HIPAA + DPDP for Indian Healthtech Selling to US Buyers | Osto<\/title>\n<meta name=\"description\" content=\"Indian healthtech selling to US buyers faces both DPDP and HIPAA. How the two regimes differ, where they overlap, and how to satisfy both efficiently.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">An Indian healthtech company selling into US healthcare answers to two regimes at once: DPDP for its Indian users and HIPAA for its US buyers. Here is how they differ, where they overlap, and how to satisfy both without running two programs.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Indian healthtech selling to US buyers faces DPDP at home and HIPAA abroad. DPDP applies to personal data of people in India and demands explicit consent and data-principal rights; HIPAA applies to US health data and requires safeguards and signed BAAs with your US healthcare customers.<\/p>\n <p>The two differ on consent, rights, and paperwork, but share the same security core: encryption, access control, and logging. Build to the stricter standard on the shared controls and layer each regime’s specifics on top, one program, two outputs.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#two\">The two-regime reality<\/a><\/li>\n <li><a href=\"#dpdp\">What DPDP requires<\/a><\/li>\n <li><a href=\"#hipaa\">What US buyers require<\/a><\/li>\n <li><a href=\"#overlap\">Where they overlap<\/a><\/li>\n <li><a href=\"#transfer\">Cross-border data<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"two\">The two-regime reality<\/h2>\n <p>If you build healthtech in India and sell into the US, you sit at the intersection of two data-protection regimes. India’s <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/\">Digital Personal Data Protection Act<\/a> governs the personal data of people in India, and it applies even to companies outside India that serve Indian users. HIPAA governs protected health information in US healthcare, and your US customers, covered entities, will require you to meet it and sign a business associate agreement. Neither replaces the other; you carry both.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">Two regimes, one platform<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">What an Indian healthtech faces<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M3 12h18\"\/><path d=\"M12 3a13 13 0 0 1 0 18a13 13 0 0 1 0-18z\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">DPDP at home<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">India users bring DPDP duties: explicit consent, breach notice, rights.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><rect x=\"3\" y=\"5\" width=\"18\" height=\"14\" rx=\"1.5\"\/><path d=\"M3 9h18M3 13h18M3 17h18\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">HIPAA for US buyers<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Selling to US healthcare means meeting HIPAA and signing BAAs.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 3l9 5-9 5-9-5 9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">One security core<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">The same safeguards underpin both; build once, satisfy both.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"dpdp\">What DPDP requires of you<\/h2>\n <p>For your Indian users, DPDP sets obligations that are, in some respects, stricter than HIPAA. It requires explicit, granular consent before processing personal data, gives data principals rights over their information, and mandates breach notification to the Data Protection Board. Penalties are significant, up to a substantial statutory maximum. Because DPDP has extraterritorial reach, offering services to people in India brings you into scope regardless of where you are based.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">DPDP’s consent bar is higher<\/div>HIPAA permits certain uses of health data, like treatment, without separate authorisation. DPDP generally requires explicit, opt-in consent. If you build to DPDP’s consent standard, you comfortably clear HIPAA’s, which is why the stricter rule is the efficient baseline.<\/div>\n\n <h2 class=\"sec\" id=\"hipaa\">What your US buyers require<\/h2>\n <p>Your US healthcare customers are bound by HIPAA, and they extend that obligation to you contractually. In practice this means you will be treated as a business associate: you must implement HIPAA’s safeguards for the PHI you handle and sign a BAA with each covered-entity customer. For an Indian company, the ability to sign and genuinely meet a BAA is often what makes a US healthcare deal possible at all.