Regulatory and Standards Environment
Domain 4 tests the legal and standards landscape and, more importantly, how the pieces interact when more than one applies to the same data.
United States
- HIPAA - Privacy, Security, Breach Notification, and Enforcement Rules, applied to covered entities and, via HITECH, business associates.
- HITECH Act - direct business-associate obligations, breach notification, tiered penalties reaching roughly $1.5 million per provision per year.
- 42 CFR Part 2 - substance use disorder records from federally assisted programs; consent-based and historically stricter than HIPAA, with 2024 alignment provisions.
- FDA - medical devices and software as a medical device.
- CMS - Conditions of Participation and interoperability programs.
- FTC Health Breach Notification Rule - non-HIPAA consumer health apps and devices.
- State law - breach notice, minor consent, HIV, genetic, and mental health protections; often stricter and not preempted.
Frameworks, not law
NIST SP 800-66 maps HIPAA Security Rule implementation; NIST CSF, ISO 27001, ISO 27799, and HITRUST CSF are assurance frameworks. PCI DSS applies wherever card data is handled.
International
GDPR treats health data as a special category (Article 9) requiring an explicit condition; the UK, Canada (PIPEDA), and other regimes impose their own transfer and consent rules.
Worked example
A US wellness app begins marketing to German users and integrates with a hospital EHR. Reasoning: HIPAA applies only if it is a covered entity or business associate - the EHR integration likely makes it a business associate under a BAA; GDPR applies because it offers services to EU data subjects, demanding a lawful Article 9 condition, a data processing agreement, and transfer safeguards. Both can apply at once.
Traps
- Assuming HIPAA is the only applicable law.
- Equating 42 CFR Part 2 with HIPAA.
- Calling NIST or ISO "regulations."
- Assuming a vendor is a business associate only when it stores data.