A patient's file holds some of the most sensitive information a person has: diagnoses, medicines, test results, photographs, contact details and payment history. Clinics in Pakistan handle this information every day, on paper, in spreadsheets, in chat groups and increasingly in software. Yet the legal picture is not as simple as in some other countries, and many clinic owners are unsure what rules actually apply. This guide explains, in plain language, where Pakistan's data protection law stands, what clinics should do regardless, and how to protect patient records in daily practice. It is general information, not legal advice. Clinics with specific concerns should consult a qualified lawyer.
Where the law stands
Pakistan has been working on a comprehensive personal data protection law for many years. Draft versions of a Personal Data Protection Bill have been prepared repeatedly, and commentary from 2026 continues to describe the country as still without an enacted general data protection statute. Parliamentary discussion of a finalised bill has been reported, but a bill under discussion is not the same as an enacted law, so clinics should watch for official publication in the Gazette before assuming new obligations are in force.
In the meantime, some existing provisions are relevant. The Constitution protects the privacy of the home subject to law, and the Prevention of Electronic Crimes Act 2016 targets offences such as unauthorised access to information systems. Commentators note that this Act was designed to punish cybercrime rather than to regulate how organisations collect, store and share personal data. Healthcare regulators, professional bodies and ethical codes also expect patient confidentiality, and the facility standards used in licensing include requirements on medical records.
The key message: even without a single data protection law, clinics are expected to protect patient confidentiality, and a breach can cause real harm to patients and to the clinic's reputation.
Why clinics should act now anyway
- Patient trust. Patients choose clinics that treat their information carefully.
- Professional ethics. Confidentiality is a core duty for doctors and clinical staff.
- Regulatory expectations. Licensing standards expect secure, controlled medical records.
- Future law. A comprehensive law, once enacted, will likely expect practices that careful clinics should adopt anyway.
- Practical risk. Lost phones, shared passwords and leaked chat messages cause most real-world breaches.
Practical steps for every clinic
1. Know what data you hold
List where patient information lives: paper files, the reception computer, staff phones, WhatsApp chats, spreadsheets and any software. You cannot protect what you have not mapped.
2. Limit who can see what
Not every staff member needs every record. Reception needs contact details and appointments. Doctors need clinical history. Accounts need billing. Give each role the minimum access the job requires.
3. Never share logins
Shared passwords make it impossible to know who did what. Each person should have their own account, and accounts should be removed promptly when staff leave.
4. Use strong, unique passwords
Short or reused passwords are a common weakness. Passwords should be kept private and changed if there is any doubt.
5. Secure devices and paper
Lock reception computers when unattended, avoid leaving files on desks and store paper records in locked cabinets. Staff phones used for work should have screen locks.
6. Be careful with WhatsApp and photos
WhatsApp is practical for appointments and receipts, but patient photos and clinical details should not be forwarded casually or posted in large groups. Confirm phone numbers before sending anything, and keep messages to what is necessary.
7. Back up and test restores
Records that cannot be recovered after a computer failure are a patient-care problem as well as a data problem. Make sure backups happen automatically and that someone has checked that they can be restored.
8. Decide how long to keep records and how to dispose of them
Set a written policy and follow it. Retention is discussed in this guide to medical record retention.
9. Train staff and write a short policy
A one-page privacy policy that staff read and sign, plus a short briefing for new joiners, prevents most careless mistakes.
10. Have a plan for incidents
If a device is lost or records are exposed, who is told, and what happens next? A simple written plan reduces panic and speeds up the response.
What to ask software vendors
- How is access controlled, and can roles be customised?
- Does each staff member have a separate login?
- Where is data hosted, and how is it backed up?
- Can the clinic export its data?
- Is there a record of who changed what?
- What happens to data if the clinic leaves?
Honest vendors answer these clearly and do not promise that software alone solves privacy.
How CareTrack supports good practice
CareTrack by CreativeIn Tek supports role-based permissions, individual staff accounts, unique patient numbers and a central place for patient and staff records, with an offline desktop app for outage days. These features help clinics follow the habits described above. CreativeIn Tek does not claim that using CareTrack makes a clinic compliant with any law, because compliance also depends on how the clinic itself operates. The company is based in Karachi, and its own privacy practices are described on its privacy policy page.
Frequently asked questions
Does Pakistan have a data protection law?
According to commentary from 2026, no comprehensive law has been enacted yet, although drafts exist. Check official publication for the latest status.
Is it safe to send receipts and reminders on WhatsApp?
It is common practice, but clinics should confirm numbers, keep messages minimal and avoid sending sensitive clinical details.
Can staff keep patient photos on their phones?
Ideally no. Photos should be attached to the patient's record in a controlled system.
Do small clinics need a privacy policy?
A short written policy is good practice at any size. It sets expectations and helps train staff.
To see how roles and permissions protect patient records, book a CareTrack demo. This article is general information and not legal advice.
