Who this guide is for
Medical superintendents, hospital administrators, heads of security, NABH coordinators, fire safety officers and DPOs at private, trust and government hospitals and nursing homes in India. This is not legal advice: confirm legal points with counsel and fire points with your fire authority.
Hospitals at a glance
| Factor | What it usually looks like |
|---|---|
| Visitor volume and peaks | A morning outpatient (OPD) rush, a wave when visiting hours open, a night attendant changeover, surges at casualty |
| Who comes | Attendants, ward visitors, outpatients’ companions, medical representatives, engineers, housekeeping and waste contractors, ambulance drivers, police for medico-legal cases, insurer staff |
| Entry points | Main gate, OPD block, casualty (open all night), inpatient lobby, service and mortuary gates, staff entrances |
| Turnstiles or access control | Rare at the main gate; card or biometric doors at ICUs, theatres, NICUs, stores and server rooms |
| Guard set-up | A contracted security agency, a supervisor per shift, a manned control room |
| Reception | OPD counters and an enquiry desk; for inpatients, the nurse station is the real gate |
| Main risks | Violence against staff, open wards, passes handed on, infant safety, crowds, people missed in an evacuation |
| Rules that apply | MoHFW instructions and advisories of August 2024; state laws on violence against healthcare workers; Clinical Establishments Act 2010 or a state law; NABH 6th edition (voluntary); MoHFW fire guidelines 2026 (advisory) and state fire rules; DPDP Act 2023 and Rules 2025; POSH Act 2013; Mental Healthcare Act 2017; Immigration and Foreigners Act 2025 |
What changed after August 2024: the MoHFW advisories and the Supreme Court
Three responses to the rape and murder of a trainee doctor at R.G. Kar Medical College and Hospital, Kolkata, reshaped the hospital gate.
The Supreme Court (20 August 2024). In its suo motu case the Court recorded that patients and their attendants had unrestricted access to all places and a “Lack of screening for arms and weapons at the entrance”, and asked governments to report on screening, public access and CCTV (SCC Online). Its National Task Force was to consider “technological intervention to regulate access to critical and sensitive areas” (S.S. Rana & Co.) and has reported (Lok Sabha, 29 November 2024). On 17 December 2025 the Court transferred the case to the Calcutta High Court to oversee compliance with its directions (LiveLaw); check that court’s later orders.
MoHFW to central government hospitals, AIIMS and Institutes of National Importance (19 August 2024). The office memorandum asks that entry and exit be “strictly monitored to allow entry to authorized personnel only” and that “Only one or two attendants be allowed with a patient at any point in time”, with an attendant pass, including during visiting hours. It also covers identification badges, monitoring of all visitors, restricted areas, CCTV, a control room staffed at all times, mock drills and display of the state’s penal provisions.
The Health Secretary to the states (23 August 2024). A “strict visitor pass policy” for attendants and relatives, regulated access to key areas, a 24/7 manned control room, liaison with the nearest police station, and security committees (PTI; Lok Sabha answer). A separate MoHFW advisory asks central institutions to file an FIR within six hours of violence against a healthcare worker.
None of this is a statute: the memorandum instructs the Ministry’s own institutions and the letter to the states is advice. The Ministry told Parliament a separate central law was not required.
After an incident, you will be judged against the August 2024 measures. The attendant pass is the one every hospital can introduce this month, and the one most often defeated at the gate.
Hospital visiting hours rules and attendant passes: what the law says
We found no central law that fixes visiting hours or visitor numbers; each hospital sets its own (a government hospital in Nahan, Himachal Pradesh, began issuing two passes per inpatient in May 2025, The Tribune reported). Four sets of rules bear on the gate:
- Emergencies come first. In Pt. Parmanand Katara v Union of India (1989) the Supreme Court held that treatment “would not wait for the arrival of the Police or completing the legal formalities”. Where the Clinical Establishments Act 2010 applies (eleven states and every Union Territory except Delhi, per the Ministry’s portal), section 12(2) also requires treatment “to stabilise the emergency medical condition” of anyone who comes or is brought in. No check, form or approval may stand between a stretcher and casualty.