<\/p>\n\n <h2 class=\"sec\" id=\"overlap\">Where DPDP and HIPAA overlap<\/h2>\n <p>Here is the good news. However different their paperwork, both regimes rest on the same security foundation.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The shared foundation<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Build the security once, satisfy both<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">DPDP and HIPAA differ on consent, rights, and paperwork, but rest on the same security core. That overlap is your efficiency.<\/div>\n <svg viewBox=\"0 0 700 170\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Shared security controls satisfy both DPDP and HIPAA\">\n<defs><marker id=\"dpArr\" markerWidth=\"12\" markerHeight=\"12\" refX=\"7\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#b9bfe0\"\/><\/marker>\n<linearGradient id=\"dpCore\" x1=\"0\" y1=\"0\" x2=\"1\" y2=\"1\"><stop offset=\"0\" stop-color=\"#1c267a\"\/><stop offset=\"1\" stop-color=\"#3a46c0\"\/><\/linearGradient><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\">\n <rect x=\"255\" y=\"92\" width=\"190\" height=\"66\" rx=\"16\" fill=\"url(#dpCore)\"\/>\n <text x=\"350\" y=\"120\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Shared controls<\/text>\n <text x=\"350\" y=\"140\" text-anchor=\"middle\" fill=\"#c3c9ee\" font-size=\"11\">encryption, access, logging<\/text>\n <rect x=\"18\" y=\"96\" width=\"160\" height=\"58\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"1.6\"\/>\n <text x=\"98\" y=\"121\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">DPDP<\/text>\n <text x=\"98\" y=\"139\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10\">+ consent & rights<\/text>\n <line x1=\"178\" y1=\"125\" x2=\"252\" y2=\"125\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#dpArr)\"\/>\n <rect x=\"522\" y=\"96\" width=\"160\" height=\"58\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"602\" y=\"121\" text-anchor=\"middle\" fill=\"#3a46c0\" font-size=\"14\" font-weight=\"800\">HIPAA<\/text>\n <text x=\"602\" y=\"139\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10\">+ BAAs & health duties<\/text>\n <line x1=\"446\" y1=\"125\" x2=\"520\" y2=\"125\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#dpArr)\"\/>\n <g font-size=\"10.5\" font-weight=\"700\" text-anchor=\"middle\">\n <rect x=\"256\" y=\"24\" width=\"88\" height=\"28\" rx=\"14\" fill=\"#fff\" stroke=\"#c9cfee\" stroke-width=\"1.2\"\/><text x=\"300\" y=\"42\" fill=\"#2b3596\">Encryption<\/text>\n <rect x=\"356\" y=\"24\" width=\"88\" height=\"28\" rx=\"14\" fill=\"#fff\" stroke=\"#c9cfee\" stroke-width=\"1.2\"\/><text x=\"400\" y=\"42\" fill=\"#2b3596\">Access ctrl<\/text>\n <line x1=\"300\" y1=\"52\" x2=\"322\" y2=\"90\" stroke=\"#dfe3f5\" stroke-width=\"1.4\"\/>\n <line x1=\"400\" y1=\"52\" x2=\"378\" y2=\"90\" stroke=\"#dfe3f5\" stroke-width=\"1.4\"\/>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Encryption, access control, logging, and monitoring satisfy the technical heart of both DPDP and HIPAA. You build that security core once. On top of it, you add DPDP’s consent and data-principal rights for Indian users, and HIPAA’s BAAs and health-data duties for US customers. One program, two compliant outputs.<\/p>\n\n <h2 class=\"sec\" id=\"transfer\">The cross-border data question<\/h2>\n <p>Moving data between India and the US raises a fair question. As things stand, DPDP takes a permissive approach to cross-border transfers, personal data may generally flow out of India unless the government specifically restricts a destination. That makes serving US buyers workable today, but the framework allows the government to introduce restrictions by notification. The practical takeaway: design your architecture so it does not depend on a single, fixed transfer direction, and watch for regulatory updates.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Build for flexibility<\/div>Cross-border transfer rules can change by government notification. Do not hard-wire your product to one data-flow assumption. An architecture that can adapt to future localisation or transfer restrictions protects you against a rule change you cannot control.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to dual compliance<\/h2>\n <p>Running DPDP and HIPAA as two separate programs would overwhelm any lean team. The efficient path is to build the shared security core once, evidence it once, and map it to both regimes, then layer each one’s specific requirements on top. Doing that across disconnected tools is exactly where dual compliance breaks down.