HIPAA vs GDPR
The leading US and EU health data regulations, and why Vietnamese HealthTech expanding abroad often needs both.
Protects US PHI
Health Insurance Portability and Accountability Act, requires protecting US patients' Protected Health Information. Applies to Covered Entities and Business Associates.
View HIPAA Hub →Protects EU data
General Data Protection Regulation, comprehensive EU personal data protection. Health data is 'special category data' with enhanced protection requirements.
View GDPR Hub →Detailed comparison
| Aspect | HIPAA | GDPR |
|---|---|---|
| Origin | US (1996, updated 2013) | EU (2018) |
| Data scope | Protected Health Information (PHI), 18 identifiers + health information | All personal data of EU persons; health data is Special Category |
| Who it applies to | Covered Entities + Business Associates (processing PHI) | Any organization processing EU persons' data, regardless of location |
| Consent | Not always required, multiple lawful bases available | One of 6 lawful bases; health data requires explicit consent |
| Business Associate Agreement | Mandatory with all Business Associates accessing PHI | Equivalent: Data Processing Agreement (DPA) |
| Breach notification | 60 days to HHS (if >500 people) + individual notification | 72 hours to DPA; no minimum threshold |
| Data Subject Rights | Right to access, amend their own PHI | 8 full rights: access, erasure, portability, objection... |
| DPO | No equivalent requirement | Mandatory in some cases (large-scale health data processing) |
| Penalties | Tiered based on level of negligence | Up to 4% global annual revenue or €20M (whichever higher) |
| Best for | HealthTech targeting US market, US healthcare service providers | Any company processing EU user data, regardless of industry |
Doing both: Where do they overlap?
Targeting both the US and EU means both apply, but technical controls overlap heavily:
Encryption at rest and in transit, access control, audit logs, MFA, satisfies both HIPAA Technical Safeguards and GDPR Article 32.
BAA (HIPAA) and DPA (GDPR): two contracts with the same vendor, many similar terms.
Process for detecting, assessing, and handling breaches, build once, apply to both.
Security and privacy training can be combined into one program.
GDPR requires explicit consent for health data; HIPAA is more flexible. A GDPR-grade consent flow covers both.
GDPR: 72 hours. HIPAA: 60 days. A 72h process satisfies both.
Beyond HIPAA and GDPR, HealthTech operating in Vietnam must also comply with Vietnam's Personal Data Protection Law (Law 91/2025) when processing health data of Vietnamese users, this is classified as sensitive data under Law 91/2025 and Decree 356/2025, and requires impact assessment dossiers filed with the Ministry of Public Security within 60 days. If you're expanding to US and EU markets while still serving Vietnamese users, all three regulations apply.
FAQ
Does Vietnamese HealthTech need HIPAA or GDPR?
It depends on your market: HIPAA if you process US patient data (including via API or US healthcare integrations), GDPR if you have EU patients. Targeting both markets means you need both.
If already GDPR-compliant, what else does HIPAA require?
HIPAA also requires: (1) Business Associate Agreements with vendors that access PHI, (2) technical safeguards under the HIPAA Security Rule, (3) the Minimum Necessary rule, (4) workforce training, and (5) a designated Privacy and Security Officer.
Do personal health apps need to comply with HIPAA?
Not always. HIPAA only applies to Covered Entities (hospitals, health insurers, healthcare providers) and their Business Associates. Consumer wellness apps are typically not Covered Entities unless they integrate with formal healthcare systems.
Turn compliance knowledge into work that gets done
Get step-by-step AI guidance, automated evidence collection, and live control status in one workspace.
In the call, we map your framework, system scope, and how pTrackly fits your current workflow.
Does not replace an independent auditor or certification body.