Medical Records Under the Mental Healthcare Act, 2017 and the DPDP Act: What Indian Psychiatrists Must Document, Store and Protect

A psychiatrist finishes a difficult consultation.

The patient has spoken about depression, family conflict, medication use and thoughts of self-harm. A relative has shared additional concerns. The psychiatrist has assessed the immediate risk, discussed a safety plan and arranged a follow-up.

The patient leaves—but the psychiatrist’s responsibility does not end there.

Every important clinical detail must now be recorded clearly. At the same time, the patient’s deeply personal information must remain private and protected.

This is what makes psychiatric documentation different from ordinary note-taking. It supports treatment, but it also protects the patient’s dignity, safety and legal rights.

For psychiatrists practising in India, two important laws shape this responsibility:

• The Mental Healthcare Act, 2017
• The Digital Personal Data Protection Act, 2023, commonly known as the DPDP Act

Let us understand what these laws mean in everyday clinical practice.

Why psychiatric records need special care

A psychiatric record may contain information that a patient has never shared with anyone else.

It may include:

• A psychiatric diagnosis
• Suicidal or self-harm thoughts
• Childhood trauma or abuse
• Alcohol or substance use
• Sexual history
• Family and relationship concerns
• Medication history
• Details provided by a relative or caregiver
• The psychiatrist’s observations and clinical interpretation

If this information is incomplete, the psychiatrist may not have the context needed to provide safe and continuous care.

If it is shared carelessly, the patient may experience embarrassment, stigma, discrimination or damage to personal relationships and employment.

Good documentation must therefore achieve two goals:

1. Create a clear clinical record that supports treatment.
2. Protect the patient’s privacy, dignity and legal rights.

What should a psychiatrist document?

A useful psychiatric record should tell the clinical story of the consultation.

It should help the psychiatrist—or another authorised professional—understand what happened, what was observed, what decisions were made and why those decisions were appropriate.

Depending on the consultation, the record may include the following information.

Patient and consultation details

Document the patient’s identifying information along with the date, time, place and type of consultation.

If the consultation was conducted online, at a clinic, during an emergency or as part of a follow-up, that context should also be clear.

Source of information

Psychiatric information may come from different sources.

The patient may describe one experience, while a relative or caregiver may report something different. The record should clearly identify whether information came from:

• The patient
• A family member
• A caregiver
• Another healthcare professional
• Previous clinical records
• The psychiatrist’s direct observation

This distinction is important because every source may have a different perspective.

Presenting concerns and clinical history

The record should describe why the patient sought care and how the problem has developed.

This may include:

• Presenting symptoms
• Duration and severity
• Effect on daily functioning
• Previous psychiatric history
• Medical and neurological history
• Family history
• Personal and social history
• Alcohol or substance use
• Previous treatment and hospitalisation
• Current and previous medications
• Treatment response and adverse effects
• Medication and other allergies

The aim is not to record every word spoken during the session. The aim is to capture the information needed to understand the patient’s condition and support clinical decisions.

Mental Status Examination

The Mental Status Examination should reflect what the psychiatrist observed during the consultation.

It may include:

• Appearance and behaviour
• Speech
• Mood and affect
• Thought process
• Thought content
• Perception
• Cognition
• Orientation
• Insight
• Judgement

Observations should be clear, respectful and clinically relevant. Avoid language that sounds dismissive, insulting or judgemental.

Safety and risk assessment

When clinically relevant, the record should clearly document:

• Suicidal thoughts
• Intent
• Plan
• Access to means
• Previous attempts
• Self-harm behaviour
• Thoughts of harming others
• Severe agitation
• Psychosis or mania
• Substance intoxication or withdrawal
• Ability to care for oneself
• Protective factors
• Immediate safety measures
• Involvement of family or emergency services

Simply writing “low risk” or “no risk” may not show how the conclusion was reached.

A stronger note records the important findings, the psychiatrist’s clinical interpretation and the plan created in response.

Assessment and treatment plan

The final part of the note should connect the findings with the next steps in care.

It may include:

• Working diagnosis
• Differential diagnoses
• Clinical formulation
• Treatment options discussed
• Medication plan
• Therapy or counselling plan
• Safety plan
• Psychoeducation
• Referrals
• Investigations
• Follow-up period
• Emergency advice
• Reasons behind important clinical decisions

A clear treatment plan helps maintain continuity between the current consultation and the next follow-up.

Separate facts, observations and clinical interpretation

A good psychiatric record should distinguish between four kinds of information:

• What the patient reported
• What a relative or informant reported
• What the psychiatrist directly observed
• What the psychiatrist concluded clinically

For example:

The patient reported sleeping for approximately three hours each night during the past week. His wife reported increased irritability and unusually high spending. During the consultation, the patient spoke rapidly and was difficult to interrupt. The findings raise concern for a possible manic episode.