- Mental health establishments. Section 26(1) of the Mental Healthcare Act 2017 gives an admitted person “the right to refuse or receive visitors”, subject to the establishment’s norms; section 26(4) carves out listed people such as the nominated representative, lawyer and treating doctor. Ask the patient before approving ordinary visitors.
- Harassment. The POSH Act 2013 lists “hospitals or nursing homes” as workplaces (section 2(o)(iii)) and protects “a woman, of any age whether employed or not” (section 2(a)(i)), so a patient, attendant or visitor can go to the Internal Committee.
- Foreign patients. Section 10 of the Immigration and Foreigners Act 2025, in force since 1 September 2025, has hospitals report foreign inpatients, and attendants lodged with them, to the Registration Officer (PRS). District notices, such as Kohima’s of May 2026, ask for Form III online within 24 hours of arrival. This belongs at admissions, not the gate.
A practical pass scheme:
| Pass | Who | Valid for | Rule |
|---|---|---|---|
| Attendant | Named carers; one or two with the patient at a time | The admission, rechecked daily | One at night; never transferable |
| Ward visitor | Relatives and friends | One visiting slot, one ward | Approved by the ward desk |
| Casualty companion | Whoever brings the patient | Until admission or discharge | Recorded after the patient is inside |
| Vendor or contractor | Representatives, engineers, housekeeping and waste staff | The appointment or work order | Named sponsor; induction and permit for work; representatives at fixed hours, never in wards |
| Official | Police, inspectors, insurer staff | The visit | Identity and purpose logged; the duty administrator decides ward access |
Write your visiting rules down (our visitor management policy template is a starting point), display them in the state’s language and enforce them equally. An unwritten rule the guard bends for a persistent relative becomes the weak point in every incident review.
A day at a hospital gate: three scenarios
These are composite situations, not real hospitals.
4:00 pm, visiting hours on ward 4. Eleven relatives arrive for Mr Sharma with two attendant cards; the cards change hands at the stairwell, and Ms Rekha Nair, the ward sister, cannot see who was approved. The fix is a pass tied to one named person with a photo, and visitors approved by the ward desk for one slot.
11:40 pm, casualty after a road accident. Twenty people follow the patient in. Doctors treat first; the guard records companions once the patient is inside. If the crowd turns angry, staff move to a secure area, the control room calls the police, and nobody tries to clear the crowd alone.
2:30 am, smoke in the inpatient block. Ventilated patients cannot go down stairs, so staff move them sideways into the next fire compartment. The incident controller needs the number of attendants and visitors on each floor, which a logbook without exit times cannot give. Missing people are reported to the fire service at once, staff search only where it is safe, and after a real alarm nobody re-enters until the fire officer in charge allows it.
Each turns on one gap: the gate cannot say who holds a valid pass or who has left. Keep OPD areas public and check passes at the corridor into the inpatient block. Tie every pass to one face and one ward, make it expire on its own, and record exits.
Patients, attendants and visitors under the DPDP Act
Keep patients out of the visitor register. They belong in the hospital information system, not a security tool.
An attendant’s record is health-adjacent. The Act has no separate sensitive data category (Cyril Amarchand Mangaldas, FAQ 9), but a record that someone attends a patient in a named ward reveals something about that patient. Show a ward and bed code on passes and guard screens, never a diagnosis or a revealing department.
Notice and consent. Consent must be “free, specific, informed, unconditional and unambiguous” and limited to what the purpose needs (section 6(1)). The visitor may read the notice in English or any of the 22 Eighth Schedule languages (section 5(3)); show English, Hindi and the state’s language at the door, and others on request.
