Healthcare content audit trail for NMC, DPDP and ABDM compliance (2026)
Updated 8 October 2026 to the National Medical Commission's Guidelines on Ethical Advertising and Public Communication by Hospitals/Medical Institutions and Registered Medical Practitioners (public notice No. R-13014/01/2024-Ethics, dated 6 October 2026, in force immediately). Paragraph numbers in this article refer to those guidelines. General information, not legal advice.
For the full NMC rules, see the complete guide to the NMC advertising guidelines 2026. For the AI rules specifically, see AI content in healthcare marketing and para 7.2.
The 3 compliance regimes Indian healthcare content faces
The NMC advertising guidelines (October 2026)
The National Medical Commission's Guidelines on Ethical Advertising and Public Communication by Hospitals/Medical Institutions and Registered Medical Practitioners were issued on 6 October 2026 and are read with the IMC (Professional Conduct, Etiquette and Ethics) Regulations 2002. Four parts bear directly on content operations:
- Responsibility stays with the doctor or hospital (para 4.4). Publishing through an agency, platform or influencer does not absolve the RMP or institution of content it authorised, commissioned, sponsored, adopted or knowingly permitted. The guidelines do not mandate an audit trail, but this is the paragraph that makes one sensible: it is how an institution shows what it authorised and how it was checked.
- What content may say (paras 3.2, 8.1, 8.3). Factual institutional information; no superiority, guaranteed-outcome or comparative claims; no "best", "No.1" or "painless"; no promotional testimonials or before-and-after images (Explanation V, paras 8.1(v) and 8.1(xi)); registration details wherever a doctor is named (Explanations III and IV).
- AI marks (para 7.2). AI-generated promotional campaigns for commercial interest are prohibited. Permitted AI-generated content must carry a source mark stating it is AI-generated. No misleading AI content, no synthetic patients or testimonials, disclosure of AI use where material, and patient data fed to AI must follow privacy law.
- Patient data (paras 6.1-6.4, 7.4, 7.6). Patient information or images only where law permits and with consent; identifying features blurred or cropped; no identifiable patient data in public communication; the IT Act 2000 and the DPDP Act 2023 and Rules 2025 apply. Consent does not make a prohibited testimonial or before-and-after image lawful (para 6.2).
For registered medical practitioners, para 10.1 sets out graded action that "may be contemplated" by the State Medical Council; hospitals are dealt with under the Clinical Establishments Act or the relevant State Act.
DPDP Act 2023
India's Digital Personal Data Protection Act 2023, with the DPDP Rules 2025, governs any patient personal data used in content, such as a consented image used for scientific or educational purposes. Consent must be specific to the purpose (which channels, for how long), the patient can withdraw it, and the organisation must be able to show that notice was given and consent obtained. In practice that means keeping a consent record per piece and acting on withdrawals promptly.
ABDM principles
Ayushman Bharat Digital Mission's data principles affect how patient identifiers are handled in content, integration with patient digital records, and consent integration with ABHA.
The forensic-reconstruction nightmare
Most healthcare brands don't keep a proactive audit trail. When a question about a piece arrives long after publication, the typical reconstruction process is:
- Search agency email archives for the brief approval thread (often missing)
- Hunt WhatsApp group messages for the client approval (often deleted)
- Locate the original file across Google Drive, Canva and agency desktops (versions confused)
- Find the medical reviewer sign-off (often informal, not documented)
- Locate patient consent where a patient image or data was used (often missing entirely)
- Compile a defensive packet from fragments
In our experience this takes 2-4 weeks per request, and the packet often has gaps.
What Content HQ logs per piece
Every content piece in Content HQ carries an immutable audit trail with:
- Brief metadata: who created the brief, when, for which campaign, with which compliance flags identified up front
- Writer and reviewer chain: who wrote, who reviewed at the Internal stage, the AI Tell Score the piece received, who signed off
- AI use and source mark: whether AI tools were used, how, and whether published AI-generated content carries the source mark required by para 7.2
- Client approval: who approved on the client side, when, with what comments (the record of what was authorised, para 4.4)
- Medical sign-off (where required): doctor or medical reviewer signature and timestamp
- Patient consent (where patient data or images are used): consent scope, expiry date, withdrawal history and confirmation that identifying features were removed (paras 6.1-6.4)
- Compliance flags: NMC, DPDP and ABDM checks at briefing, at Internal Approved and at publish
- Publish and edit history: every version published, every later edit with its reason
- Performance and comments archive: engagement, audience reactions and any flagged content concerns
Audit query example
An illustrative case: some months after a hospital published an anonymised, consented case image in an educational post, the patient's family asks for it to be removed and the consent withdrawn. Within Content HQ:
- Find the piece by its consent record, in seconds
- Verify the withdrawal against the contact details in the original consent record
- Start the removal pipeline: website, Instagram, LinkedIn and WhatsApp variants flagged for removal
- Document the withdrawal: timestamp and reason logged in the trail
- Assemble the record: original consent, withdrawal request and removal confirmation in one packet
With the trail already in place, this takes hours rather than the weeks a forensic reconstruction needs.
How to evaluate your current audit readiness
Three questions for any hospital or clinic:
- If asked today, could I show who reviewed and approved any piece published in the last 24 months, and against which rules?
