Healthcare Cloud Security Risk Assessment in India for HIPAA and DPDP Compliance

A healthcare organisation can have Microsoft 365 security enabled, patient records stored in Azure, multi-factor authentication enforced, and automated backups running every night, yet still have significant security gaps that put patient information at risk.

The problem is not always a missing security product. Sometimes it is an administrator account with excessive permissions, an old employee account that was never disabled, a diagnostic report shared through an unrestricted link, or a backup configuration that has never been tested.

These weaknesses become particularly important for Indian healthcare organisations working with US hospitals, healthcare providers, medical billing companies, and HealthTech businesses. They may need to protect patient information while addressing HIPAA obligations, India’s Digital Personal Data Protection (DPDP) framework, and contractual security requirements imposed by their clients.

A healthcare cloud security risk assessment should therefore go beyond checking whether security features are enabled. It should determine whether those controls actually protect patient information across the organisation’s cloud infrastructure, applications, identities, devices, and data-sharing processes.

For healthcare providers and technology companies in India, the objective is straightforward: understand where patient information is exposed, identify which security weaknesses could create regulatory or operational problems, and establish a practical remediation plan.

Where Healthcare Cloud Security Problems Actually Begin

Consider a medical billing company in India supporting multiple healthcare providers in the United States.

Its employees access patient records, insurance information, billing applications, and supporting documents through Microsoft 365 and cloud-hosted applications.

The company has MFA enabled and uses endpoint security software. From a basic security checklist, the environment may appear reasonably protected.

However, a closer examination could uncover several problems:

• Former employees still have active accounts with access to shared patient documents.
• Billing employees can download records belonging to clients they no longer support.
• External sharing links allow access without adequate restrictions.
• Administrators use everyday accounts for privileged operations.
• Security alerts are generated, but nobody reviews them consistently.
• Backup data exists, but recovery has never been tested.
• There is no documented process for investigating potential exposure of patient information.

None of these issues necessarily requires a sophisticated cyberattack. They can result from ordinary IT administration practices that have not been reviewed as the organisation grows.

This is why healthcare security should be assessed from an operational perspective, not just a technology perspective.

The important question is not whether your organisation has security tools. It is whether those tools are configured correctly, monitored consistently, and protecting the right information.

HIPAA and DPDP: What Indian Healthcare Organisations Need to Understand

Indian organisations may operate across different healthcare markets, and their compliance responsibilities depend on their business model, data processing activities, contractual relationships, and applicable laws.

Two frameworks deserve particular attention.

HIPAA: Protecting Patient Information for US Healthcare Operations

The Health Insurance Portability and Accountability Act (HIPAA) establishes requirements for protecting protected health information (PHI) in the United States.

It applies to covered entities, including qualifying healthcare providers, health plans, and healthcare clearinghouses, as well as business associates performing certain services involving PHI on their behalf.

This distinction is particularly important for Indian businesses.

An Indian medical billing company, healthcare BPO, SaaS provider, or IT service provider may have HIPAA responsibilities when it performs functions involving PHI for a US covered entity or another business associate.

For example, an Indian company providing outsourced billing operations may access:

• Patient names and identification details.
• Medical records and treatment information.
• Insurance policy information.
• Claims and billing documentation.
• Clinical and diagnostic reports.

Its security responsibilities cannot be limited to protecting its own corporate information. It must also consider the healthcare information it handles on behalf of its clients.

Under the HIPAA Security Rule, organisations must conduct a risk analysis covering potential threats and vulnerabilities affecting electronic protected health information (ePHI).

The assessment should consider administrative, physical, and technical safeguards, including access management, audit controls, authentication, security incident procedures, and contingency planning.

One important point: signing a Business Associate Agreement (BAA) does not automatically make a vendor HIPAA compliant. The organisation must also implement and maintain appropriate safeguards.

DPDP Act: Protecting Digital Personal Data in India

India’s Digital Personal Data Protection Act, 2023 introduces a framework governing the processing of digital personal data.

For Indian healthcare organisations, this is relevant to information such as identifiable patient records, contact details, medical histories, and other digital information associated with individuals.

The Act establishes responsibilities concerning:

• Lawful processing of personal data.
• Consent and transparency, where applicable.
• Purpose limitation.
• Reasonable security safeguards.
• Personal data breach notification.
• Data retention and deletion.
• Responsibilities of Data Fiduciaries and their processors.

