A telemedicine product in India answers to three regulators at once, and only the doctor may prescribe

A telemedicine product in India answers to three regimes that do not share a regulator. The Telemedicine Practice Guidelines of 25 March 2020, Appendix 5 to the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, let only a registered medical practitioner counsel or prescribe, and bar a platform built on artificial intelligence from doing either. The National Medical Commission (NMC) put its own 2023 conduct regulations in abeyance and adopted those 2002 Regulations by a notification of 23 August 2023. Software that diagnoses, monitors or treats is a medical device under the Medical Devices Rules, 2017 (MDR) and falls into Class A, B, C or D by its intended use. Patient data comes under the Digital Personal Data Protection Act, 2023 (DPDP Act), whose main duties begin on 13 May 2027.

Which rules bind the doctor, and where do they now come from?

The Telemedicine Practice Guidelines were issued on 25 March 2020 by the Board of Governors in supersession of the Medical Council of India, and their cover states that they constitute Appendix 5 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002. They apply to a registered medical practitioner (RMP) enrolled in a State Medical Register or the Indian Medical Register, who under paragraphs 1.3.1 and 1.3.2 may consult patients "from any part of India" on the same professional norms as in person.

The National Medical Commission Act, 2019 repeals the Indian Medical Council Act, 1956 from a date the Central Government appoints (section 60(1)), and section 27(1)(b) gives the Ethics and Medical Registration Board the function of regulating professional conduct under regulations made under the 2019 Act. The NMC published its own Registered Medical Practitioner (Professional Conduct) Regulations on 2 August 2023, whose regulation 29 made telemedicine permissible "following the Telemedicine Practice Guidelines". By a notification dated 23 August 2023, in force on its publication in the Gazette on 24 August 2023, an amendment held them "in abeyance with immediate effect" and adopted the 2002 Regulations "as if the same have been made by the Commission".

What may the platform do, and what may it not?

Section 5 of the Guidelines is addressed to platforms that work across a network of RMPs. A platform must ensure that consumers consult RMPs registered with a medical council, do due diligence before listing anyone, show each RMP's name, qualification, registration number and contact details, report non-compliance to the Board of Governors and keep a grievance mechanism. A platform found in violation may be blacklisted, after which "no RMP may then use that platform".

Paragraph 5.4 is the limit that shapes a product. A platform based on artificial intelligence or machine learning is "not allowed to counsel the patients or prescribe any medicines". Such tools may assist an RMP, but the RMP must deliver the final prescription or counselling directly.

Other rules bind the practitioner but fix the design. The consultation cannot be anonymous, and the registration number appears on prescriptions, the website and receipts (paragraphs 3.2.1 and 3.2.5). In an emergency, telemedicine is to be avoided where in-person care is available and "should be limited to" first aid, life-saving measures, counselling and referral advice (1.4.2.3). An RMP may not insist on telemedicine where the patient will travel, and may not solicit patients "through any advertisements or inducements" (3.7.1.4).

What may be prescribed, by list?

Paragraph 3.7.4 permits prescribing only on adequate information, and prescribing without a diagnosis or provisional diagnosis "will amount to a professional misconduct". There are four lists:

• List O: medicines safe through any mode, such as paracetamol;
• List A: medicines for a first consult that is a video consultation, and refills on a follow-up;
• List B: medicines added on a follow-up to those prescribed in person for the same condition;
• Prohibited List: Schedule X medicines under the Drugs and Cosmetics Act, 1940 and the rules made under it, and narcotic or psychotropic substances under the Narcotic Drugs and Psychotropic Substances Act, 1985.

A first consult is one where the patient has not seen the RMP before, last consulted more than six months earlier, or presents a different condition. A follow-up is a consultation with the same RMP within six months of an in-person consultation, for the same condition, and it is not a follow-up if there are new symptoms outside that condition or the RMP does not recall the earlier treatment.

When does software become a medical device?

S.O. 648(E) of 11 February 2020, made under section 3(b)(iv) of the Drugs and Cosmetics Act, 1940, specifies from 1 April 2020 as a drug every device "including a software or an accessory" that does not act by pharmacological, immunological or metabolic means and is intended by its maker for one of six purposes, among them diagnosis, prevention, monitoring, treatment or alleviation of disease or disorder. The Medical Devices Rules, 2017 (G.S.R. 78(E) of 31 January 2017, in force from 1 January 2018) regulate such devices.

The test is intended purpose. The Central Drugs Standard Control Organisation (CDSCO) Guidance Document on Medical Device Software, numbered CDSCO/MD/GD/MDSW/01/2026, says it reflects current practice, is not a new control and, by its own notice, is issued for awareness rather than as a statement of law. It reads intended use from labelling, instructions and "promotional material".

