Guarding the data: HIPAA, GDPR, and Part 11 for health data

Two rules matter most:

• The Privacy Rule limits how PHI is used and disclosed.
• The Security Rule requires safeguards for electronic PHI: access controls, encryption, audit logs.

When Maria's site (a hospital) shares her data with the trial sponsor, HIPAA usually requires either her authorization or a formal de-identification step. This is why "PT-1042" exists: the sponsor typically receives a coded dataset (a "limited data set" or de-identified data) rather than "Maria Alvarez, DOB, address."

Enforcement. The HHS Office for Civil Rights (OCR) enforces HIPAA. Penalties are tiered by culpability, from roughly $100 per violation to $50,000 per violation, with annual caps that OCR adjusts for inflation. Real settlements run into the millions: Anthem paid $16 million in 2018 after a breach exposing data on nearly 79 million people, still the largest HIPAA settlement on record (as of early 2026).

Key nuance: HIPAA does not cover most consumer health apps or wearables when the maker isn't a covered entity. A fitness tracker's step data usually sits outside HIPAA entirely. That gap surprises people.

GDPR: the European regime with teeth

Now suppose Maria's trial also runs sites in Germany. The GDPR (General Data Protection Regulation, in force since 2018) applies to personal data of people in the EU, regardless of where the company is based.

Health data is a special category under GDPR, meaning it gets extra protection. Processing it generally requires an explicit legal basis. For clinical trials, sponsors typically rely on consent plus obligations under EU clinical trial law, and they must document a lawful basis for every use.

GDPR concepts to know:

• Data controller: decides why and how data is processed (usually the sponsor).
• Data processor: acts on the controller's instructions (a lab, a CROCROConversion Rate Optimization (CRO) is the systematic practice of increasing the percentage of users who complete a desired action, using data, testing, and user research.View full definition →, a cloud vendor).
• Data subject rights: access, correction, erasure ("right to be forgotten"), and portability. Note: erasure is limited in trials, because deleting safety data would break scientific integrity.
• Pseudonymization: exactly what "PT-1042" achieves. It reduces risk but the data is still personal (someone holds the key), so GDPR still applies.

Cross-border transfers are the classic trap. Sending EU trial data to a U.S. server is restricted. Since 2023 the EU-U.S. Data Privacy Framework provides one legal route; Standard Contractual Clauses (SCCs) are the more common fallback. Skip this and you're exposed.

Enforcement. Fines reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 20 million euros or 4 percent of global annual revenue, whichever is higher. Meta was fined 1.2 billion euros in 2023 over unlawful data transfers, the largest GDPR fine to date (as of early 2026). For a mid-size biotech, even a fraction of that is existential.

The official text is worth bookmarking: the full GDPR is free at gdpr-info.eu.

21 CFR Part 11: can you trust the record?

Here's where biotech diverges from ordinary privacy law. Once Maria's data feeds an FDA submission, 21 CFR Part 11 applies. This FDA rule (effective 1997) sets requirements for electronic records and electronic signatures to be considered as trustworthy as paper and ink.

Part 11 is not about privacy. It's about integrity. The guiding principle regulators use is ALCOA+: data must be Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available.

What Part 11 requires in practice:

• Audit trails: every create, edit, or delete is logged with who, what, when, and why. You cannot silently overwrite Maria's baseline reading.
• Access controls: unique user IDs, no shared logins.
• Electronic signatures: legally binding, linked to the record, non-transferable.
• System validation: the software must be tested and documented to work as intended.

A simple audit-trail entry looks like this:

That "reason" field is not optional. An FDA inspector who finds edits without documented reasons will issue a Form 483 (a list of observations) or a Warning Letter. Repeated data integrity failures can lead to rejected submissions or import bans. You can read the FDA's data integrity guidance for free here.

🎬 [VIDEO: "21 CFR Part 11 Explained" - youtube.com - a concise walkthrough of electronic records and signature requirements for FDA-regulated systems]

Where the three collide

Back to Maria's single reading. Watch the overlaps:

• The nurse edits the value. Part 11 demands the audit trail entry above.
• The sponsor pulls the coded dataset. HIPAA required de-identification or authorization first.
• The German site's copy moves to a U.S. cloud. GDPR required SCCs and a lawful basis.

One data point, three compliance checkpoints. Miss any one and different regulators come knocking with different penalties. A HIPAA breach draws OCR. A transfer misstep draws an EU data protection authority. A missing audit trail draws the FDA. They do not coordinate their fines.

The compliance constraints in practice

For a biotech or medtech professional, these rules shape daily operations:

Vendor selection. Any cloud or software vendor touching trial data must sign a Business Associate Agreement (HIPAA) and a Data Processing Agreement (GDPR), and their systems must be Part 11 capable. "We use a normal spreadsheet" is not a defensible answer to an inspector.

Design choices. Pseudonymization at the point of collection reduces both HIPAA and GDPR exposure. Building audit trails and access controls into your electronic data capture (EDC) system from day one is cheaper than retrofitting.

Consent complexity. Maria may need to consent separately to trial participation, to data transfer to the U.S., and to future research use. Sloppy consent forms are a common finding.

Retention paradox. GDPR pushes toward deleting data you no longer need. FDA and trial regulations require keeping records for years (often long after a trial ends). Reconciling these tensions is a genuine legal exercise, not a checkbox.

Note that MedTech adds a layer: connected devices (a smart insulin pump, a cardiac monitor) generate continuous health data. If that device supports an FDA submission or is a regulated medical device, its software falls under both device regulation and, where applicable, Part 11 style integrity expectations.

Key Takeaways

• Different questions, not duplicates. HIPAA and GDPR govern privacy (who sees data, why); Part 11 governs integrity (can you trust the record). You must satisfy all that apply.
• Coding is your friend. Pseudonymization ("PT-1042") reduces HIPAA and GDPR risk but does not remove the data from GDPR's scope, because someone still holds the key.
• Cross-border transfer is the classic GDPR trap. Moving EU trial data to U.S. servers needs a legal mechanism (Data Privacy Framework or SCCs). The largest fines to date came from transfer and consent failures.
• No audit trail, no trust. Part 11 requires logging every edit with who, what, when, and why. Undocumented changes trigger FDA 483s and Warning Letters.
• Fines are enforced separately. OCR, EU data protection authorities, and the FDA act independently, so one dataset can generate three distinct enforcement risks.