- If a patient withdrew consent today, how fast could I remove every variant of the content and document the withdrawal?
- For content being published now, could I show where AI was used and that the para 7.2 source mark was applied?
Most healthcare brands answer "we'd struggle" to all three. Teams using Content HQ can answer each in an hour or two per piece.
Make your content operation audit-ready.
ICG runs a 30-minute compliance tour of Content HQ: the per-piece audit trail, the consent withdrawal flow and an example audit query. Led by ICG Sr. Leadership.
Book a free compliance tour → WhatsApp ICGFAQ
Why do the NMC guidelines make a content audit trail sensible?
Para 4.4 of the NMC guidelines of 6 October 2026 says publishing through an agency, platform or influencer does not absolve the RMP or institution of content it authorised, commissioned, sponsored, adopted or knowingly permitted. The guidelines do not require an audit trail as such, but a record of who briefed, wrote, reviewed and approved each piece is the practical way to show what was authorised and checked.
What does a healthcare content compliance audit look for?
Evidence that each piece meets the NMC guidelines (factual content, no superiority or outcome claims, no promotional testimonials or before-and-after images, registration details where a doctor is named), that AI-generated content carries a source mark (para 7.2), that any patient data or image was used only where law permits and with consent (paras 6.1 and 7.4), plus reviewer sign-off and version history.
What do the NMC guidelines say about AI-generated content?
Para 7.2 prohibits AI-generated promotional campaigns for commercial interest and requires permitted AI-generated content to carry a source mark stating it is AI-generated. It also bars misleading AI content and synthetic patients, testimonials or endorsements, requires disclosure of AI use where material, and says patient data fed to AI must follow privacy law. An audit trail should record where AI was used and that the mark was applied.
How do the DPDP Act and the NMC guidelines fit together?
Para 7.6 of the NMC guidelines points to the IT Act 2000 and the DPDP Act 2023 and Rules 2025 for personal data. Para 7.4 bars publishing identifiable patient data such as names, faces or anomalies. So a patient image needs a lawful basis and consent under data protection law, and must still meet the NMC rules: consent does not make a prohibited testimonial or before-and-after image lawful (para 6.2).
How long should healthcare content audit trails be retained?
The DPDP Act does not set a single retention period for content audit trails. Keep them for as long as the content is live plus a defensible audit window, because the organisation must be able to show that notice was given and consent obtained. ICG Content HQ retains records indefinitely and they can be queried per piece across the full history.
Can audit trails be reconstructed from WhatsApp and email?
In theory, yes; in practice it is slow and patchy. In our experience forensic reconstruction takes 2-4 weeks per request and still leaves documentation gaps. A trail built as the work happens, as in Content HQ, can answer the same request in hours.
Related reading
- Content HQ product page
- AI Tell Score for healthcare
- 28-piece monthly content calendar
- Why most agencies fail at content ops
How ICG works within these guidelines
ICG is a healthcare marketing agency. Our clients are hospitals, clinics and medical institutions, which may publish factual, objective and verifiable information about themselves (paras 8.3 and 9.1). For individual doctors, ICG supports only genuinely educational content in the doctor's own name and designation (para 8.2(iii)). For doctors and their practices, we run patient-education-driven campaigns: awareness content that helps patients understand their condition and their options, published in the doctor's own name and designation (para 8.2(iii)) and kept free of the self-promotion that para 8.1(ii) bars.
The work is education-first and runs across six channels:
- Awareness content on YouTube. Doctor-led educational videos on public health and disease awareness, in the doctor's own name and designation, without promoting the employer organisation (para 8.2(iii)). See YODA and YouTube marketing for healthcare.
- Research articles and blogs that help patients understand their options: information shared in the normal course, not promotion (para 3.2, Explanation I). See healthcare content marketing, ICG research reports and healthcare SEO.
- Expert answers on Reddit and Quora from named, disclosed accounts. No anonymous or fake posts, no undisclosed commercial relationships and no manufactured engagement (paras 8.1(xi) and 8.1(xii)). See Reddit and Quora programmes.
- Awareness campaigns on Meta, run from the hospital's or clinic's own page, with no discounts, offers, free procedures or other inducements (paras 8.1(x) and 8.3). See Meta advertising for hospitals and clinics.
- NMC-compliant Google Ads landing pages: factual departments, services and facilities, with no "best", "No.1", "100% success", "painless" or "guaranteed" claims (paras 8.1(iii) and 8.1(ix)). See Google Ads for hospitals and clinics.
- "Learn More" instead of "Book Now" on patient-facing pages, so that a page informs rather than solicits (paras 8.1(ii) and 8.3(ii)).
All six rest on three kinds of content: scientific (evidence-based, checked by a qualified clinician), persona-based (written for the questions a specific patient group asks) and consumer-based (built from how people search, compare and decide). AI-assisted drafts go through human medical review, and AI-generated content that is published carries an AI source mark (para 7.2). We do not publish patient testimonials, before-and-after images or superiority claims, and we never buy, incentivise or gate reviews.
Free NMC compliance check. We review a hospital's or clinic's website, Google Business Profile and social channels against the October 2026 guidelines and send back a written list of fixes.
See what the check covers · Request the check · Book a 30-minute call
General information, not legal advice. Source: NMC public notice No. R-13014/01/2024-Ethics, 6 October 2026.