On its examples, a Bluetooth application reading a blood pressure cuff for medical purposes, software analysing X-rays or electrocardiograms to suggest or exclude conditions, and an artificial intelligence tool for triage or screening of cancer lesions are devices. Systems used only for scheduling, billing and storing records, general communication systems such as email and video calling that carry prescriptions, and general wellness software that makes no reference to disease are outside the Rules, though they may be treated as devices if a medical function such as image analysis is added. On those examples the video and chat layer is a communication system. A symptom checker or monitoring dashboard is where the question arises.

Which class applies, and who licenses it?

Rule 4 places devices in Class A (low risk), B (low moderate), C (moderate high) or D (high), and rule 4(3) has the Central Licensing Authority classify by intended use. Under the First Schedule, software that drives or influences a device takes that device's class. For standalone software the guidance gives this grid:

Condition      Treatment or diagnosis   Drive clinical mgmt   Inform clinical mgmt
Critical               D                       C                    B
Serious                C                       B                    A
Non-serious            B                       A                    A

CDSCO confirms the class, and the stricter applies where several rules do. Under the guidance, manufacturing licences for Class A and B come from the State Licensing Authority and for Class C and D from the Central Licensing Authority. Import and test licences are central. A Class A device that is non-sterile and non-measuring needs registration but no licence.

What does the data law add for health data?

The Digital Personal Data Protection Act, 2023 creates no separate class of health data. Sensitivity appears only in section 10(1)(a), as a factor for notifying a significant data fiduciary. Its duties fall on the data fiduciary, who decides the purpose and means of processing, towards the data principal.

The Data Protection Board of India was established on 13 November 2025 by G.S.R. 844(E). Section 6(9) and rule 4 of the Digital Personal Data Protection Rules, 2025, on consent managers, start on 13 November 2026. Sections 3 to 5, the rest of section 6, sections 7 to 17 and sections 27 to 34 (other than section 27(1)(d)), 36 and 37, with rules 3 and 5 to 16, start on 13 May 2027, when section 44(2) also omits section 43A of the Information Technology Act, 2000. From that date:

• section 7(a) permits processing of data voluntarily provided for a specified purpose, section 7(f) a medical emergency, and section 7(g) treatment during an epidemic or public health threat;
• section 8(5) and rule 6 require security safeguards, including encryption or masking, access control, logs, backups, a processor contract term and one year's retention of logs;
• section 8(6) and rule 7 require intimation of a personal data breach to each affected principal and to the Board without delay, with detail within 72 hours;
• section 9 requires verifiable parental consent for a child under eighteen and bars tracking and targeted advertising, but Part A of the Fourth Schedule lifts section 9(1) and (3) for a clinical establishment or healthcare professional, to the extent necessary for the child's health.

The Schedule sets maximum penalties of INR 250 crore for a failure of safeguards under section 8(5), INR 200 crore for failing to give breach intimation or breaching the children's provisions, and INR 50 crore for any other breach.

How might a launch run? An illustration

An illustration. The product and dates below are hypothetical, applying the sources to an invented platform with a video consultation service and a symptom checker, launching on 1 March 2027.

Software
  Symptom checker informs care for non-serious complaints     Class A, registration
  Same engine used by patients for a serious condition        Class C, or D if treated as critical
  Video and chat layer                                        communication system

Prescribing, one patient
  In-person visit to Dr X for hypertension                    10 January 2027
  Follow-up window closes (six months)                        10 July 2027
  Video consult on 15 July 2027, no consult since 10 January  first consult: lists O, A

Data law
  Launch                                                      1 March 2027
  Main duties begin                                           13 May 2027
  Days of operation before they begin                         73
  Ceiling for failed safeguards, section 8(5)                 INR 250 crore

The checker's class moves with its stated purpose and the seriousness of the condition. The patient's status turns on a calendar date and the condition. And the platform runs 73 days under section 43A of the Information Technology Act, 2000 before the Act's notice, security and breach duties replace it, while the RMPs' confidentiality norms apply from the first consultation.

What remains unsettled?

Whether the Guidelines came with the 2002 Regulations when the NMC adopted them by the notification of 23 August 2023. The Guidelines call themselves an appendix to those Regulations, the 2023 text that referred to them is in abeyance, and the adopting amendment names only the Regulations.

How far section 5 binds a platform that is not an RMP. The sanction is blacklisting, and no designation procedure is stated.

Whether a consultation platform is a clinical establishment for Part A of the Fourth Schedule, which takes its meaning from the Clinical Establishments (Registration and Regulation) Act, 2010. If it is not, the children's consent duties apply on their words.

Where the line falls between a communication system and a device when a platform adds a clinical function. The guidance gives examples at either end only.