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Their implementation is phased. The majority of substantive provisions are scheduled to commence on 13 May 2027, while certain provisions have earlier commencement dates.

Healthcare organisations should assess the commencement schedule rather than assume that every requirement is already operational.

They should also consider other applicable requirements, including relevant CERT-In directions and contractual obligations.

HIPAA vs DPDP: What Should Your Organisation Evaluate?

Assessment area	HIPAA considerations	DPDP considerations
Applicability	Covered entity or business associate relationship	Processing of digital personal data within the Act’s scope
Data protection	PHI and ePHI safeguards	Personal data protection
Access management	Authorised access to ePHI	Security safeguards and controlled processing
Risk management	Security risk analysis	Organisational accountability and reasonable safeguards
Third-party relationships	Business Associate Agreements where applicable	Data Fiduciary and Data Processor responsibilities
Incident management	HIPAA breach notification requirements	Applicable personal data breach notification requirements
Data lifecycle	Protection, availability, and contingency planning	Purpose limitation, retention, and deletion obligations

An organisation supporting US healthcare clients while operating in India should not assume that meeting one framework automatically satisfies the other.

The assessment should identify which obligations apply to the organisation and translate them into specific technical and operational controls.

Seven Security Areas That Deserve Closer Examination

A useful assessment should investigate how information moves through the organisation, who can access it, which systems store it, and what happens when something goes wrong.

The following areas are particularly relevant to healthcare environments.

1. Patient Data Access: Can Employees See More Than They Need?

Healthcare organisations frequently have multiple departments accessing overlapping systems.

A billing employee may need insurance and claims information, while a clinician requires access to treatment records. An IT administrator may need infrastructure access but should not automatically have unrestricted access to patient information.

A common problem is that access permissions expand over time without being reviewed.

During an assessment, examine:

• Whether employees have access based on their actual job responsibilities.
• Whether access to patient information is restricted by department or client.
• Whether privileged accounts are separated from everyday user accounts.
• Whether former employees and contractors have been removed.
• Whether administrator permissions are reviewed periodically.
• Whether MFA is enforced for sensitive applications and administrative access.

Practical example: An employee moves from one healthcare client’s billing team to another. Their previous permissions remain active, allowing them to access historical patient documents belonging to the previous client.

The account is technically legitimate, but the access is no longer appropriate.

This is where identity governance and least-privilege access become essential.

Organisations using Microsoft environments should examine Microsoft Entra ID, Conditional Access, authentication policies, and privileged account permissions.

Relevant resource: Microsoft Entra Conditional Access Best Practices for Zero Trust.

2. Microsoft 365 and Azure: Are Patient Records Protected Across All Workloads?

Many healthcare organisations use Microsoft 365 and Azure for communication, document management, application hosting, and data storage.

However, enabling Microsoft security features does not guarantee that every workload is properly protected.

For example, a healthcare organisation might have MFA enabled but still allow sensitive SharePoint documents to be shared with external users without adequate restrictions.

Similarly, an Azure storage account may contain encrypted information but have overly permissive access policies.

The assessment should examine:

Technology	What should be reviewed
Microsoft Entra ID	User permissions, MFA, privileged access, Conditional Access
SharePoint Online	External sharing, document permissions, access reviews
OneDrive	Sharing links, download permissions, external access
Exchange Online	Mailbox access, forwarding rules, suspicious sign-ins
Microsoft Teams	Guest access, file sharing, team membership
Azure Storage	Public access, network restrictions, encryption, access keys
Azure Virtual Machines	Patching, administrative access, network exposure
Azure Key Vault	Secrets management and key access permissions

The goal is to understand whether sensitive information remains protected when employees access, share, store, or transfer it.

For organisations operating Microsoft environments, see HIPAA Compliance with Microsoft 365 and Azure Cloud.

3. Data Loss Prevention: Can Sensitive Information Leave the Organisation?

Healthcare information does not always leave an organisation through a cyberattack.

It may be shared accidentally through email, downloaded to a personal device, copied into an unauthorised application, or uploaded to an external file-sharing service.

This makes data protection and information governance important parts of the assessment.

