Navigating HIPAA, GDPR and the EU AI Act for health data

HIPAA lets covered entities use PHI for treatment, payment, and operations without separate authorization, but research generally needs a signed HIPAA authorization plus IRB (Institutional Review Board) approval.

GDPR needs a lawful basis under Article 6, plus an Article 9 condition for special category data. For research, sponsors often rely on "explicit consent" or on "scientific research" provisions, but not on the vague "legitimate interest" basis that works for marketing.

Concrete check: Anna's German consent form must be granular. One combined checkbox for "genomic sequencing, wearable monitoring, AI model training, and future secondary research" is a classic GDPR failure. DPAs expect separable, specific choices.

Genetic data is special everywhere

Under GDPR, genetic data is explicitly special category. In the US, the picture is fragmented: HIPAA covers genomic data held by covered entities, GINA (Genetic Information Nondiscrimination Act) restricts its use in employment and health insurance, and state laws (for example Illinois's genetic privacy statute) add layers. There is no single US federal genomic privacy law.

Step 2: The transatlantic transfer

Anna's data moves from Munich to Boston. Under GDPR, exporting personal data outside the EU requires a transfer mechanism.

The main options in 2026:

• EU-US Data Privacy Framework (DPF): the US company can self-certify with the Department of Commerce. If certified, transfers to that firm are treated as adequate.
• Standard Contractual Clauses (SCCs): EU-approved contract templates, plus a Transfer Impact Assessment documenting US surveillance risk.

Note: the DPF faces ongoing legal challenge, echoing the fate of its predecessors Safe Harbor and Privacy Shield (both struck down by the EU Court of Justice). Prudent sponsors keep SCCs as a fallback so a single court ruling does not halt the trial.

You can read the European Commission's overview of transfer tools here: Commission adequacy and transfer mechanisms.

Data mapping: the audit that catches problems

Before any transfer, run a data flowdata flowAn automated sequence of steps that moves data from source to destination: ingestion, transformation, validation, and loading, so it arrives clean and ready to use.View full definition → mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition →. A simple record for Anna's data:

Every row that lacks a lawful basis, a transfer mechanism, or a retention limit is a finding you fix before go-live, not after a breach.

Step 3: Pseudonymization is not anonymization

Teams love to say "the data is anonymized, so GDPR does not apply." Usually false.

Pseudonymized data replaces names with a code but keeps a key that can re-link. It is still personal data under GDPR. Anonymized data cannot be re-linked by any reasonably likely means, and only then falls outside GDPR.

Genomic data is famously hard to truly anonymize. Studies have shown individuals can be re-identified from genotype data cross-referenced with public genealogy databases. Treat genomic data as personal data by default.

Under HIPAA, the parallel concept is "de-identification," achievable via the Safe Harbor method (remove 18 specified identifiers) or Expert Determination. HIPAA de-identification and GDPR anonymization are not the same standard, so clearing one does not clear the other.

Step 4: The AI inference

Now the model predicts Anna is at high risk of atrial fibrillation. Two regimes fire at once.

Under GDPR Article 22, decisions based *solely* on automated processing that produce legal or similarly significant effects trigger extra rights, including the right to human review. A model that flags Anna for a clinician to review is safer than one that auto-triages her without any human in the loop.

Under the EU AI Act, an AI system used as a medical device, or as a safety component of one, is typically high-risk. High-risk obligations include:

• A risk management system and data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → (training data must be relevant, representative, and checked for bias).
• Technical documentation and logging.
• Human oversight.
• Accuracy, robustness, and cybersecurity requirements.

Crucially, AI Act obligations sit *on top of* the existing EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR). Your arrhythmia model is not choosing between MDR and the AI Act. It must satisfy both.

Bias check as a governance control

Anna's cohort skews European. If the model underperforms on populations it was not trained on, that is both a scientific validity problem and an AI Act data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → failure. A basic subgroup performance check:

Document the result. "We tested and found a gap, and here is our mitigation" is a defensible audit posture. Silence is not.

Step 5: When something goes wrong

A laptop with the trial's re-linking key is stolen.

GDPR: notify the relevant DPA without undue delay and, where feasible, within 72 hours of becoming aware, if the breach risks people's rights. Notify affected individuals if the risk is high.

HIPAA: the Breach Notification Rule requires notifying affected individuals and HHS. Breaches affecting 500 or more people must be reported to HHS within 60 days and disclosed publicly on the OCR breach portal, sometimes called the "wall of shame."

Different clocks, different regulators, one incident. Your incident response plan must run both tracks in parallel from hour one.

Penalties, as a rough sense of scale

These are the statutory maximums, not typical outcomes, and actual fines vary widely:

• GDPR: up to 20 million euros or 4 percent of global annual turnover, whichever is higher.
• EU AI Act: up to 35 million euros or 7 percent of global turnover for the most serious violations (prohibited AI practices).
• HIPAA: tiered civil penalties per violation with annual caps that are adjusted for inflation; check the current OCR figures rather than relying on older numbers.

Worked example: a biotech with 500 million euros global turnover faces a theoretical GDPR ceiling of 20 million euros (4 percent of 500 million is 20 million, and the fixed cap is also 20 million, so they tie). Under the AI Act's top tier, 7 percent of 500 million is 35 million euros, matching the fixed cap. The percentage basis is what makes these laws bite for larger firms.

Governance checklist you can run this quarter

1. Data flow map for every element, with regime, lawful basis, transfer mechanism, and retention.

2. Consent audit: are choices granular and separable? Is withdrawal actually honored downstream?

3. Re-identification risk review for genomic and wearable data.

4. AI classification memo: is each model high-risk under the AI Act, and a device under MDR or IVDR?

5. Dual breach playbook: 72-hour GDPR track and HIPAA track, tested with a tabletop drill.

Key Takeaways

• The same patient record can be governed by HIPAA, GDPR, and the EU AI Act simultaneously. MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → each rule to the entity, the person's location, and the AI use case.
• Genomic and wearable data are hard to truly anonymize. Treat them as personal data, and remember HIPAA de-identification does not equal GDPR anonymization.
• Cross-border transfers need a live mechanism (DPF self-certification or SCCs plus a Transfer Impact Assessment). Keep a fallback because adequacy decisions have been struck down before.
• Medical AI is usually high-risk under the AI Act and must also satisfy MDR or IVDR. Human oversight and documented bias testing are core controls, not nice-to-haves.
• Build one incident plan that runs the GDPR 72-hour clock and the HIPAA notification track in parallel.

*This lesson is educational and not legal, medical, or investment advice. Verify current thresholds and enforcement figures with primary regulatory sources before acting.*