, without promoting their practice (paras 5.1, 8.2(iii))
• Formal announcements: starting practice, change of address or practice type, temporary absence, consultation fees (paras 8.2(ii), 9.3)
• For hospitals: factual, verifiable institutional information such as departments, facilities, equipment, services, emergency care, accreditation and charges (paras 8.3, 9.1)
• Factual, transparent fee and package information (para 8.1(x))

What is now prohibited:

• Requesting or sharing patient testimonials or reviews for promotion on social media, even with consent (Explanation V to para 3.2; para 6.2)
• Before-and-after photos, success stories and celebrity patients, except strictly scientific or educational use with anonymised consent (para 8.1(v))
• "Best", "No.1", "leading", "painless", guaranteed cures, success rates and patient counts, unless independently verifiable under a disclosed method (paras 8.1(iii), (ix))
• Discounts, limited-period offers, free procedures, cashbacks and referral benefits (para 8.1(x))
• Product endorsements by doctors, paid or unpaid (para 8.1(iv))
• Fake or bought reviews, followers or engagement, and ranking manipulation (para 8.1(xii))
• Agency, influencer or platform fees linked to individual patients (para 8.1(viii))
• AI-generated promotional campaigns, and AI-created patients, doctors or endorsements (para 7.2)

The disclosure line. Every electronic-media post by a doctor should show their name, qualifications, registration status and SMR/NMR registration number, and hospitals must show the same for every doctor they feature (Explanations III and IV to para 3.2).

Penalties. The State Medical Council may apply graded action, from a warning and ethics training for a first violation up to removal from the medical register for one to three years for repeated violations (para 10.1). Hospitals are dealt with under the Clinical Establishments Act or the relevant state act. Using an agency or influencer does not shift the responsibility (para 4.4).

The doctor-creator compliance issue:

Physicians with YouTube channels and Instagram accounts are the sharpest example of the change. Educational content in their own name is fine. A cardiologist with 300,000 YouTube subscribers who endorses a supplement is no longer in a grey area: para 8.1(iv) bars a doctor from endorsing any health or commercial product, paid or unpaid, and para 8.1(ii) bars letting their name, image or voice be used to promote one. ASCI's guidelines on endorsements by health professionals still apply on top for the brands involved.

Consent-Based Marketing: Building a Compliant Patient Communications System

Given DPDP Act requirements, here is what a compliant patient communications system looks like:

Stage 1: Consent collection

• Appointment booking form: service-specific consent (appointment reminders, test results, discharge instructions) separated from marketing consent
• Website: cookie consent banner that separates analytics from marketing cookies
• WhatsApp first contact: before adding any patient to a broadcast list, confirm opt-in

Stage 2: Consent management

• Maintain a consent database showing when, how, and for what purpose each patient consented to communications
• Provide easy opt-out in every communication
• Honor opt-outs within 24 hours

Stage 3: Data retention

• Keep patient data only as long as necessary for the consented purpose
• Medical records: statutory retention periods apply (10 years for most records in most states)
• Marketing data: retain only for active marketing relationships; delete within 30 days of opt-out

Social Media Advertising: Platform Policies That Add to the Regulatory Stack

Beyond Indian law, Google, Meta, and other advertising platforms have their own healthcare advertising policies that restrict what healthcare advertisers can and cannot run.

Meta (Facebook and Instagram):

• Cannot use custom audiences built from health data (people who visited your cancer treatment page cannot be targeted with cancer treatment ads)
• Cannot run "before and after" ads for medical procedures
• Requires special certification for pharmaceutical advertising
• Sensitive health conditions (mental health, HIV, fertility, addiction) are subject to audience targeting restrictions

Google Ads:

• Healthcare and medicine is a sensitive category requiring additional verification in India
• Cannot target based on medical condition inferences
• Prescription drug advertising requires pharmacy certification
• Remarketing to healthcare visitors is restricted for sensitive conditions

Practical implication: Your targeting strategy may be more limited than you think. Standard retargeting to everyone who visited your oncology page likely violates platform policies. Work within compliant audience structures: general website visitors, geographic targeting, interest-based audiences that do not infer health conditions.

Building Compliance Into Your Marketing Workflow

The goal is a marketing workflow where compliance is built in, not bolted on as an afterthought.

Content review checkpoint: Every piece of marketing copy (ad text, website content, social posts) passes through a review step that checks for: prohibited claims (guaranteed outcomes, cure claims, superlatives, success rates), prohibited formats (testimonials, before-and-after images, offers), required disclosures (the doctor's name, qualifications and registration number; sponsored content; AI source marks), and accurate representation of services.

Vendor compliance: All agencies, freelancers, and platforms handling patient data must have signed DPAs in place.

Patient communication compliance: Every broadcast list and email list is consent-verified. Every communication has an opt-out mechanism.

Documentation: Maintain records of consent collection, data processing activities, and marketing compliance reviews. If regulatory scrutiny comes, documentation is your defense.

Build a Compliant Healthcare Marketing System — Compliance Audit Available →