Consider a situation where an employee downloads a spreadsheet containing patient names, insurance details, and billing information.

If the device is not properly managed or the document is shared externally, the organisation may lose visibility over where that information goes.

A security review should evaluate:

• Whether sensitive information is identified and classified.
• Whether external sharing is restricted appropriately.
• Whether data loss prevention policies cover relevant workloads.
• Whether sensitive files can be downloaded to unmanaged devices.
• Whether email and document-sharing activities are monitored.
• Whether retention and deletion policies are appropriate.

Microsoft Purview can help organisations implement information protection, sensitivity labels, data loss prevention, and data lifecycle controls.

However, policies need to be designed around actual business workflows. Overly restrictive controls can disrupt legitimate clinical and administrative activities, while poorly scoped policies may fail to prevent exposure.

Related resources:

• Microsoft Purview Data Loss Prevention
• Microsoft Purview Implementation Best Practices

4. Endpoint Security: What Happens When a Healthcare Employee’s Device Is Compromised?

Healthcare employees may access patient information from office computers, laptops, remote workstations, and mobile devices.

A compromised endpoint can provide attackers with access to corporate credentials, cloud applications, and sensitive files.

The assessment should determine whether:

• Devices are centrally managed.
• Security updates are installed consistently.
• Endpoint detection and response (EDR) is configured.
• Disk encryption is enforced.
• Unauthorised applications are restricted.
• Device compliance policies are applied.
• Lost or compromised devices can be remotely contained.

A particularly important consideration is the difference between antivirus protection and endpoint detection and response.

Traditional antivirus primarily focuses on detecting known malicious files and activities. EDR provides broader visibility into endpoint behaviour and helps investigate suspicious activity.

For healthcare environments, endpoint security should be considered alongside identity protection and cloud access controls.

Related resources:

• Endpoint Security Assessment
• Difference Between EDR and Antivirus
• Microsoft Intune Device Compliance Policies

5. Backup and Recovery: Can You Actually Restore Patient Information?

A backup policy may look good on paper, but it does not necessarily mean the organisation can recover its systems after ransomware or infrastructure failure.

Consider an Azure-hosted healthcare application that stores patient records in a database.

The organisation has automated backups, but:

• Backup permissions are available to the same compromised administrator account.
• Backup retention is shorter than the organisation’s recovery requirements.
• No one has tested whether the database can be restored.
• The recovery procedure does not account for application dependencies.
• There is no documented recovery responsibility between internal IT and the cloud provider.

In this situation, the existence of backups provides limited assurance.

During an assessment, review:

Backup isolation: Can attackers compromise backup data using the same credentials used to administer production systems?

Recovery testing: Has the organisation successfully restored applications and data in a controlled test?

Recovery objectives: Are the recovery time objective (RTO) and recovery point objective (RPO) documented and realistic?

Data integrity: How will the organisation verify that recovered records are complete and accurate?

Operational ownership: Who is responsible for restoring databases, applications, identity services, and network dependencies?

These questions help determine whether the organisation can continue essential operations when critical infrastructure becomes unavailable.

6. Security Monitoring: Would Your IT Team Notice Suspicious Activity?

A security product can generate alerts continuously, but alerts are useful only when somebody reviews and investigates them.

For example, a user account may suddenly sign in from an unusual location, access a large number of patient documents, and create multiple external sharing links.

If these activities are not correlated, the organisation may fail to recognise a potential security incident.

A cloud security review should examine:

• Authentication and privileged access logs.
• Unusual sign-in patterns.
• Suspicious file downloads.
• External sharing activities.
• Administrative configuration changes.
• Endpoint security alerts.
• Incident escalation and response procedures.

For organisations using Microsoft security technologies, Microsoft Sentinel can provide centralised security monitoring and correlation across connected data sources.

The assessment should also determine whether alerts have clear ownership, investigation procedures, and escalation timelines.

Relevant resource: Microsoft Sentinel.

7. Third-Party and Cloud Vendor Risk: Who Else Can Access Your Data?

Healthcare organisations rarely operate entirely independently.

They may depend on cloud hosting providers, electronic health record vendors, billing platforms, diagnostic service providers, outsourced IT teams, and application developers.

Each external relationship can introduce additional access and data protection considerations.