This is clearer than combining every detail into one general statement.

It allows anyone reviewing the record to understand how the clinical conclusion was reached.

What the Mental Healthcare Act, 2017 says

The Mental Healthcare Act protects several rights of people receiving mental healthcare. Three areas are especially important for clinical records.

Right to confidentiality

Section 23 protects information obtained during mental healthcare and treatment.

In simple terms, a patient’s psychiatric information should not be shared merely because someone asks for it.

A psychiatrist should not automatically release the complete record to:

• Family members
• Employers
• Educational institutions
• Insurance companies
• Police
• Friends
• Unrelated healthcare professionals

Before disclosing information, the psychiatrist should identify:

• Whether the patient has given valid consent
• Whether another legal basis permits or requires disclosure
• What information is genuinely necessary
• Who is authorised to receive it
• How it can be shared securely

Even where disclosure is permitted, it does not always mean that the complete psychiatric record should be released. The information shared should be limited to what is necessary for the relevant purpose.

Photographs, recordings and media

Section 24 restricts the release of photographs or other information relating to a person receiving mental healthcare without consent.

This becomes especially important when using:

• Consultation recordings
• Patient photographs
• Screenshots from clinical software
• Case studies
• Teaching material
• Conference presentations
• Social-media content

Removing the patient’s name may not be enough if other details could still reveal the patient’s identity.

Before using clinical material for education, promotion or publication, the psychiatrist should consider consent, anonymisation and the possibility of indirect identification.

Patient access to medical records

Section 25 gives patients the right to access their basic medical records.

This means psychiatric notes should be written with the understanding that the patient may read them.

That does not mean avoiding clinically important information. It means documenting it professionally, accurately and respectfully.

In limited circumstances, particular information may be withheld if disclosure is likely to cause serious harm. However, this should not become a routine reason for refusing access. The patient may approach the Mental Health Review Board regarding restricted information.

What the DPDP Act adds

The DPDP Act focuses on digital personal data.

It can apply when patient information is:

• Collected through an app or website
• Entered into clinic-management software
• Stored on a computer, tablet or mobile device
• Shared through email or messaging platforms
• Recorded on paper and later digitised
• Processed by a cloud, transcription or backup provider

A psychiatrist, clinic or hospital deciding why and how this information is processed may function as a Data Fiduciary under the Act.

Consent should be clear and meaningful

Where consent is the basis for processing personal data, it must be free, specific, informed, unconditional and unambiguous.

Patients should understand:

• What information is being collected
• Why it is needed
• How it will be used
• Whether it will be shared
• How they can exercise their rights
• How they can raise a concern

Consent should not be hidden inside a long and confusing form.

Recording a consultation, using transcription software and sharing a record with another organisation may also require separate consideration. Consent to treatment should not automatically be treated as consent for every other use of the patient’s information.

Collect only what is necessary

Psychiatrists need enough information to provide safe and appropriate care. However, unnecessary personal information should not be collected simply because a form allows it.

Before recording a detail, ask:

• Is it relevant to the patient’s assessment or treatment?
• Is it needed for legal, administrative or safety reasons?
• Would the purpose be clear if the patient reviewed the note?
• Does the entire team need access to it?

Collecting less unnecessary information reduces the impact of accidental disclosure.

Keep information accurate

Inaccurate information can affect diagnosis, medication, risk assessment and future treatment.

Important details should therefore be corrected or updated when necessary.

A correction should not secretly replace or erase the original clinical entry. A safer approach is to preserve a clear amendment trail showing:

• What was corrected
• When it was corrected
• Who made the correction
• Why it was changed

This protects the integrity of the medical record.

Responsibility continues when vendors are involved

A clinic may use an external provider for:

• Cloud storage
• Appointment management
• Transcription
• Electronic health records
• Email communication
• Backups
• Analytics

Using a service provider does not automatically remove the clinic’s responsibility for patient information.

Before using a vendor, the psychiatrist or clinic should understand:

• What information the vendor receives
• Where the information is stored
• Who can access it
• Whether it is encrypted
• How long it is retained
• Whether it is used for another purpose
• What happens after the contract ends
• How a security breach will be handled

The DPDP implementation timeline

As of 30 September 2026, the DPDP framework is being introduced in stages.

The November 2025 commencement notification states that many of the Act’s substantive provisions are scheduled to take effect 18 months after publication, pointing to 14 May 2027.

