Short answer: HIPAA (1996, with the Privacy, Security and Breach Notification Rules) applies to covered entities, health plans, healthcare clearinghouses and providers that bill electronically, and to their business associates; it protects protected health information they hold and says which uses are permitted without the person's authorisation. GDPR (2016) applies to any controller or processor handling personal data of people in the EU, with health data as a special category; it requires a legal basis for every use and gives people enforceable rights. The practical difference for a product: a consumer health app in the US is usually outside HIPAA and regulated by the FTC and state laws instead; the same app in the EU is inside the GDPR from the first user. A product serving both must be built for the GDPR's breadth and HIPAA's prescriptive safeguards at once.
Side by side
Side by side, HIPAA regulates US covered entities and business associates handling protected health information, while the GDPR regulates any controller or processor of EU residents' data. HIPAA permits treatment, payment and operations uses without authorisation and gives 60 days for breach notification; the GDPR requires a legal basis for every purpose, grants erasure and portability, and gives 72 hours.
| HIPAA (US) | GDPR (EU) | |
|---|---|---|
| Who is regulated | Covered entities and business associates | Any controller or processor of EU residents' data, anywhere |
| What data | Protected health information (PHI): identifiable health data held by a covered entity | All personal data; health data is a special category (Article 9) |
| Consumer health apps | Outside HIPAA unless acting for a covered entity; FTC Act, FTC Health Breach Notification Rule, state laws apply | Inside GDPR; explicit consent is the usual basis |
| Legal basis for use | Permitted uses without authorisation: treatment, payment, operations, plus listed exceptions; authorisation otherwise | An Article 6 basis and an Article 9(2) exception for every purpose |
| Minimum necessary / minimisation | Minimum necessary standard | Data minimisation principle (Article 5) |
| Individual rights | Access (30 days), amendment, accounting of disclosures, restrictions | Access (1 month), rectification, erasure, portability, objection, restriction, withdrawal of consent |
| De-identification | Safe Harbor (18 identifiers) or expert determination | Anonymisation (no longer personal data) vs pseudonymisation (still personal data) |
| Security | Security Rule: administrative, physical, technical safeguards; risk analysis; addressable vs required specifications | Article 32: appropriate measures to the risk; no fixed list |
| Breach notification | Individuals and HHS within 60 days of discovery (media if 500+ in a state); annual log for smaller breaches | Authority within 72 hours; individuals without undue delay when high risk |
| Contracts | Business associate agreement (BAA) | Processor contract (Article 28) |
| Oversight roles | Privacy officer and security officer | Data protection officer where required (Article 37) |
| Impact assessment | Risk analysis under the Security Rule | DPIA under Article 35 |
| International transfer | No restriction in HIPAA itself | Chapter V: adequacy, SCCs, Data Privacy Framework |
| Enforcement | HHS Office for Civil Rights; state attorneys general | National data protection authorities; EDPB |
| Fines | Tiered civil penalties, inflation-adjusted, roughly up to $2 million per provision per year; criminal penalties | Up to €20 million or 4% of worldwide turnover |
The scope difference, in practice
In practice, HIPAA applies to a health app only when it acts for a covered entity, as a business associate under a BAA; a consumer app a patient chooses is outside HIPAA and regulated by the FTC and state laws. In the EU the same app is a GDPR controller from the first user.
A US hospital using a cloud FHIR platform: the hospital is a covered entity, the platform a business associate under a BAA, both under HIPAA. A consumer in the US uploading their own lab reports to an app: HIPAA does not apply to the app; the FTC does (deceptive practices, and the Health Breach Notification Rule, updated in 2024 to cover health apps explicitly), as do state laws such as Washington's My Health My Data Act (2023), which requires consent for collecting consumer health data and bans geofencing around health facilities, and the health provisions of the California CPRA, Nevada and Connecticut laws. A patient in the EU doing the same: the app is a controller under the GDPR with Article 9 obligations from day one. See GDPR Article 9 for health data.
The legal-basis difference
HIPAA and the GDPR start from opposite points on legal basis. HIPAA permits covered entities to use protected health information for treatment, payment and healthcare operations without authorisation, requiring written authorisation for other uses. The GDPR prohibits processing health data unless an Article 9(2) exception applies, so nothing is permitted by default and consent must be explicit, specific and revocable.
HIPAA starts from permitted uses: a covered entity may use and disclose PHI for treatment, payment and healthcare operations without asking, and for a list of public-interest purposes; everything else needs a written authorisation. GDPR starts from a prohibition (for health data) with exceptions; nothing is permitted "by default", and consent, where used, must be explicit, specific and revocable. A US product team's instinct that "operations" covers analytics does not transfer; in the EU, analytics on health data needs consent or anonymisation.