A useful assessment should identify:

• Which vendors process or store patient information.
• Whether their access is necessary and appropriately restricted.
• Whether relevant contractual security obligations are documented.
• Whether BAAs are in place where HIPAA requires them.
• Whether vendors have appropriate incident notification procedures.
• Whether data can be returned or securely deleted when a contract ends.
• Whether subcontractors introduce additional security risks.

One common mistake is reviewing the primary cloud provider while overlooking the smaller applications and integrations connected to the environment.

An organisation may have a well-configured Azure environment but still expose patient information through a poorly secured third-party application.

The assessment must consider the entire data-processing chain.

A Practical Healthcare Cloud Security Assessment: What Should Be Checked?

Rather than treating compliance as a collection of documents, organisations should evaluate whether their actual technical controls support their regulatory and operational responsibilities.

The following assessment matrix can be used as a starting point.

Assessment category	Questions to investigate	Expected outcome
Data discovery	Where is PHI/ePHI stored and processed?	Data inventory and classification
Identity security	Who can access sensitive systems and records?	Access control gap analysis
Cloud configuration	Are storage, databases, and workloads securely configured?	Configuration findings
Data protection	Are sharing, encryption, and DLP controls appropriate?	Data exposure assessment
Endpoint security	Are devices managed and protected?	Endpoint security findings
Monitoring	Are suspicious activities detected and investigated?	Logging and monitoring gaps
Backup and recovery	Can critical data and applications be restored?	Recovery readiness findings
Third-party access	Which external providers can access patient data?	Vendor risk observations
Incident response	Can the organisation investigate and respond to exposure?	Response readiness recommendations

The assessment should be adapted to the organisation’s actual environment rather than applying every control identically to every business.

For example, a small HealthTech SaaS provider may require a different assessment scope from a multi-location hospital group or an Indian medical billing company with hundreds of employees.

How Should Security Findings Be Prioritised?

One of the biggest weaknesses in many security assessments is that they produce long lists of vulnerabilities without helping management decide what needs attention first.

A healthcare organisation needs to understand which findings create the greatest risk to patient information and business operations.

A practical approach is to classify findings into four priority levels.

Priority	Example finding	Recommended response
Critical	Publicly accessible storage containing patient information	Immediate containment and investigation
High	Compromised or excessively privileged accounts with access to PHI	Restrict access and remediate promptly
Medium	Inadequate logging or incomplete access reviews	Implement corrective controls within a defined timeframe
Low	Documentation gaps or configuration improvements with limited immediate exposure	Include in the planned security improvement roadmap

These are illustrative classifications, not universal risk ratings. The final priority should consider the actual exposure, exploitability, affected information, compensating controls, and business impact.

For example, a public storage configuration containing no sensitive information is not equivalent to one exposing identifiable medical records.

Likewise, a missing security policy document should not automatically receive the same priority as an actively exploitable vulnerability.

The assessment should explain why a finding matters, what could happen if it remains unresolved, and how the organisation can address it.

What Should Your Organisation Receive After an Assessment?

A useful assessment should leave the organisation with clear decisions and actionable next steps, not just a technical report containing screenshots and vulnerability descriptions.

At NG Cloud Security, our assessment approach focuses on connecting technical findings with practical security improvements.

Depending on the agreed scope, the expected assessment deliverables should cover:

1. Assessment Scope and Environment Overview

Documentation of the cloud platforms, applications, identities, endpoints, and data-processing environments included in the review.

2. Security Gap Report

Identified weaknesses across access management, cloud configurations, data protection, endpoint security, monitoring, and other assessed areas.

3. Compliance Mapping

A review of relevant HIPAA security requirements, DPDP obligations, and applicable contractual or operational requirements.

4. Risk Prioritisation

Findings categorised according to their likelihood, impact, and potential exposure of sensitive information.

5. Remediation Recommendations

Specific actions explaining what needs to change, why the change matters, and which security controls can address the issue.

6. Remediation Roadmap

A prioritised improvement plan that helps management and IT teams allocate resources and track progress.

7. Validation and Follow-up

Where included in the engagement, verification of implemented improvements and reassessment of previously identified findings.

The exact deliverables should be agreed during assessment scoping so that the organisation knows what is included and what requires additional testing or implementation work.

Why Choose NG Cloud Security for Healthcare Security Assessments?

