HIPAA vs. GDPR compliance: what’s the difference?
- Iasonas Michailidis
- 7 days ago
- 5 min read
While HIPAA and GDPR both oversee how personal information is used, they maintain entirely different scopes.
HIPAA is focused on healthcare organizations and how personal health information is used in the US. GDPR, on the other hand, is a broader legislation that supervises any organization handling personally identifiable information of an EU or UK citizen.
We compare the two frameworks in more detail below, including the similarities and differences that set HIPAA and GDPR apart.
What is HIPAA?
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a US law that limits the use of protected health information (PHI) by healthcare organizations, which it refers to as covered entities.
A covered entity can be any of the following:
Health plans: Includes health insurance companies, company health plans, etc.
Healthcare clearinghouses: Any entity that processes nonstandard health information received from another entity into a standard format
Healthcare providers: Includes doctors, dentists, clinics, pharmacies, etc.
HIPAA defines PHI as any information that qualifies as a personal identifier. For example, billing information, insurance accounts, medical histories, mental health conditions, or laboratory results.
While HIPAA doesn’t have a certifying body or official certification, it’s enforced by the US Department of Health and Human Services’ Office for Civil Rights (OCR).
Cases of non-compliance or violations can result in fines and penalties, as well as a damaged reputation.
Who needs to be HIPAA compliant
Any covered entity or business associate of a covered entity is legally required to be HIPAA compliant. The process involves performing routine technical and nontechnical evaluations to ensure compliance against HIPAA’s three main rules:
Privacy rule
Security rule
Breach notification rule
What is GDPR?
The General Data Protection Regulation, or GDPR, became law on May 25, 2018, and exists as one of the most stringent data privacy and security laws around the world.
It applies to all organizations targeting or collecting personally identifiable information (PII) of people in the UK or the EU, regardless of whether they physically operate within those jurisdictions. The data is referred to as personally identifiable information (PII) and includes anything that can be used to clearly identify a person.
Under the GDPR, organizations are required to safeguard and provide documentation of the protocols used to protect PII. The documented steps should cover the following:
Consent: Whenever an individual’s data is used for a new purpose, organizations are required to send them a new request for consent. The GDPR prohibits the use of confusing terms and conditions when it comes to consent, and requires the process to withdraw consent to be just as easy as it is to give consent.
Breach notifications: Organizations have 72 hours to notify all data subjects of a security breach, either by email, phone, or through a public announcement.
Right to access: Organizations must be transparent with UK and EU citizens about how their PII is used.
Right to be forgotten: Unless there is a legal reason for retaining the information, organizations must delete PII immediately upon an individual request and cease further distribution of that data.
Privacy by design: Organizations are only allowed to process information essential to the completion of their business.
Data protection officers: Organizations must appoint a data protection officer (DPO) to oversee the implementation of the GDPR. This individual protects personal data from misuse, unauthorized access, and other security breaches.
Regardless of size, an organization must appoint a DPO if:
It is a public authority or body
Its core activities consist of data processing operations that require regular and systematic monitoring of data subjects on a large scale
Its core activities consist of large-scale processing of special categories of data and/or personal data relating to criminal convictions and offenses
Who needs to be GDPR compliant
If you handle PII of individuals in the UK and EU, you are legally required to comply with the GDPR. Failure to do so could result in hefty fines up to €20 million or 4% of your worldwide annual revenue.
Timelines for GDPR implementation vary between processors, controllers, and company structure, but typically take anywhere from six to 36 weeks.
Once implemented, an internal GDPR assessment must be completed periodically for organizations to demonstrate their continued compliance. An organization can also apply for an optional certification.
Differences between HIPAA vs. GDPR compliance
The most apparent difference between HIPAA vs. GDPR is the jurisdiction and industry in which each law applies. Here are three other differences between HIPAA and GDPR:
Consent: HIPAA permits some degree of PHI disclosure without patient consent. For example, healthcare providers can send PHI to another provider for treatment purposes. In some circumstances, a healthcare provider can disclose PHI to other providers or business associates without patient consent. Under GDPR, however, consent must always be given, even for patient care.
Right to be forgotten: Under HIPAA, medical records and other personal information can’t be altered or deleted. In other words, although subject to privacy, the information is stored forever. GDPR gives data subjects the right to be forgotten, where individuals have the right to tell an organization to erase their data.
Data breaches: Under the HIPAA breach notification rule, covered entities and business associates must notify affected individuals of breaches. If the incident involves over 500 individuals, the organization must notify the OCR and all affected individuals within 60 days.
With the GDPR, breach size does not matter. Article 33 of the GDPR places a 72-hour breach reporting deadline and requires providers to report all breaches to supervisory authorities.
Similarities between HIPAA and GDPR compliance
Organizations that are either HIPAA- or GDPR-compliant already have existing safeguards in place to protect data. While there are more differences than similarities between HIPAA and. GDPR, there is some framework overlap:
Both require controlled access to sensitive data
Both require methods for detecting unauthorized changes to PHI
Both require PHI encryption at rest and in transit
Both require an appointed DPO
Both provide organizations the security needed to focus on their clients, patients. and employees’ privacy
HIPAA vs. GDPR
Aspect | HIPAA | GDPR |
Regulated Data | Specific to healthcare data (PHI) | Applies to all personal data (PII). Broader scope than HIPAA. |
Application of Regulation | Covers entities handling PHI, irrespective of location | Applies to processing personal data of EEA residents, irrespective of organization’s location. |
Privacy Rights |
|
|
Consent | Obtain consent for certain purposes (e.g., marketing) with exceptions | Must obtain explicit consent with clear information on data usage. |
Breach Notification | Varies by breach size. Notify individuals and OCR, either immediately or annually | Report to supervisory authority within 72 hours. Inform service providers. |
Penalties | Fines vary based on fault, ranging from $100 to $50,000 per violation, maxing out at $1.5 million annually for repeated violations | Hefty fines up to 20 million euros or 4% of global annual income, whichever is higher. |
Privacy/Data Protection Officer | Mandatory HIPAA Privacy Officer for covered entities | Data Protection Officer (DPO) required for certain organizations under GDPR |
Assessments | Annual risk assessment required for all PHI processing | DPIA required only for high-risk processing to individuals |
HIPAA and GDPR compliance are two legal requirements that benefit both the organization and the individuals they serve. While each one involves distinct rules and regulations, they do have some overlap in their aim and process to protect data subjects.
Comentarios