Health Information Privacy and Data Protection Law
Privacy law questions test whether you can classify data, choose a lawful basis, and meet notification clocks. eHealth adds special-category health data, research secondary use, and cross-border vendors.
HIPAA basics
PHI is individually identifiable health information held by a covered entity or business associate. The Privacy Rule permits treatment, payment, and operations without authorization; other uses need patient authorization or an exception. Apply the minimum necessary standard. The Security Rule protects ePHI electronically. The Breach Notification Rule requires individual notice without unreasonable delay and no later than 60 days after discovery, plus HHS notice and media notice for breaches affecting 500 or more individuals in a state.
GDPR and other regimes
Health data is special category under Article 9; processing needs an Article 9(2) condition plus an Article 6 basis. A data protection officer may be required. Breach notification to the supervisory authority is generally within 72 hours of awareness. Data subject rights include access, rectification, erasure, and portability. Cross-border transfers need an adequacy decision or standard contractual clauses plus a transfer impact assessment. HIPAA de-identification can use Safe Harbor, removing 18 identifiers, or expert determination. Pseudonymised data remains personal data under GDPR.
Worked example
A registry wants to share records with a university. If Safe Harbor removes all 18 identifiers and there is no actual knowledge of re-identification, the data is not PHI. If dates of service remain, use expert determination or obtain authorization or an IRB waiver. For EU subjects, a GDPR Article 9(2)(j) research basis and safeguards are also needed. The reasoning: de-identification status controls HIPAA scope; GDPR status is assessed separately.
Traps
Assuming de-identified data can never be re-identified. Confusing a privacy notice with consent. Missing the 60-day and 72-hour clocks. Ignoring stricter state breach laws. Treating pseudonymisation as anonymisation.