Emergencies. Section 7(f) allows processing without consent “for responding to a medical emergency involving a threat to the life or immediate threat to the health” of anyone. In our reading that covers details a companion gives so staff can treat the patient and reach the family; whether it covers logging companions for security is less clear, so confirm with counsel. Either way, take details after the patient is inside.
Children. Anyone under 18 is a child (section 2(f)), and processing a child’s data needs verifiable consent of a parent or lawful guardian (section 9(1)), with a Rule 10 check that the person is an identifiable adult. Rule 12 and Part A of the Fourth Schedule lift that duty for a clinical establishment only where processing “is restricted to provision of health services to the child”. In our reading that covers a child patient, not a child visiting a grandparent; confirm with counsel. Record the number of children against the adult’s visit, and a child’s name only with that consent.
Retention and dates. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year “for the purposes as specified in the Seventh Schedule”; Cyril Amarchand Mangaldas and Lakshmikumaran & Sridharan read it as binding every data fiduciary. Keep the visit record and logs for one year, and photos and mobile numbers for days, as a written decision your DPO and counsel sign off. Most duties apply from 13 May 2027 (Rule 1(4)); some firms, including Cyril Amarchand Mangaldas, give 14 May 2027. A proposal to shorten the timeline was floated in January 2026 (Business Standard); no change had been notified as of 12 October 2026 (S.S. Rana & Co.). See our guide to the DPDP Act and your visitor register.
Ask least at the gate: name, photo, the patient’s bed and a mobile number for most visitors, with ID verification only for contractors and where policy calls for it.
Wards, ICUs, NICUs and duty rooms: zoning a hospital
| Zone | Who gets in | Control |
|---|---|---|
| Public: OPD, pharmacy, canteen | Anyone | CCTV, patrols, help desk |
| Wards | Attendant pass holders; visitors in their slot | Corridor and nurse station check |
| Critical care: ICU, NICU, PICU, theatres | One named attendant at set times | Controlled door, staff escort |
| Maternity and paediatrics | The patient’s named attendants only | Controlled door, exit check for infants |
| Staff only: duty rooms, stores, records, server rooms | Staff | Card or biometric access |
| Service: mortuary, waste yard, plant rooms | Named contractors and staff | Permit, sponsor, induction |
The 2024 memorandum also asked for secure duty rooms for female staff and lighting at dark spots. NABH’s 6th edition, applied to new and renewal applications from 1 January 2025, added an objective element on non-fire emergencies (FMS.7.b) and interpretation in HRM.3.d emphasising training on emergency codes. An infant abduction code works only if someone can say who entered maternity in the last hour.
Put the hard checks where the risk is: critical care, maternity and duty rooms. A hospital that tries to stop everyone at the main gate ends up stopping nobody at the ICU door.
Fire drills and roll call when patients cannot walk
MoHFW’s National Guidelines on Fire and Life Safety in Healthcare Facilities, reported on 4 May 2026 (PTI), revise the 2020 guidelines; the title page says 2026, the foreword 2025. They call themselves advisory; state fire laws still bind. They rest on progressive horizontal evacuation: patients move first to an adjoining safe compartment, then down only if needed (sections 5.1.5 and 8.2). On visitors and attendants:
- Security: “Security manages crowd control and directs visitors to assembly points” (section 6.3).
- Attendants: a basic fire safety orientation at admission, and “Wherever feasible, patients’ attendants may be included in mock evacuation drills” (section 8.2).
- Assembly points: outdoors, at least 30 m from the building perimeter (section 5.4).
- Drills: “periodically” for each building, plus a joint drill at least once a year with the fire brigade, police and disaster management authority (section 6.3). Annexure 3, a suggestive annex for high-rise buildings taken from the National Building Code, adds drills every three months in a building’s first two years, then every six months, with records kept three years. Follow what your fire authority and NOC require.
Attendants often stay inside with their patients, so count by floor and compartment, not only at the assembly point. See our evacuation roll call guide and lobby emergency playbook.
