Healthcare organizations should treat HIPAA and GDPR as overlapping but separate compliance systems. HIPAA focuses on protected health information handled by U.S. healthcare entities and their service providers. GDPR applies to personal data of people in the EU or EEA, including health data, even when the organization sits outside Europe. If your patient data crosses borders, assume both laws may apply and design controls for the stricter requirement.
TLDR: HIPAA is narrower and healthcare-specific, while GDPR is broader and gives individuals stronger control over their data. For example, a U.S. telehealth company with 50,000 patients, including 8% based in Germany and France, may need HIPAA safeguards and GDPR rights workflows at the same time. GDPR breach notice can be due within 72 hours, while HIPAA may allow up to 60 days for affected individual notices in many cases. The safest approach is to map data, limit access, document every decision, and prepare breach response before anything goes wrong.
Where HIPAA and GDPR Apply
HIPAA, the Health Insurance Portability and Accountability Act, applies mainly in the United States. It covers covered entities, such as health plans, healthcare clearinghouses, and healthcare providers that conduct certain electronic transactions. It also applies to business associates, such as billing vendors, cloud hosting companies, analytics providers, and claims processors that handle protected health information on behalf of covered entities.
GDPR, the General Data Protection Regulation, applies across the EU and EEA. It can also reach organizations outside Europe if they offer goods or services to people in the EU or monitor their behavior. Health data is treated as a special category of personal data. That means it gets stronger protection than ordinary personal data.
The catch is that many healthcare teams assume “HIPAA-compliant” means “privacy-compliant everywhere.” It does not. A HIPAA control may be strong, but GDPR may still require a lawful basis, a data protection impact assessment, or a response to a patient access request within a set time.
Key Difference: PHI vs Personal Data
HIPAA protects protected health information, or PHI. PHI is health information that identifies a person or can reasonably identify them. It includes medical records, lab results, insurance details, appointment histories, diagnosis codes, and billing data. HIPAA also covers 18 identifiers, such as names, addresses, dates, phone numbers, email addresses, and medical record numbers.
GDPR protects personal data. This is broader. It includes any information relating to an identified or identifiable person. In healthcare, that includes clinical data, genetic data, biometric data, device identifiers, IP addresses, location data, and even coded data if reidentification is possible.
This broader scope matters. A wellness app may not be a HIPAA covered entity, but it may still process health data under GDPR. A hospital website using tracking scripts may also collect personal data, even before the patient logs into a portal.
Legal Basis and Consent
HIPAA permits many uses of PHI without patient authorization. These include treatment, payment, and healthcare operations. For example, a hospital may share PHI with a laboratory for testing or with an insurer for reimbursement. HIPAA still requires safeguards, minimum necessary access, and proper agreements with vendors.
GDPR works differently. An organization must identify a lawful basis for processing personal data. For health data, it must also meet a special category condition. Consent is one option, but it must be freely given, specific, informed, and easy to withdraw. In healthcare, consent can be tricky because patients may feel they have no real choice.
Honestly, it feels like consent screens are often treated as a shortcut. They are not. A five-second checkbox does not fix poor data governance, vague purposes, or excessive collection.
Patient Rights Under Each Law
Both laws give people rights, but GDPR goes further in several areas.
- Access: HIPAA gives patients the right to access their medical records. GDPR gives access to personal data and related processing details.
- Correction: HIPAA allows patients to request amendments. GDPR gives a right to rectification of inaccurate data.
- Deletion: GDPR includes a right to erasure in certain cases. HIPAA usually does not require deletion of medical records when retention laws apply.
- Restriction: GDPR allows people to request limits on processing. HIPAA has narrower restriction rights.
- Portability: GDPR has a data portability right for certain processing. HIPAA also supports patient access and electronic delivery, but the structure is different.
For healthcare providers, this means workflow design matters. Staff must know which rule applies, what deadlines exist, and when a request can be denied. Poor intake forms and scattered ticket queues can turn a simple request into a compliance failure.
Security Requirements
HIPAA’s Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Common controls include access management, audit logs, encryption, workstation security, disaster recovery, and staff training. HIPAA is flexible in some areas, but flexibility does not mean optional.
GDPR requires appropriate technical and organizational measures. These may include encryption, pseudonymization, confidentiality controls, resilience, testing, and access limits. GDPR also expects privacy by design and privacy by default. That means systems should collect only what is needed and expose only what is necessary.
Breach Notification Rules
Breach response is one of the clearest differences between HIPAA and GDPR.
- HIPAA: Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. The U.S. Department of Health and Human Services may also need notice. Media notice is required for breaches affecting more than 500 residents of a state or jurisdiction.
- GDPR: Controllers must notify the relevant supervisory authority within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to risk people’s rights and freedoms. Affected individuals must be notified when risk is high.
Expect to waste time on breach classification if no one documented data flows in advance. Teams often spend the first 24 hours just figuring out which systems were touched, which records were exposed, and which jurisdiction applies. That delay can be costly.
Vendor and Processor Management
HIPAA requires business associate agreements with vendors that create, receive, maintain, or transmit PHI for covered entities. These agreements define permitted uses, safeguards, reporting duties, subcontractor rules, and return or destruction of PHI.
GDPR requires data processing agreements between controllers and processors. These contracts must include processing instructions, confidentiality duties, security measures, subcontractor terms, assistance with rights requests, breach reporting, deletion or return of data, and audit support.
A healthcare organization using cloud storage, email tools, AI transcription, billing platforms, or call center software should review each vendor carefully. The issue is not only whether the vendor says it is compliant. The real question is what data it receives, where it stores data, who can access it, and how fast it reports incidents.
Penalties and Enforcement Risk
HIPAA enforcement is handled by the Office for Civil Rights within the U.S. Department of Health and Human Services. Penalties can vary based on culpability, correction efforts, and harm. Serious cases can lead to large settlements, corrective action plans, and years of monitoring.
GDPR penalties can be severe. Fines may reach up to €20 million or 4% of annual worldwide turnover, whichever is higher. Supervisory authorities can also order processing restrictions, which may hurt operations more than the fine itself.
Reputation damage is also real. Patients may forgive a technical failure. They are less forgiving when an organization cannot explain what happened, why data was collected, or why access was wider than needed.
Practical Compliance Steps
A strong healthcare data compliance program should not treat HIPAA and GDPR as separate paperwork projects. Build one control framework, then map each control to each law.
- Map data flows: Identify what data you collect, where it goes, who receives it, and how long it stays there.
- Classify data: Separate PHI, health data, payment data, research data, and marketing data.
- Limit access: Use role-based access and review permissions often.
- Use written agreements: Put BAAs and data processing agreements in place before sharing data.
- Prepare breach playbooks: Include HIPAA and GDPR deadlines, contacts, decision points, and evidence logs.
- Train staff: Focus on real tasks, such as sending records, verifying identity, and reporting lost devices.
- Audit regularly: Test controls, review logs, check vendors, and fix gaps quickly.
Which Standard Should Healthcare Teams Follow?
If only HIPAA applies, meet HIPAA fully and document decisions. If GDPR applies, add GDPR governance, lawful basis records, rights handling, transfer assessments, and privacy notices. If both apply, design for the stricter rule where possible.
The best approach is simple to state and hard to execute: collect less data, protect it better, share it carefully, and prove every step. Healthcare data is deeply personal. Compliance should reflect that seriousness, not just satisfy an audit checklist.