GDPR HIPAA Compliance: Running Both Programs Without Duplicating Work
GDPR HIPAA compliance is the operational reality for HealthTech SaaS companies with EU and US customers. Most teams make the mistake of treating these as two separate compliance programs — two sets of policies, two audit tracks, two vendor agreements, double the overhead. The smarter pattern is one security and privacy foundation with two compliance lenses applied to it.
This brief is the operational guide for companies that have already determined they need both. For a side-by-side comparison of the two frameworks, see HIPAA vs GDPR.
The Unified Program Architecture
The core insight is that GDPR and HIPAA share approximately 60–70% of their underlying control requirements. Both want you to:
- Know what data you have and where it goes
- Limit access to people who need it
- Encrypt data in transit and at rest
- Detect and respond to breaches quickly
- Vet your vendors and govern their access
- Train your workforce on data handling
Build that foundation once. The remaining 30–40% is framework-specific work layered on top.
Shared Foundation: Build Once, Apply to Both
Data Inventory
Both frameworks require knowing what data you process, where it lives, and how it moves.
- HIPAA requires tracking PHI flows to ensure minimum necessary use and support breach investigations
- GDPR requires a Record of Processing Activities (RoPA) documenting purposes, categories, recipients, retention periods, and transfer mechanisms
These are different documents but draw from the same underlying inventory. Build the data map first. Generate the RoPA and the PHI flow documentation from it. Updating one automatically updates the other.
Access Controls
- HIPAA: minimum necessary access, unique user IDs, automatic logoff, encryption, audit logs
- GDPR Article 32: access control is explicitly listed as an appropriate technical measure
Implementation: role-based access control with quarterly access reviews, MFA for all PHI and personal data, audit logging. One policy, one control set, satisfies both.
Encryption
- HIPAA: addressable implementation specification — required unless you document why it is not reasonable and appropriate (in practice, always implement it)
- GDPR Article 32: encryption is explicitly listed as an appropriate technical measure, especially for special category health data
Implementation: TLS 1.2+ in transit, AES-256 at rest. One standard covers both.
Incident Response
- HIPAA: breach investigation within 60 days, notification to HHS and individuals within 60 days, media notification for 500+ affected in a state
- GDPR: notification to supervisory authority within 72 hours, notification to data subjects without undue delay if high risk
Design your IR procedure around GDPR's 72-hour window. HIPAA's 60-day window is automatically satisfied. One procedure, one training, one communication template.
Vendor Agreements
- HIPAA: Business Associate Agreement required for every BA handling PHI
- GDPR Article 28: Data Processing Agreement required for every processor handling EU personal data
Build a combined template that includes all required HIPAA BAA elements and all required GDPR Article 28 elements. Legal review required — standard DPA templates do not automatically satisfy BAA requirements, and vice versa. For EU processors handling PHI, the combined agreement eliminates the need for two separate contracts per vendor.
Security Risk Assessment
- HIPAA: requires a risk analysis to identify threats and vulnerabilities to PHI
- GDPR Article 32: requires assessing risks to the rights and freedoms of individuals
Different framing, same underlying work. One risk assessment methodology that addresses both HIPAA's operational risk lens and GDPR's individual rights lens covers both requirements.
Workforce Training
- HIPAA: security and privacy awareness training required for the workforce
- GDPR: Article 32 and Article 29 require that persons acting under the controller process data only on instruction and are trained accordingly
One annual training program covering PHI handling (HIPAA) and personal data handling (GDPR) satisfies both. Document completion records for both frameworks.
GDPR-Specific Layer: No HIPAA Equivalent
Lawful Basis Register
Before processing EU personal data, document a lawful basis under Article 6. For health data (special category under Article 9), document a second basis. HIPAA has no equivalent — it defines permitted disclosures, not a prior authorization to process.
For a HealthTech SaaS, the typical bases are:
- Article 6: contract performance (patient treatment) or legitimate interests (B2B analytics)
- Article 9: health care provision and treatment (Article 9(2)(h)) for patient-facing processing; explicit consent for research or secondary uses
Build a processing register that maps each activity to its Article 6 and Article 9 bases. This is net-new work with no HIPAA shortcut.
Data Subject Rights Beyond Access and Amendment
HIPAA grants patients the right of access and amendment. GDPR grants EU residents additional rights:
- Erasure (right to be forgotten) — may conflict with HIPAA retention requirements; document the retention obligation to rely on Article 17(3)(b) exemption
- Portability — structured, machine-readable export on request; HIPAA's access right does not require a specific format
- Restriction of processing — pause processing while a dispute is in progress; no HIPAA equivalent
- Objection — object to processing based on legitimate interests; no HIPAA equivalent
Build GDPR-specific workflows for each right. The HIPAA access and amendment process is a starting point, not a complete solution.