Run at least one drill a year at night, with attendants included: staffing is thinnest and attendant numbers least known.
Recommended set-up: decisions for a hospital
- Scope: attendants, visitors, vendors, contractors and officials; patients stay in the hospital information system.
- Attendants: how many at the bedside by day and night, each pass named, rechecked daily and ended at discharge.
- Visitor types: the five passes above, each collecting only what it needs.
- Approvals: the ward desk, department head or sponsor; then a named backup, then the security supervisor, never the guard alone.
- ID verification: for contractors and where policy calls for it, not every relative.
- Passes: one person, one zone, an end time, a bed code instead of a diagnosis.
- Contractors: induction and agreements completed before arrival, an escort in critical care, and agency staff counted in every evacuation (see our contractor management guide).
- Watchlist: people with a documented history of violence or harassment on the premises, added by a named committee with reasons and reviewed on schedule; the guard sees a quiet flag (visitor watchlist guide).
- Roll call: a live count by block and floor, attendants included.
- Retention and staff list: one year for visit records, days for photos and mobile numbers, and a current staff list so leavers cannot approve.
Agree these at the hospital security committee, minute them, and review them after every incident and drill.
Common mistakes in hospitals
- A laminated attendant card handed to whoever is next.
- A visitor check at the casualty door that slows a stretcher.
- The diagnosis or department on the pass or in the logbook.
- Patients registered in the visitor system.
- Guards photographing relatives’ ID documents on their own phones (see our guard SOP).
- Children’s names and photos taken at the gate.
- Fire drills that count staff and patients but not attendants and contractors.
Name one owner each for passes, the gate, drills and data, and the list gets shorter.
Where Orb fits
Orb, our visitor management system, is built for the DPDP Act 2023 and Rules 2025.
Attendant cards change hands
The visitor’s phone becomes the pass, its code changes every minute so a screenshot is useless, and the guard scans it to see photo, name, host and approval.
Families from other states queue at the gate
They scan a QR poster, read the notice in their own language and consent item by item; the desk checks in anyone without a phone, and a self-service kiosk by Orb with use-and-throw visitor tags is an optional add-on.
Ward desks cannot phone the gate
The ward sister, as host, approves in one tap in WhatsApp, Microsoft Teams or Slack, and a backup is asked if she does not answer.
The night drill needs a headcount
A live register shows who is inside right now, and the roll call produces a drill report for fire audits.
Relatives’ photos pile up
Photos and mobile numbers are erased after seven days by default, with a signed record of each erasure.
Questions buyers ask
How many attendants are allowed per patient in Indian hospitals?
There is no single national number. MoHFW’s memorandum of 19 August 2024 asked central government hospitals, AIIMS and Institutes of National Importance to allow “only one or two attendants” with a patient at any point in time, each with an attendant pass. Other hospitals set their own limits.
Are there legal rules on hospital visiting hours in India?
We found no central law that fixes visiting hours; each hospital sets them. Admitted mental health patients may refuse or receive visitors (Mental Healthcare Act 2017, section 26), and no visitor rule may delay emergency treatment (Parmanand Katara, 1989; Clinical Establishments Act 2010, section 12(2), where it applies).
What is an attendant pass in a hospital?
A pass for a named relative or carer who stays with an inpatient, showing photo, ward, bed and an end date. It should not be transferable.
Does the DPDP Act apply to a hospital visitor register?
Yes, if the register is digital or a manual register is later digitised (section 3(a)). The hospital needs a notice, a lawful basis (usually consent), safeguards and erasure on schedule, mostly from 13 May 2027.
Can a hospital record details of children who visit patients?
Only with verifiable consent of a parent or lawful guardian (section 9(1) and Rule 10). In our reading the clinical establishment exemption covers health services to the child, not visiting, so record the number of children against the adult’s visit; confirm with counsel.
Does NABH require a visitor management system?
The published summary of the 6th edition names no product. Assessors look for a working process; ask your NABH coordinator how it will be assessed.