Many operational rules concerning notices, security safeguards and breach reporting are also scheduled to commence after the transition period.

This gives psychiatric practices time to prepare—but preparation should not be postponed.

The Mental Healthcare Act’s confidentiality and patient-access requirements already matter. Clinics can use the DPDP transition period to review their consent processes, privacy notices, software, access controls, vendor agreements and breach-response plans.

How should psychiatric records be protected?

Security is not only an IT department’s responsibility. In a small clinic, it may begin with the psychiatrist’s own phone, tablet or computer.

A practical protection system should include:

• Strong passwords or biometric access
• Automatic screen locking
• Encryption of stored information
• Access limited to authorised people
• Separate staff accounts
• Regular review of user access
• Secure and recoverable backups
• Logs showing access and changes
• Controlled PDF exports
• Secure methods for sharing records
• A process for lost or stolen devices
• A written response plan for data breaches
• Secure deletion when legally appropriate
• Clear agreements with external service providers

A clinic should also train its staff. Even strong software cannot prevent every breach if passwords are shared, screens are left open or patient information is sent to the wrong person.

What happens when a family member asks for information?

This is a common situation in psychiatric practice.

A concerned parent, spouse or sibling may call the clinic and ask:

“What did the patient tell you?”
“What is the diagnosis?”
“Which medicine has been prescribed?”
“Can you send me the full report?”

The family member may have genuine concerns, but concern alone does not always create an automatic right to receive the complete record.

The psychiatrist should consider:

• The patient’s consent
• The patient’s capacity
• The role of a nominated representative
• Immediate safety concerns
• Relevant legal exceptions
• The minimum information necessary

It can also be helpful to distinguish between receiving information and disclosing information.

A psychiatrist may listen to concerns shared by a relative without automatically revealing the patient’s confidential information in return.

How Dr. Notes for Psychiatrists can support organised documentation

Dr. Notes for Psychiatrists is designed to help organise psychiatric documentation within a structured workflow.

The app can bring together:

• Patient profiles
• Previous evaluations
• Appointments and follow-ups
• Safety and risk assessments
• Symptoms and psychiatric history
• Mental Status Examination
• Clinical scales
• Formulation
• Assessment and treatment planning
• Final review
• PDF export

By connecting these areas, the psychiatrist can create a clearer record of the consultation and review relevant information during the patient’s next visit.

Dr. Notes works offline, and patient information is stored on the doctor’s device. This may reduce exposure associated with routine cloud transmission and helps keep the information under the doctor’s control.

However, offline storage does not automatically guarantee security or legal compliance.

The doctor must still:

• Protect the device
• Control who can access it
• Keep the operating system and app updated
• Manage backups carefully
• Protect exported PDFs
• Respond appropriately if the device is lost or stolen
• Follow legal requirements for access, disclosure and retention

Dr. Notes supports documentation. It does not replace the psychiatrist’s clinical judgement, professional responsibilities or independent legal advice.

A practical checklist for psychiatrists

Before completing a psychiatric record, ask:

Documentation

• Have I clearly recorded the important symptoms and history?
• Have I identified the source of information?
• Have I separated reported information from my observations?
• Have I documented the Mental Status Examination?
• Have I recorded relevant safety findings?
• Does the treatment plan follow logically from the assessment?
• Have I explained the reasons for important decisions?

Confidentiality

• Is every detail relevant and professionally written?
• Who is authorised to access this record?
• Do I have a lawful basis before sharing it?
• Am I sharing only the information that is necessary?
• Could the patient be identified from supposedly anonymised material?

Digital protection

• Is the device properly secured?
• Is the information encrypted?
• Are backups protected and recoverable?
• Can I identify who accessed or changed the record?
• Are exported files stored and shared safely?
• Do I understand what my software vendors do with patient data?
• Do I have a plan for a lost device or data breach?

The trust behind every record

Patients share their most personal experiences because they trust the psychiatrist sitting across from them.

That trust continues after the consultation ends.

It continues in how the note is written, where it is stored, who is allowed to read it and how carefully it is protected.

Psychiatric documentation is therefore not only about recording symptoms or completing a form. It is about creating a clinically meaningful record while protecting the patient’s privacy, dignity and trust.

When records are clear, organised and secure, psychiatrists can provide better continuity of care—and patients can speak more openly, knowing that their stories are being handled responsibly.

---

Official references

• Mental Healthcare Act, 2017
• Digital Personal Data Protection Act, 2023
• DPDP commencement notification
• Digital Personal Data Protection Rules, 2025

This article provides general educational information and is not legal advice. Psychiatrists and healthcare organisations should obtain professional advice based on their practice, systems and applicable state requirements.