Health data regulation
The laws that govern health data and health software: GDPR Article 9, the European Health Data Space, MDR and IVDR for medical device software, the EU AI Act, and in the US HIPAA, TEFCA and USCDI.
Health data in the EU falls under several laws at once. The GDPR treats it as special-category data (Article 9). The European Health Data Space Regulation, Regulation (EU) 2025/327, governs patients' access to their records and the reuse of health data, and applies in stages. NIS2 covers cybersecurity, the MDR and IVDR apply when software is a medical device, and the AI Act regulates AI systems. In the United States the main reference points are HIPAA, TEFCA and the USCDI data set.
| Personal data | GDPR, Regulation (EU) 2016/679, Article 9 for health data |
|---|---|
| Access and reuse | European Health Data Space, Regulation (EU) 2025/327 |
| Software as a medical device | MDR (EU) 2017/745 and IVDR (EU) 2017/746 |
| Artificial intelligence | AI Act, Regulation (EU) 2024/1689 |
| United States | HIPAA, TEFCA, USCDI |
How do the EU laws fit together?
What do GDPR and the EHDS mean for health data?
- GDPR Article 9 for health data: legal bases explainedHealth data is a special category under the GDPR: processing is prohibited unless an Article 9(2) exception applies, on top of an Article 6 basis.
- Medical data rights in the EU: GDPR and EHDS explainedWhat European law says about your health data: what “special category” means under the GDPR, what the European Health Data Space (EHDS) brings from 2025, when each right applies and how to use them concretely with hospitals, laboratories and apps.
- HIPAA vs GDPR for health data: key differencesHIPAA governs covered entities and business associates in the US; the GDPR governs anyone processing EU residents' data.
When is health software a medical device?
- Is My Health App a Medical Device? EU MDR Rule 11 ExplainedUnder the EU Medical Device Regulation, software is a medical device when its intended purpose is medical, such as diagnosis or treatment decisions.
- MDR vs IVDR: which applies to your health softwareThe MDR covers medical devices; the IVDR covers in vitro diagnostics, including software that interprets data from specimens.
- SaMD: MDR classes I–III and IEC 62304 classes A–COnce software has a medical purpose, two classifications decide the work to market it in the EU: the MDR risk class (I, IIa, IIb, III) from Rule 11 sets the conformity route; the IEC 62304 safety class (A, B, C) sets engineering rigour.
How is AI in healthcare regulated?
What are the US interoperability rules?
For developers
Build on interoperable health data
Anpheros Platform is a FHIR R4 API for medical records, with patient consent, a free sandbox and SDKs for Dart, Flutter and TypeScript.