The rights difference
On individual rights, HIPAA and the GDPR both grant access and correction, but the GDPR adds erasure, portability in a machine-readable format, objection and the right to withdraw consent, which HIPAA lacks as such. A product built for the GDPR's rights, with export, delete and revoke in the product, satisfies HIPAA's access rights with margin.
The Cures Act's information-blocking rules and the right of access to electronic PHI through APIs move US patients towards portability.
Security and breaches
HIPAA's Security Rule is prescriptive, with a required risk analysis, named administrative, physical and technical safeguards, policies, training and audit controls; the GDPR's Article 32 is outcome-based, asking for measures appropriate to the risk, usually shown through ISO 27001. Breach deadlines differ sharply: 60 days to individuals and HHS under HIPAA, 72 hours to the authority under the GDPR.
HIPAA's Security Rule is prescriptive: a risk analysis, named safeguards, policies, training, audit controls, and a 2025 proposed update that would make encryption and multi-factor authentication mandatory rather than addressable. GDPR's Article 32 is outcome-based: appropriate to the risk, with encryption and pseudonymisation named as examples; ISO 27001 is the usual way to show it. Breach timelines differ sharply: 60 days to individuals and HHS under HIPAA, 72 hours to the authority under the GDPR. A joint incident runbook uses the shorter clock. See ISO 27001 vs ISO 27799.
De-identification
HIPAA's Safe Harbor removes 18 listed identifiers and the data is no longer PHI; expert determination certifies a very small re-identification risk. The GDPR has no list: data is anonymous only if no one can reasonably re-identify it, and pseudonymised data remains personal data. Safe Harbor output often does not meet the GDPR's bar, especially with dates and rare conditions. See De-identification of health data.
Building for both
A product serving both the US and the EU is best designed to the GDPR first (consent per purpose, rights in the product, DPIA, 72-hour breach runbook, EU hosting option) with HIPAA's prescriptive artefacts layered on top: a risk analysis document, a BAA template, Security Rule policies, a 60-day breach procedure and workforce training records.
Design to the GDPR (consent per purpose, rights in the product, DPIA, 72-hour runbook, EU hosting option) and layer HIPAA's prescriptive artefacts on top (risk analysis document, BAA template, Security Rule policy set, 60-day breach procedure, workforce training records). Keep US and EU data in separable regions, because GDPR transfers and some US state laws both care about location. Anpheros is built this way: GDPR-first as a European company, with the platform able to operate as a business associate under a BAA for US customers. The developer site documents GDPR for developers and security.
This page explains regulation for product and engineering teams. It is not legal advice; the texts linked under Sources are the authority, and your data protection officer, notified body or counsel decides for your case. Last reviewed: October 2026.
Related pages
- GDPR Article 9 for health data
- De-identification of health data
- ISO 27001 vs ISO 27799
- TEFCA and QHINs explained
- Health data regulation map
- GDPR for developers (developer site)
Sources
- HHS: HIPAA for professionals (Privacy, Security, Breach Notification Rules)
- HHS: Breach Notification Rule
- FTC Health Breach Notification Rule (16 CFR Part 318)
- Washington State: My Health My Data Act (HB 1155)
- Regulation (EU) 2016/679 (GDPR), EUR-Lex
- European Commission: EU-US Data Privacy Framework
Frequently asked questions
Is a HIPAA-compliant app automatically GDPR-compliant?
No. HIPAA compliance says nothing about legal basis, consent quality, erasure, portability, DPIAs, DPOs or transfers. It covers a subset of the GDPR's security expectations and a different breach regime.
Does HIPAA apply to my app if a doctor recommends it?
Not by itself. HIPAA applies if the app acts on behalf of a covered entity under a business associate agreement (for example, integrated into the clinic's workflow at the clinic's request). An app the patient chooses and controls is outside HIPAA, and under FTC and state rules.
Which breach deadline do I follow for a joint EU–US incident?
Both: 72 hours to the EU authority for EU residents' data, 60 days to individuals and HHS for PHI, plus any state deadlines (often 30 to 60 days) and the FTC rule's 60 days for consumer health apps. Runbooks are written to the shortest.
Can EU health data be processed in the US?
Yes, with a Chapter V transfer tool: the EU-US Data Privacy Framework for certified companies, or standard contractual clauses with a transfer impact assessment. Many European customers nevertheless require EU hosting as a contractual condition.
Try it free in the sandbox
Your first FHIR call in 5 minutes. An HL7 FHIR R4 API with the patient's consent built in: try it in the sandbox, then connect your own app or clinic system.
Free · 30 synthetic patients · no card
Anpheros builds a medical record that the patient controls and can share with any clinic, on an HL7 FHIR R4 platform, based in the EU. These guides help you understand and organise your health; they do not replace your doctor.
About Anpheros →
AnpherosThe more you log, the clearer your record
Your health history in one place, under your control.
Free · Works in your browser · No card
