Legal norms for diagnostic labs in India

Healthcare regulation in India is substantially a state subject, which means the specifics differ depending on where you operate. What follows is a general picture intended to help you ask the right questions, not a substitute for advice from someone who knows your state's requirements.

The Clinical Establishments (Registration and Regulation) Act, 2010 is the principal framework, but it only applies in states that have adopted it. Many have; several have their own equivalent legislation instead. Check which applies to you before assuming anything.

Where it applies, the Act requires registration, sets minimum standards for facilities and staffing, and requires that services and rates be displayed. Enforcement varies but has tightened considerably over the last few years, and operating without registration where it is required is a meaningful risk.

This is the requirement with the sharpest consequences. A pathology report must be signed by a registered medical practitioner qualified in pathology — an MD Pathology or a recognised equivalent. A technologist, however experienced, cannot sign reports.

The Supreme Court and several High Courts have addressed this directly, and state medical councils have acted against arrangements where a pathologist's signature appeared on reports they had not reviewed. If you engage a visiting pathologist, the verification needs to be real and you should be able to demonstrate that it happened.

Practically, this means your systems should record who verified each report and when. A software audit trail that shows a named pathologist verified a specific report at a specific time is far better evidence than a signature image in a template.

Retention requirements vary by state and by record type, but the common baseline is three years for outpatient records, with longer periods for certain categories. Many states require more, and medico-legal cases require retention until the matter concludes.

The practical advice is to retain longer than the minimum. Storage is cheap, and the cost of not having a record when it is needed is high. Most labs running on cloud software simply retain indefinitely, because there is no compelling reason to delete.

The Bio-Medical Waste Management Rules, 2016 apply to every laboratory generating biomedical waste, which is all of them. You need authorisation from your State Pollution Control Board, a contract with an authorised treatment facility, correct colour-coded segregation, and records of what was handed over and when.

This is one of the more actively inspected areas. Keep your records current — the annual return is due by the end of June each year, and gaps in the handover register are the most common finding at inspection.

The Digital Personal Data Protection Act, 2023 applies to health data and brings obligations that many labs have not yet worked through. Health data is sensitive personal data, and the Act requires a lawful basis for processing, reasonable security safeguards, breach notification, and mechanisms for patients to access and correct their data.

For most labs the practical implications are: get consent properly at registration rather than assuming it, keep patient data secure and access-controlled, be able to produce a patient's data on request, and have a plan for what you would do if you suffered a breach.

If you use cloud software, your provider is a data processor and you should have a data processing agreement with them. Ask for it — a provider who cannot produce one has not thought about this properly.

Where the Clinical Establishments Act applies, you are generally required to display your rates for common tests visibly. Some states specify the format. Beyond the legal requirement, this is worth doing anyway: rate disputes at the counter are unpleasant and entirely avoidable.