Sources
- Enhancing security in all Central Govt. Hospitals/AIIMS/INIs, office memorandum Z.28016/54/2024-PMSSY-I, Ministry of Health and Family Welfare, 19 August 2024 (copy hosted by Medical Dialogues)
- Health Ministry asks central government hospitals and institutes to enhance security, All India Radio News, 20 August 2024
- Night patrol, access control: Centre suggests measures to states on safety of medics, PTI in The Week, 28 August 2024
- Lok Sabha Unstarred Question No. 916: safety of healthcare workers, Ministry of Health and Family Welfare, 29 November 2024
- In re: alleged rape and murder incident of a trainee doctor in R.G. Kar Medical College and Hospital, 2024 SCC OnLine SC 2056, SCC Online, August 2024
- R.G. Kar Medical College case: Supreme Court forms National Task Force, S.S. Rana & Co., 21 August 2024
- Supreme Court transfers suo motu proceedings on RG Kar case to Calcutta High Court, LiveLaw, 17 December 2025
- Nahan hospital introduces visitor pass system for improved hygiene, security, The Tribune, 12 May 2025
- Pt. Parmanand Katara v. Union of India, (1989) 4 SCC 286, Supreme Court of India, 28 August 1989 (copy hosted by Global Health Rights)
- The Clinical Establishments (Registration and Regulation) Act, 2010-act,-2010.pdf), PRS Legislative Research (text of the Act)
- About the Clinical Establishments Act, Ministry of Health and Family Welfare, Clinical Establishments portal
- Mental Healthcare Act, 2017, section 26, AdvocateKhoj (text of the Act)
- The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013, India Code
- The Immigration and Foreigners Bill, 2025: bill summary, PRS Legislative Research
- Immigration and Foreigners Act 2025: an overview, iPleaders (in force 1 September 2025; section 10)
- Kohima district notice on reporting foreigners under the Immigration and Foreigners Act 2025, Directorate of Information and Public Relations, Nagaland, 6 May 2026
- Notification: implementation plan of 6th edition standards, NABH, 10 September 2024
- NABH Accreditation Standards for Hospitals, 6th edition (published extract and summary of changes), NABH, January 2025
- National Guidelines on Fire and Life Safety in Healthcare Facilities (2026), Ministry of Health and Family Welfare (copy hosted by Firesafeworld)
- Govt updates guidelines on handling fire in healthcare facilities, PTI in Nagaland Post, 4 May 2026
- Health Ministry revises fire safety norms for hospitals, Medical Dialogues, 5 May 2026
- Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, 11 August 2023
- Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, 13 November 2025
- DPDP Rules 2025, Rule 1: short title and commencement, dpdpa.com (text reproduction)
- DPDP Rules 2025, Rule 8: time period for specified purpose, dpdpa.com (text reproduction)
- DPDP Rules 2025, Rule 10: verifiable consent for processing personal data of a child, dpdpa.com (text reproduction)
- DPDP Rules 2025, Rule 12: exemptions for processing children’s data, dpdpa.com (text reproduction)
- DPDP Rules 2025, Fourth Schedule, DPDP Wiki (text reproduction)
- DPDP FAQs (law as on 7 December 2025), Cyril Amarchand Mangaldas
- Digital Personal Data Protection Rules, 2025: incremental tweaks and the way ahead, Lakshmikumaran & Sridharan, updated 16 July 2026
- MeitY may cut compliance timeline for key DPDP rules to 12 months, Business Standard, 22 January 2026
- DPDP (Removal of Difficulties) Order, 2026: what has been changed for children’s data and SDF audits, S.S. Rana & Co., 12 October 2026
- Languages included in the Eighth Schedule of the Indian Constitution, Department of Official Language, Ministry of Home Affairs
This guide reflects Indian law, the standards cited and published guidance as of 18 October 2026. It is general information, not legal advice: confirm your approach with counsel, your fire authority and your accreditation body.