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups, and built with deep roots in the Indian market. Encryption, access control, audit logging, and monitoring run on one platform and produce evidence once, then map to both DPDP and HIPAA alongside 200+ other frameworks. An Indian healthtech can satisfy its home regulator and its US buyers from a single platform, which is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Satisfy India and the US from one platform.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Build the shared security core once and map it to both DPDP and HIPAA, with one set of evidence. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>Does an Indian healthtech company need both DPDP and HIPAA?<\/summary><p>If it serves people in India and sells to US healthcare customers, yes. DPDP applies to the personal data of individuals in India, and US covered-entity customers will require HIPAA compliance and a signed BAA. The two apply together.<\/p><\/details>\n <details><summary>How do DPDP and HIPAA differ?<\/summary><p>DPDP covers all personal data of people in India and generally requires explicit opt-in consent plus data-principal rights. HIPAA covers US health data, permits certain uses like treatment without separate authorisation, and requires safeguards and BAAs. They differ most on consent and scope.<\/p><\/details>\n <details><summary>Which standard should I build to?<\/summary><p>The stricter one on each shared control. DPDP’s explicit-consent requirement is generally higher than HIPAA’s, so building to it clears HIPAA too. A single strong security core plus the stricter of each requirement is the efficient approach.<\/p><\/details>\n <details><summary>Can I transfer health data from India to the US?<\/summary><p>As things stand, DPDP permits cross-border transfers by default unless the government restricts a specific destination, so serving US buyers is workable. However, the government can introduce restrictions by notification, so design your architecture to adapt rather than depend on one fixed transfer direction.<\/p><\/details>\n <details><summary>Do US customers require a BAA from an Indian vendor?<\/summary><p>Yes. US covered entities must sign <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate-agreement\/\">business associate agreement<\/a>s with vendors handling PHI, regardless of where the vendor is based. Being able to sign and genuinely meet a BAA is often what makes a US healthcare deal possible for an Indian company.<\/p><\/details>\n <details><summary>Can one platform handle both DPDP and HIPAA?<\/summary><p>Yes. Because both rest on the same security core, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, access control, and logging, you can build and evidence those controls once and map them to both regimes, then layer each one’s specific consent, rights, and BAA requirements on top.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA + DPDP for Indian Healthtech Selling to US Buyers | Osto An Indian healthtech company selling into US healthcare\u2026<\/p>\n","protected":false},"author":8,"featured_media":905,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[385,384],"class_list":["post-904","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-dpdp-and-hipaa","tag-hipaa-and-dpdp"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=904"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/904\/revisions"}],"predecessor-version":[{"id":906,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/904\/revisions\/906"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/905"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":904,"date":"2026-08-17T18:26:27","date_gmt":"2026-08-17T18:26:27","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=904"},"modified":"2026-08-17T18:26:27","modified_gmt":"2026-08-17T18:26:27","slug":"hipaa-dpdp-indian-healthtech-us-buyers","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-dpdp-indian-healthtech-us-buyers\/","title":{"rendered":"HIPAA and DPDP for Indian Healthtech Selling to US Buyers"},"content":{"rendered":"\n\n\n\n\n\nHIPAA + DPDP for Indian Healthtech Selling to US Buyers | Osto<\/title>\n<meta name=\"description\" content=\"Indian healthtech selling to US buyers faces both DPDP and HIPAA. How the two regimes differ, where they overlap, and how to satisfy both efficiently.