International Data Transfer Mechanisms
GDPR restricts transfers of EU personal data to third countries without an adequate safeguard. PHI processed by a US entity — servers in the US, team in the US — requires a transfer mechanism for EU health data.
Options:
- EU-US Data Privacy Framework — if the US entity is certified (fastest for US-based processors)
- Standard Contractual Clauses (SCCs) — attach to the DPA; required for sub-processors in non-adequate countries
- Adequacy decision — UK has a time-limited adequacy decision; other countries vary
HIPAA has no equivalent restriction. This is pure GDPR overhead.
Data Protection Officer
Assess whether GDPR requires you to appoint a DPO. Triggers: processing special category data at large scale (health data almost always qualifies at scale), or systematic monitoring of individuals at large scale.
HIPAA requires a Privacy Officer and Security Officer. Those roles do not satisfy the DPO requirement, which has specific independence and expertise requirements under Article 37. The HIPAA officers can inform the DPO appointment — or the same person can hold all three roles if qualified.
HIPAA-Specific Layer: No GDPR Equivalent
Business Associate Agreements for US-only Vendors
Vendors that are not subject to GDPR (US-only vendors processing only US patient data) still require HIPAA BAAs. The combined DPA/BAA template does not apply — use a standalone BAA for these relationships.
HIPAA Privacy Rule: TPO Permitted Uses
HIPAA's treatment, payment, and operations (TPO) framework allows disclosure of PHI for defined purposes without patient authorization. GDPR does not have a direct equivalent — each processing purpose needs its own lawful basis, even if it falls within what HIPAA would consider a permitted disclosure.
Map every HIPAA TPO use case to a GDPR Article 6 and Article 9 basis explicitly. Do not assume a HIPAA permitted disclosure is automatically a GDPR-compliant processing activity.
HHS Breach Notification to OCR
HIPAA requires notifying HHS Office for Civil Rights of breaches — all breaches in the annual summary, large breaches (500+) within 60 days. GDPR's equivalent is notifying the national supervisory authority within 72 hours. These are separate notifications to separate regulators. One incident may require both.
Practical Implementation Checklist
Shared (build once):
- Data inventory and PHI/personal data tagging
- Combined DPA/BAA vendor agreement template
- Access control policy + quarterly review process
- Encryption standards (TLS 1.2+, AES-256)
- Incident response procedure (72-hour GDPR clock)
- Security risk assessment
- Annual workforce training program
GDPR-specific (additional layer):
- Record of Processing Activities (RoPA)
- Lawful basis register (Article 6 + Article 9 for each activity)
- Data subject rights workflows (erasure, portability, restriction, objection)
- International transfer mechanisms (SCCs or DPF certification)
- DPO assessment and appointment if triggered
- Cookie consent management (GDPR opt-in standard)
HIPAA-specific (additional layer):
- PHI flow documentation
- Standalone BAAs for US-only vendors
- HIPAA Privacy Rule policies (TPO, minimum necessary, authorization)
- HHS breach notification process
- Notice of Privacy Practices
For HIPAA-specific detail, see the HIPAA compliance checklist for HealthTech and the HIPAA service page. For GDPR-specific implementation, see GDPR for SaaS and the GDPR service page. For the HIPAA vs GDPR comparison, see HIPAA vs GDPR.
Frequently Asked Questions
Can a Data Processing Agreement serve as a HIPAA Business Associate Agreement? They serve parallel functions but are different documents. A single combined agreement can satisfy both if it includes all required HIPAA BAA elements alongside GDPR Article 28 requirements. Legal review is required — a standard DPA template will not automatically satisfy BAA requirements.
Does HIPAA compliance satisfy GDPR Article 32 security requirements? Partially. HIPAA's Security Rule overlaps substantially with Article 32, but the gaps are real: GDPR requires a risk assessment framed around data subject rights (not just operational risk) and explicitly lists pseudonymization as a measure. A HIPAA security program is a strong foundation, not a complete substitute.
What is the biggest operational difference between GDPR and HIPAA compliance? GDPR's lawful basis requirement. Before processing EU personal data, you must document a lawful basis under Article 6, and for health data, a second basis under Article 9. HIPAA has no equivalent prior-authorization requirement — it defines permitted uses and disclosures. This is net-new work with no HIPAA shortcut.
Do I need a Data Protection Officer if I am already HIPAA compliant? HIPAA does not substitute for GDPR's DPO requirement. Whether you need a DPO is determined independently under GDPR: processing special category data (which health data is) at large scale is a trigger. HIPAA Privacy and Security Officers do not satisfy the DPO requirement, though the same person can hold all three roles if qualified.
Ready to Build a Unified GDPR + HIPAA Program?
ShieldKey designs combined GDPR and HIPAA compliance programs for HealthTech SaaS companies. We start with your data inventory, build the shared control layer, and handle the framework-specific additions — one engagement, two frameworks.