HIPAA vs. GDPR compliance: what’s the difference? (2024)

While HIPAA and GDPR both oversee how personal information is used, they maintain entirely different scopes.

What is HIPAA?

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a US law that limits the use of protected health information (PHI) by healthcare organizations, which it refers to as covered entities.

A covered entity can be any of the following:

Health plans: Includes health insurance companies, company health plans, etc.
Healthcare clearinghouses: Any entity that processes nonstandard health information received from another entity into a standard format
Healthcare providers: Includes doctors, dentists, clinics, pharmacies, etc.

HIPAA defines PHI as any information that qualifies as a personal identifier. For example, billing information, insurance accounts, medical histories, mental health conditions, or laboratory results.

While HIPAA doesn’t have a certifying body or official certification, it’s enforced by the US Department of Health and Human Services’ Office for Civil Rights (OCR).

Cases of non-compliance or violations can result in fines and penalties, as well as a damaged reputation.

Who needs to be HIPAA compliant

Any covered entity or business associate of a covered entity is legally required to be HIPAA compliant. The process involves performing routine technical and nontechnical evaluations to ensure compliance against HIPAA’s three main rules:

Privacy rule
Security rule
Breach notification rule

What is GDPR?

The General Data Protection Regulation, or GDPR, became law on May 25, 2018, and exists as one of the most stringent data privacy and security laws around the world.

It applies to all organizations targeting or collecting personally identifiable information (PII) of people in the UK or the EU, regardless of whether they physically operate within those jurisdictions. The data is referred to as personally identifiable information (PII) and includes anything that can be used to clearly identify a person.

Under the GDPR, organizations are required to safeguard and provide documentation of the protocols used to protect PII. The documented steps should cover the following:

Consent: Whenever an individual’s data is used for a new purpose, organizations are required to send them a new request for consent. The GDPR prohibits the use of confusing terms and conditions when it comes to consent, and requires the process to withdraw consent to be just as easy as it is to give consent.
Breach notifications: Organizations have 72 hours to notify all data subjects of a security breach, either by email, phone, or through a public announcement.
Right to access: Organizations must be transparent with UK and EU citizens about how their PII is used.
Right to be forgotten: Unless there is a legal reason for retaining the information, organizations must delete PII immediately upon an individual request and cease further distribution of that data.
Privacy by design: Organizations are only allowed to process information essential to the completion of their business.
Data protection officers: Organizations must appoint a data protection officer (DPO) to oversee the implementation of the GDPR. This individual protects personal data from misuse, unauthorized access, and other security breaches.

Regardless of size, an organization must appoint a DPO if:

It is a public authority or body
Its core activities consist of data processing operations that require regular and systematic monitoring of data subjects on a large scale
Its core activities consist of large-scale processing of special categories of data and/or personal data relating to criminal convictions and offenses

Who needs to be GDPR compliant

If you handle PII of individuals in the UK and EU, you are legally required to comply with the GDPR. Failure to do so could result in hefty fines up to €20 million or 4% of your worldwide annual revenue.

Timelines for GDPR implementation vary between processors, controllers, and company structure, but typically take anywhere from six to 36 weeks.

Once implemented, an internal GDPR assessment must be completed periodically for organizations to demonstrate their continued compliance. An organization can also apply for an optional certification.

Differences between HIPAA vs. GDPR compliance

The most apparent difference between HIPAA vs. GDPR is the jurisdiction and industry in which each law applies. Here are three other differences between HIPAA and GDPR:

Consent: HIPAA permits some degree of PHI disclosure without patient consent. For example, healthcare providers can send PHI to another provider for treatment purposes. In some circ*mstances, a healthcare provider can disclose PHI to other providers or business associates without patient consent. Under GDPR, however, consent must always be given, even for patient care.
Right to be forgotten: Under HIPAA, medical records and other personal information can’t be altered or deleted. In other words, although subject to privacy, the information is stored forever. GDPR gives data subjects the right to be forgotten, where individuals have the right to tell an organization to erase their data.
Data breaches: Under the HIPAA breach notification rule, covered entities and business associates must notify affected individuals of breaches. If the incident involves over 500 individuals, the organization must notify the OCR and all affected individuals within 60 days.

With the GDPR, breach size does not matter. Article 33 of the GDPR places a 72-hour breach reporting deadline and requires providers to report all breaches to supervisory authorities.

Similarities between HIPAA and GDPR compliance

Organizations that are either HIPAA- or GDPR-compliant already have existing safeguards in place to protect data. While there are more differences than similarities between HIPAA and. GDPR, there is some framework overlap:

Both require controlled access to sensitive data
Both require methods for detecting unauthorized changes to PHI
Both require PHI encryption at rest and in transit
Both require an appointed DPO
Both provide organizations the security needed to focus on their clients, patients. and employees’ privacy

HIPAA and GDPR compliance are two legal requirements that benefit both the organization and the individuals they serve. While each one involves distinct rules and regulations, they do have some overlap in their aim and process to protect data subjects.

Learn more about gaining compliance by downloading our eBook about the ISO 27001 journey. You can also request a demo for OneTrust’s Certification Automation tool.