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">An Indian healthtech company selling into US healthcare answers to two regimes at once: DPDP for its Indian users and HIPAA for its US buyers. Here is how they differ, where they overlap, and how to satisfy both without running two programs.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>Indian healthtech selling to US buyers faces DPDP at home and HIPAA abroad. DPDP applies to personal data of people in India and demands explicit consent and data-principal rights; HIPAA applies to US health data and requires safeguards and signed BAAs with your US healthcare customers.<\/p>\n <p>The two differ on consent, rights, and paperwork, but share the same security core: encryption, access control, and logging. Build to the stricter standard on the shared controls and layer each regime’s specifics on top, one program, two outputs.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#two\">The two-regime reality<\/a><\/li>\n <li><a href=\"#dpdp\">What DPDP requires<\/a><\/li>\n <li><a href=\"#hipaa\">What US buyers require<\/a><\/li>\n <li><a href=\"#overlap\">Where they overlap<\/a><\/li>\n <li><a href=\"#transfer\">Cross-border data<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"two\">The two-regime reality<\/h2>\n <p>If you build healthtech in India and sell into the US, you sit at the intersection of two data-protection regimes. India’s <a href=\"https:\/\/www.osto.one\/resources\/glossary\/dpdp-act\/\">Digital Personal Data Protection Act<\/a> governs the personal data of people in India, and it applies even to companies outside India that serve Indian users. HIPAA governs protected health information in US healthcare, and your US customers, covered entities, will require you to meet it and sign a business associate agreement. Neither replaces the other; you carry both.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:34px 34px 30px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">Two regimes, one platform<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:24px;letter-spacing:-.01em\">What an Indian healthtech faces<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr 1fr ;gap:16px\"><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"12\" cy=\"12\" r=\"9\"\/><path d=\"M3 12h18\"\/><path d=\"M12 3a13 13 0 0 1 0 18a13 13 0 0 1 0-18z\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">DPDP at home<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">India users bring DPDP duties: explicit consent, breach notice, rights.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><rect x=\"3\" y=\"5\" width=\"18\" height=\"14\" rx=\"1.5\"\/><path d=\"M3 9h18M3 13h18M3 17h18\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">HIPAA for US buyers<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">Selling to US healthcare means meeting HIPAA and signing BAAs.<\/div>\n <\/div><div style=\"background:rgba(255,255,255,.06);border:1px solid rgba(174,182,238,.28);border-radius:16px;padding:20px\">\n <div style=\"width:38px;height:38px;border-radius:10px;background:linear-gradient(135deg,#3a46c0,#2b3596);display:grid;place-items:center;font-size:18px;margin-bottom:12px\"><svg width=\"20\" height=\"20\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"#ffffff\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M12 3l9 5-9 5-9-5 9-5z\"\/><path d=\"M3 13l9 5 9-5\"\/><\/svg><\/div>\n <div style=\"font-size:14.5px;font-weight:800;color:#fff;margin-bottom:6px\">One security core<\/div>\n <div style=\"font-size:12px;color:#c3c9ee;line-height:1.5\">The same safeguards underpin both; build once, satisfy both.<\/div>\n <\/div><\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"dpdp\">What DPDP requires of you<\/h2>\n <p>For your Indian users, DPDP sets obligations that are, in some respects, stricter than HIPAA. It requires explicit, granular consent before processing personal data, gives data principals rights over their information, and mandates breach notification to the Data Protection Board. Penalties are significant, up to a substantial statutory maximum. Because DPDP has extraterritorial reach, offering services to people in India brings you into scope regardless of where you are based.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">DPDP’s consent bar is higher<\/div>HIPAA permits certain uses of health data, like treatment, without separate authorisation. DPDP generally requires explicit, opt-in consent. If you build to DPDP’s consent standard, you comfortably clear HIPAA’s, which is why the stricter rule is the efficient baseline.