Data, patients and borders: privacy law and global regulatory fragmentation

The three regimes every pharma professional must know

HIPAA (US)

The Health Insurance Portability and Accountability Act (1996), enforced by the HHS Office for Civil Rights (OCR), governs "protected health information" (PHI) held by "covered entities" (hospitals, insurers, clinics) and their "business associates."

Key practical point: HIPAA often does not directly cover pharma companies themselves. A drugmaker sponsoring a trial is usually not a covered entity. But the moment it contracts with a hospital or receives identifiable patient data from a health system, HIPAA's Business Associate Agreement (BAA) requirements kick in, dictating how that data must be secured, who can access it, and breach notification timelines (60 days to notify affected individuals, per HHS breach notification rules).

GDPR (EU)

The General Data Protection Regulation (2016, enforced since 2018) is broader and stricter. It applies to any "personal data" of EU residents, regardless of where the company processing it is based. Enforced by national Data Protection Authorities (DPAs), coordinated by the European Data Protection Board (EDPB).

For pharma, three GDPR mechanics matter most:

1. Legal basis for processing. Consent is one option, but for clinical trials, "legitimate interest" or "public health" bases are often used instead, because consent must be freely given and withdrawable at any time, which is incompatible with trial data integrity requirements.

2. Cross-border data transfer restrictions. Moving EU patient data to the US requires a valid transfer mechanism, Standard Contractual Clauses (SCCs) being the most common after the EU-US Privacy Shield was struck down by the Court of Justice of the EU in the 2020 *Schrems II* ruling. The 2023 EU-US Data Privacy Framework restored a formal adequacy route, but companies still layer SCCs as backup.

3. Fines with teeth. Up to 4% of global annual revenue or €20 million, whichever is higher. This is not symbolic: several pharma and health-tech companies have faced multi-million euro GDPR fines for improper health data handling (see the EDPB's public enforcement register).

Data localization rules (country-specific)

A growing number of countries require certain health or genetic data to be stored, or at least processed, on servers within national borders:

• China's Personal Information Protection Law (PIPL, 2021) and related cybersecurity rules require security assessments before health and genetic data leave the country. China's human genetic resource rules separately restrict export of biological samples and associated data.
• Russia's data localization law requires personal data of Russian citizens to be initially stored on Russian servers.
• India has debated (and partly implemented) localization requirements for sensitive personal data under its Digital Personal Data Protection Act (2023).

The practical effect: a global trial cannot use one central data warehousedata warehouseA central repository that consolidates data from many source systems into a structured, query-optimized store designed for analytics, reporting, and business intelligence.View full definition →. Companies build regional data architectures, sometimes storing raw data locally and only transferring de-identified, aggregated results internationally.

What this means operationally: redesigning trials and PSPs

Clinical trial design

• Consent forms must be localized, not just translated. GDPR's granular consent and right-to-withdraw language differs from HIPAA's authorization forms, which differ again from China's PIPL consent requirements.
• Data flow mapping becomes a pre-trial deliverable: sponsors must document where each data point (lab result, imaging file, wearable stream) is collected, stored, and transferred, before a single patient is enrolled.
• De-identification and pseudonymization are used differently: HIPAA has a specific "Safe Harbor" method (removing 18 identifiers) or an "Expert Determination" method; GDPR treats pseudonymized data as still personal data if re-identification is possible, a stricter standard.

Patient support programs

PSPs are especially exposed because they run continuously, not for a fixed trial period, and often involve vendors (call centers, app developers) handling identifiable health data at scale.

Practical adjustments companies make:

• Regional PSP vendors instead of one global platform, to keep data within required borders.
• Separate consent flows for PSP enrollment versus trial participation, since the legal basis and data retention rules differ.
• Shorter data retention windows in GDPR markets (deletion once the support purpose ends) versus longer retention common in the US.

A simplified data flowdata flowAn automated sequence of steps that moves data from source to destination: ingestion, transformation, validation, and loading, so it arrives clean and ready to use.View full definition → decision snippet

Pharma privacy teams often codify these checks into a data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → rule set. A simplified version:

This is not literal software most companies run, but it mirrors the logic embedded in real data governancedata governanceData governance is the set of policies, roles, and processes that ensure data is accurate, secure, well-defined, and used responsibly across an organization.View full definition → platforms used by pharma legal and IT teams.

The fragmentation problem, and why it is getting worse

There is no global health data standard. The World Health Organization (WHO) has no binding data protection authority. Efforts like the OECD's cross-border privacy frameworks remain voluntary. Meanwhile, more countries are passing their own laws: Brazil's LGPD, South Korea's PIPA, Saudi Arabia's PDPL.

For a pharma company running trials in 15 countries, this means 15 overlapping compliance regimes, not one harmonized standard. Legal and regulatory affairs teams increasingly work alongside data privacy officers embedded directly in clinical operations, not just in a central compliance department.

Key Takeaways

• HIPAA (US) and GDPR (EU) are not interchangeable: HIPAA mainly targets covered entities and business associates; GDPR applies extraterritorially to anyone processing EU residents' data, with far larger maximum fines (4% of global revenue).
• Cross-border data transfer mechanisms (SCCs, the EU-US Data Privacy Framework) are legally required infrastructure for any multinational trial, not optional paperwork.
• Data localization laws (China's PIPL, Russia, and others) force regional data architecture: raw data often cannot leave the country of collection, only de-identified aggregates can.
• Consent forms, retention periods, and vendor selection for both clinical trials and patient support programs must be localized market by market, not standardized globally.
• There is no single global health privacy standard; fragmentation is increasing as more countries pass their own laws, making dedicated privacy governance a core, not peripheral, function in pharma operations.