HIPAA vs GDPR: how the US and EU health data rules compare, and how to meet both

HIPAA vs GDPR: the short answer

HIPAA protects health information inside the US healthcare system. Its Privacy, Security and Breach Notification Rules bind health plans, clearinghouses and providers that transact electronically, and every business associate handling their protected health information (PHI). The GDPR protects any personal data about people in the EU and EEA, in every sector, and treats health data as a special category that may be processed only under an additional condition.

HIPAA is narrow and deep: one kind of information, one industry, detailed safeguards. The GDPR is broad and principle-based, with accountability for proving the principles are met. A company can fall under either law, or both; the useful question is which of your services touch which data, for whom.

How HIPAA sits beside SOC 2, HITRUST and ISO/IEC 27001 is covered in HIPAA vs SOC 2, HITRUST and ISO/IEC 27001; the GDPR's relationship with ISO/IEC 27701 has its own guide, GDPR vs ISO/IEC 27701, ISO/IEC 27001 and SOC 2.

Who each law covers

HIPAA applies by role. A covered entity is a health plan, a healthcare clearinghouse, or a provider that sends health information electronically in a transaction for which HHS has adopted a standard. A business associate performs work involving PHI for a covered entity, and a subcontractor doing the same for a business associate is one too. The test is the function performed, not the country of the office, which is why billing firms in India and contact centres in the Philippines sign business associate agreements with US clients.

The GDPR applies by establishment and by targeting. Article 3 covers processing in the context of an establishment in the Union, wherever the processing happens, and organisations outside the Union that offer goods or services to people there or monitor their behaviour. Its roles are the controller, which decides the purposes and means of processing, and the processor, which acts on the controller's behalf. A non-EU organisation caught by Article 3(2) generally appoints a representative in the Union, subject to the Article 27 exemptions.

A covered entity usually behaves as a controller and a business associate as a processor, but the mapping is not automatic: a processor that starts deciding purposes and means becomes a controller under Article 28(10). Record your role under each law for every service.

What counts as health data

HIPAA's subject is PHI: individually identifiable health information held or transmitted by a covered entity or business associate, in any form, with the Security Rule focused on electronic PHI. Information stops being PHI once de-identified, and HHS describes a method based on removing eighteen identifiers, from names and most dates to IP addresses and full-face photographs.

The GDPR's subject is any information relating to an identifiable person. Data concerning health is defined in Article 4(15), and Article 9(1) prohibits processing health data unless an Article 9(2) condition, such as explicit consent, applies. Recital 26 places anonymous information outside the Regulation, while pseudonymisation appears in Articles 25 and 32 as a safeguard for data still in scope.

Health information held by an organisation outside HIPAA's roles may still sit inside the GDPR. And a data set that meets HIPAA's de-identification method is not automatically anonymous under the GDPR, so treat it as personal data until a documented assessment says otherwise.

HIPAA and the GDPR side by side

Where the two laws pull apart

Breach clocks

The GDPR expects the supervisory authority to hear within 72 hours of the controller becoming aware of a notifiable breach; HIPAA sets an outer limit of 60 days from discovery for notifying individuals. HIPAA also presumes a breach unless a four-factor risk assessment shows a low probability of compromise. A combined incident procedure runs both tests and works to the shorter deadline.

Rights and legal basis

HIPAA lets patients see, correct and learn about disclosures of their records; the GDPR adds erasure, portability and objection. Under HIPAA much routine use is already permitted for treatment, payment and operations, while under the GDPR every activity needs its own lawful basis and health data an Article 9(2) condition, and consent must be as easy to withdraw as to give.

Transfers

The GDPR restricts transfers outside the EU and EEA to countries with an adequacy decision or to recipients covered by safeguards such as the Commission's standard contractual clauses. HIPAA controls onward flows through business associate agreements and subcontractor flow-down. A Philippine BPO serving a German clinic and a US health plan needs transfer safeguards for one client and a business associate agreement for the other.

Penalties

HIPAA's civil money penalties sit in four tiers reflecting increasing culpability, adjusted for inflation each year, and HHS lists criminal penalties that can include up to ten years' imprisonment. Under Article 83 of the GDPR, fines reach up to €10 million or 2% of total worldwide annual turnover of the preceding financial year for breaches of controller and processor duties, and up to €20 million or 4% for breaches of the principles, legal bases, rights and transfer rules, whichever is higher.

Which law applies to you

For personal health record vendors outside HIPAA, HHS points to the Federal Trade Commission's Health Breach Notification Rule. Where your position is unclear, confirm it with your legal advisers, because the answer decides which contracts, notices and deadlines you build.

Running one programme for both

Both laws ask you to know where the data is, assess the risk, apply proportionate safeguards, bind providers by contract, handle incidents, train people and keep evidence.

• One data map of PHI flows and GDPR processing activities, tagged by client, law and role.
• One risk method producing the Security Rule risk analysis and feeding DPIAs; see The Security Rule risk analysis: how to conduct one.
• One control set for access, encryption, logging, backup and restoration.
• Two contract templates on one clause library; see Business associate agreements: what to sign and what to issue.
• One incident procedure with both breach tests and the 72-hour clock as the default.

HIPAA vs GDPR: questions buyers ask