<\/div>\n\n <h2 class=\"sec\" id=\"hipaa\">What your US buyers require<\/h2>\n <p>Your US healthcare customers are bound by HIPAA, and they extend that obligation to you contractually. In practice this means you will be treated as a business associate: you must implement HIPAA’s safeguards for the PHI you handle and sign a BAA with each covered-entity customer. For an Indian company, the ability to sign and genuinely meet a BAA is often what makes a US healthcare deal possible at all.<\/p>\n\n <h2 class=\"sec\" id=\"overlap\">Where DPDP and HIPAA overlap<\/h2>\n <p>Here is the good news. However different their paperwork, both regimes rest on the same security foundation.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">The shared foundation<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:6px\">Build the security once, satisfy both<\/div>\n <div style=\"font-size:13.5px;color:#5b6178;margin-bottom:26px\">DPDP and HIPAA differ on consent, rights, and paperwork, but rest on the same security core. That overlap is your efficiency.<\/div>\n <svg viewBox=\"0 0 700 170\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Shared security controls satisfy both DPDP and HIPAA\">\n<defs><marker id=\"dpArr\" markerWidth=\"12\" markerHeight=\"12\" refX=\"7\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#b9bfe0\"\/><\/marker>\n<linearGradient id=\"dpCore\" x1=\"0\" y1=\"0\" x2=\"1\" y2=\"1\"><stop offset=\"0\" stop-color=\"#1c267a\"\/><stop offset=\"1\" stop-color=\"#3a46c0\"\/><\/linearGradient><\/defs>\n<g font-family=\"Inter,Arial,sans-serif\">\n <rect x=\"255\" y=\"92\" width=\"190\" height=\"66\" rx=\"16\" fill=\"url(#dpCore)\"\/>\n <text x=\"350\" y=\"120\" text-anchor=\"middle\" fill=\"#fff\" font-size=\"14\" font-weight=\"800\">Shared controls<\/text>\n <text x=\"350\" y=\"140\" text-anchor=\"middle\" fill=\"#c3c9ee\" font-size=\"11\">encryption, access, logging<\/text>\n <rect x=\"18\" y=\"96\" width=\"160\" height=\"58\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1c267a\" stroke-width=\"1.6\"\/>\n <text x=\"98\" y=\"121\" text-anchor=\"middle\" fill=\"#1c267a\" font-size=\"14\" font-weight=\"800\">DPDP<\/text>\n <text x=\"98\" y=\"139\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10\">+ consent & rights<\/text>\n <line x1=\"178\" y1=\"125\" x2=\"252\" y2=\"125\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#dpArr)\"\/>\n <rect x=\"522\" y=\"96\" width=\"160\" height=\"58\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#3a46c0\" stroke-width=\"1.6\"\/>\n <text x=\"602\" y=\"121\" text-anchor=\"middle\" fill=\"#3a46c0\" font-size=\"14\" font-weight=\"800\">HIPAA<\/text>\n <text x=\"602\" y=\"139\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"10\">+ BAAs & health duties<\/text>\n <line x1=\"446\" y1=\"125\" x2=\"520\" y2=\"125\" stroke=\"#b9bfe0\" stroke-width=\"2.5\" marker-end=\"url(#dpArr)\"\/>\n <g font-size=\"10.5\" font-weight=\"700\" text-anchor=\"middle\">\n <rect x=\"256\" y=\"24\" width=\"88\" height=\"28\" rx=\"14\" fill=\"#fff\" stroke=\"#c9cfee\" stroke-width=\"1.2\"\/><text x=\"300\" y=\"42\" fill=\"#2b3596\">Encryption<\/text>\n <rect x=\"356\" y=\"24\" width=\"88\" height=\"28\" rx=\"14\" fill=\"#fff\" stroke=\"#c9cfee\" stroke-width=\"1.2\"\/><text x=\"400\" y=\"42\" fill=\"#2b3596\">Access ctrl<\/text>\n <line x1=\"300\" y1=\"52\" x2=\"322\" y2=\"90\" stroke=\"#dfe3f5\" stroke-width=\"1.4\"\/>\n <line x1=\"400\" y1=\"52\" x2=\"378\" y2=\"90\" stroke=\"#dfe3f5\" stroke-width=\"1.4\"\/>\n <\/g>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Encryption, access control, logging, and monitoring satisfy the technical heart of both DPDP and HIPAA. You build that security core once. On top of it, you add DPDP’s consent and data-principal rights for Indian users, and HIPAA’s BAAs and health-data duties for US customers. One program, two compliant outputs.<\/p>\n\n <h2 class=\"sec\" id=\"transfer\">The cross-border data question<\/h2>\n <p>Moving data between India and the US raises a fair question. As things stand, DPDP takes a permissive approach to cross-border transfers, personal data may generally flow out of India unless the government specifically restricts a destination. That makes serving US buyers workable today, but the framework allows the government to introduce restrictions by notification. The practical takeaway: design your architecture so it does not depend on a single, fixed transfer direction, and watch for regulatory updates.