Healthcare security requires an understanding of how infrastructure, identities, applications, endpoints, and data protection controls work together.

NG Cloud Security approaches healthcare security through practical IT and cloud security assessments, focusing on identifying weaknesses and helping organisations strengthen the controls protecting sensitive information.

Our HIPAA Compliance Services support healthcare providers, HealthTech companies, medical billing organisations, business associates, and technology providers serving the US healthcare industry.

Our assessment and security capabilities include:

• HIPAA security risk assessment and compliance gap identification.
• Microsoft 365 and Azure security configuration reviews.
• Identity and access management assessments.
• PHI and ePHI data protection considerations.
• Endpoint and cloud infrastructure security.
• Security monitoring and incident response preparedness.
• Practical remediation recommendations and implementation support.

Organisations can also explore our Cloud Security Assessment Services to understand how cloud configuration, architecture, access policies, and security controls can be evaluated.

Rather than recommending additional security products by default, the objective is to understand what is already deployed, identify where it falls short, and recommend improvements based on actual risks.

Frequently Asked Questions

Does HIPAA apply to healthcare companies operating in India?

HIPAA applicability depends on the organisation’s role and activities, not simply its geographical location. An Indian company may have HIPAA obligations if it performs functions involving PHI on behalf of a US covered entity or business associate.

This can include medical billing companies, healthcare BPOs, HealthTech providers, SaaS companies, and certain IT service providers.

Is HIPAA compliance enough for an Indian healthcare organisation?

Not necessarily. An organisation operating in India may also need to evaluate the DPDP Act and other applicable Indian legal, regulatory, and contractual requirements.

HIPAA and DPDP have different scopes and obligations. Organisations should assess each framework according to their operations and data-processing activities.

Does storing patient data in Azure automatically make it HIPAA compliant?

No. Using Azure does not automatically make an organisation HIPAA compliant.

Organisations must evaluate the specific services being used, applicable Microsoft contractual commitments and BAA coverage, access controls, security configurations, monitoring, data protection, and their own responsibilities under HIPAA.

How often should a healthcare organisation conduct a cloud security assessment?

There is no single assessment frequency that applies to every organisation.

A risk-based approach should consider significant infrastructure changes, new applications, changes in vendors, security incidents, changes in data processing, and evolving regulatory obligations.

Organisations should also conduct periodic reviews to ensure that previously implemented controls remain effective.

Can a healthcare cloud security assessment identify HIPAA compliance gaps?

Yes. A properly scoped assessment can examine technical and operational safeguards relevant to HIPAA, identify weaknesses, and provide recommendations for remediation.

However, a technical assessment alone does not establish complete HIPAA compliance. Administrative, physical, contractual, and other applicable requirements must also be considered.

Does a cloud security assessment include Microsoft 365 and Azure?

It can, depending on the agreed scope.

For healthcare organisations using Microsoft technologies, the assessment may cover Entra ID, Conditional Access, SharePoint, Exchange Online, Microsoft Defender, Microsoft Purview, Azure infrastructure, storage, identity permissions, and security monitoring.

What is the difference between a HIPAA risk assessment and a general cloud security assessment?

A general cloud security assessment evaluates infrastructure security, configurations, identities, network exposure, data protection, and other technical risks.

A HIPAA security risk assessment specifically evaluates potential risks and vulnerabilities affecting ePHI and the safeguards required under the HIPAA Security Rule.

The two can overlap significantly, but a general cloud assessment should not be assumed to cover every HIPAA requirement.

Identify Healthcare Security Gaps Before They Become Incidents

A healthcare organisation does not necessarily become vulnerable because it lacks expensive security technology. In many cases, the greater problem is that existing controls have not been configured, reviewed, or monitored properly.

An inactive employee account, unrestricted document-sharing permission, exposed cloud resource, or untested backup can create risks that remain unnoticed until an incident occurs.

For Indian healthcare providers, medical billing companies, and HealthTech businesses working with US healthcare organisations, reviewing these weaknesses is an important step towards protecting patient information and strengthening compliance readiness.

Is your healthcare cloud environment protecting the information it is supposed to?

Talk to a HIPAA Security Expert at NG Cloud Security to assess your existing environment, identify security gaps, and develop a practical plan to strengthen your cloud security posture.