How do I secure our school's or hospital's patient data?
Key takeaways
- An Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month.
- Segmentation is the control that limits the blast radius: a compromised clinical workstation must not be able to reach the database server.
- CERT-In requires 180 days of logs, and clock synchronisation is what makes a detection timestamp defensible in a 6-hour report.
- Offline backups are not sufficient on their own, because modern ransomware exfiltrates before it encrypts, so a restore still needs exfiltration testing.
- DPDP Rule 7 notification obligations commence from May 2027, and 83% of Indian organisations have not begun comprehensive DPDP implementation.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Why is healthcare the top Indian target?
Four reasons. The data is dense and high-value: name, address, contact, identity documents, diagnosis, prescriptions and sometimes financial details, in one place. The uptime requirement is extreme, so hospitals pay sooner and negotiate less, which makes them attractive targets. The estate is historically under-segmented, with clinical devices, administrative desktops, laboratory systems and the billing application often on one flat network. And the sector has under-invested in identity controls, because staff move, work across sites and share credentials. Kerala is a specific expression of this: an Ernakulam hospital lost over 800GB of patient data in March 2026, and a Kochi hospital was listed by the same ransomware group that month. Schools have the same structural weakness, with a mixed device estate, a young audience and a trusted staff culture.
What does segmentation actually mean in a hospital?
It means at least four zones, with traffic between them controlled and logged. The clinical zone holds bedside and ward devices, and it should reach the clinical application and nothing else. The administrative zone holds the billing, HR and accounts desktops, and it should reach the finance systems. The data zone holds the database server, reachable only by the specific applications that need it, on specific ports. And the guest and vendor zone covers Wi-Fi for visitors, contractors and supplier support, which is the zone most likely to carry the initial compromise and the one most often left flat. The test is simple and it is a test any assessor can run: take a compromised clinical workstation and ask whether it can reach the database server directly. If it can, the segmentation is not real.
What are the patient-data notification obligations?
Two regimes, and both apply to you now or soon. CERT-In's six-hour reporting obligation is already in force for listed incidents, including breaches affecting personal data, and the report goes to incident@cert-in.org.in or 1800-11-4949, with 180 days of logs required. The Digital Personal Data Protection Act 2023 and its rules add a second regime: Rule 7 notification obligations, covering notification to the Data Protection Board and to affected data principals, commence from May 2027. 83% of Indian organisations have not begun comprehensive DPDP implementation, so a hospital or school that prepares its data inventory, consent record and breach register now will be able to notify within hours when the rule starts, rather than spending the first month working out what personal data it holds.
What is the 90-day plan for a hospital or school?
Days 1 to 30, find the exposure: segment the network into the four zones, inventory every system holding personal data, find the internet-facing remote access and close the exposed RDP ports, and set MFA on email, the clinical application and the backup console. Days 31 to 60, build resilience: move backups to offline immutable storage, run a timed restore test of a patient record set, and verify log retention is actually 180 days with clock synchronisation on the domain controllers, firewalls and application servers. Days 61 to 90, rehearse: write the incident runbook that starts with the six-hour report, run a tabletop exercise with clinical and administrative staff, notify affected individuals from a template, and set the re-test date. That is a realistic plan for a mid-sized institution, and it is far cheaper than one incident.
| Days | Workstream | Outcome to evidence |
|---|---|---|
| 1-15 | Network segmentation into clinical, admin, data and guest zones | A compromised clinical workstation cannot reach the database |
| 1-30 | Data inventory of every system holding personal data | A written list with an owner and a retention period for each |
| 16-30 | MFA on email, clinical application, backup console and remote access | No clinical system reachable with a password alone |
| 31-45 | Offline immutable backups with a timed test restore | A patient record set restored and verified on record |
| 31-60 | 180-day log retention and clock synchronisation verified | A defensible detection timestamp for a CERT-In report |
| 61-75 | Incident runbook starting with the 6-hour CERT-In report | A named call list and a ready notification template |
| 76-90 | Tabletop exercise and re-test date scheduled | A written exercise report with corrective actions |
What are the frequently asked questions?
Get a straight answer on this
Send us your user count, your site count and the systems that hold personal data, and we will return a fixed-price 90-day plan with a start date.
Send us the details See pricing