<\/p>\n\n <div class=\"bbox indigo\"><div class=\"bt\">Build for flexibility<\/div>Cross-border transfer rules can change by government notification. Do not hard-wire your product to one data-flow assumption. An architecture that can adapt to future localisation or transfer restrictions protects you against a rule change you cannot control.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path to dual compliance<\/h2>\n <p>Running DPDP and HIPAA as two separate programs would overwhelm any lean team. The efficient path is to build the shared security core once, evidence it once, and map it to both regimes, then layer each one’s specific requirements on top. Doing that across disconnected tools is exactly where dual compliance breaks down.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups, and built with deep roots in the Indian market. Encryption, access control, audit logging, and monitoring run on one platform and produce evidence once, then map to both DPDP and HIPAA alongside 200+ other frameworks. An Indian healthtech can satisfy its home regulator and its US buyers from a single platform, which is why lean teams treat Osto as the default foundation.<\/div>\n\n <div class=\"callout\">\n <h3>Satisfy India and the US from one platform.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Build the shared security core once and map it to both DPDP and HIPAA, with one set of evidence. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>Does an Indian healthtech company need both DPDP and HIPAA?<\/summary><p>If it serves people in India and sells to US healthcare customers, yes. DPDP applies to the personal data of individuals in India, and US covered-entity customers will require HIPAA compliance and a signed BAA. The two apply together.<\/p><\/details>\n <details><summary>How do DPDP and HIPAA differ?<\/summary><p>DPDP covers all personal data of people in India and generally requires explicit opt-in consent plus data-principal rights. HIPAA covers US health data, permits certain uses like treatment without separate authorisation, and requires safeguards and BAAs. They differ most on consent and scope.<\/p><\/details>\n <details><summary>Which standard should I build to?<\/summary><p>The stricter one on each shared control. DPDP’s explicit-consent requirement is generally higher than HIPAA’s, so building to it clears HIPAA too. A single strong security core plus the stricter of each requirement is the efficient approach.<\/p><\/details>\n <details><summary>Can I transfer health data from India to the US?<\/summary><p>As things stand, DPDP permits cross-border transfers by default unless the government restricts a specific destination, so serving US buyers is workable. However, the government can introduce restrictions by notification, so design your architecture to adapt rather than depend on one fixed transfer direction.<\/p><\/details>\n <details><summary>Do US customers require a BAA from an Indian vendor?<\/summary><p>Yes. US covered entities must sign <a href=\"https:\/\/www.osto.one\/resources\/glossary\/business-associate-agreement\/\">business associate agreement<\/a>s with vendors handling PHI, regardless of where the vendor is based. Being able to sign and genuinely meet a BAA is often what makes a US healthcare deal possible for an Indian company.<\/p><\/details>\n <details><summary>Can one platform handle both DPDP and HIPAA?<\/summary><p>Yes. Because both rest on the same security core, <a href=\"https:\/\/www.osto.one\/resources\/glossary\/encryption-at-rest-and-in-transit\/\">encryption<\/a>, access control, and logging, you can build and evidence those controls once and map them to both regimes, then layer each one’s specific consent, rights, and BAA requirements on top.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA + DPDP for Indian Healthtech Selling to US Buyers | Osto An Indian healthtech company selling into US healthcare\u2026<\/p>\n","protected":false},"author":8,"featured_media":905,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[385,384],"class_list":["post-904","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-dpdp-and-hipaa","tag-hipaa-and-dpdp"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=904"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/904\/revisions"}],"predecessor-version":[{"id":906,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/904\/revisions\/906"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/905"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}