HIPAA for European healthtech: your GDPR work already covers half of it

The gate at the edge of the US market

European digital health is in strong shape. London anchors AI diagnostics and genomics, Berlin leads prescription digital therapeutics, Stockholm exports remote care models, Dublin sits next to the European headquarters of US pharma, and Zurich and Basel hold the precision-medicine corridor.

Then comes US expansion, and a procurement gate that has nothing to do with product quality: a US hospital, insurer or pharmacy cannot hand protected health information to a vendor who will not sign a Business Associate Agreement and evidence HIPAA compliance. Not "prefers not to" — cannot, without accepting regulatory exposure themselves.

It applies equally to European vendors. HIPAA follows the data and the relationship, not the office address.

What HIPAA asks for, in plain terms

HIPAA is not one document. The parts that matter for a technology vendor are the Privacy Rule, the Security Rule, the Breach Notification Rule and the Omnibus Rule that made business associates directly liable.

• Administrative safeguards: a documented risk analysis, a risk management plan, workforce training, sanctions, and a named security official.
• Physical safeguards: facility access, workstation use and device and media disposal controls — including for a distributed European team.
• Technical safeguards: access control, unique user identification, audit controls, integrity controls, and transmission security. Encryption is "addressable", which means you either implement it or document a defensible reason not to. In practice, implement it.
• Organisational requirements: Business Associate Agreements with your customers, and equivalent downstream agreements with every subcontractor that touches PHI.
• The minimum necessary standard: access and disclosure limited to what the task actually requires — an access-model requirement, not a policy sentence.

GDPR to HIPAA: what carries over, and what does not

The pattern is consistent: your technical posture mostly transfers, your documentation mostly transfers, and the genuinely new work is contractual (BAAs), definitional (PHI and de-identification) and procedural (HHS breach mechanics).

The four things that actually block European vendors

• No BAA capability. Until you can sign one and mean it, no US covered entity can onboard you. Downstream subcontractor agreements are part of the same obligation.
• PHI data flows that were never mapped as PHI. Your GDPR record of processing describes personal data; a US reviewer wants to see where the eighteen HIPAA identifiers live, who reaches them and for how long they are retained.
• De-identification done by intuition. "We stripped the names" is not Safe Harbor. Either meet all eighteen identifier requirements or hold an expert determination on file.
• A breach process that only knows about the 72-hour DPA clock. You need a documented HHS path, individual notification, the 500-record media threshold, and state-level requirements layered on top.

Things European teams commonly get wrong

• Assuming CE marking or DiGA listing counts. They answer medical-device and reimbursement regulators, not HIPAA.
• Assuming a US entity is required. It is not — HIPAA follows PHI wherever it is processed. A US point of contact for regulatory correspondence is practical, not statutory.
• Assuming EU data residency solves it. Hosting location does not change your obligations; it does change the transfer analysis you owe under GDPR in the other direction.
• Treating HIPAA as a certification. There is no HIPAA certificate. What buyers accept is a current risk analysis, documented safeguards, training records, a signed BAA and, increasingly, a SOC 2 report mapped to HIPAA safeguards.
• Letting engineering support access production PHI ad hoc. This is the most common finding in vendor security reviews and the easiest to fix before anyone asks.

A three-to-four week bridge

The compressible part is the documentation and mapping work — which is precisely the work that traditionally consumes three to six months of consultancy time at €40K-€100K. The parts that stay on your calendar are engineering remediation, if your access model needs real change, and your customers' own review cycles.

Running GDPR and HIPAA together

For European healthtech this is the steady state, not a transition. You will hold both indefinitely: GDPR for your European patients and clinicians, HIPAA for your US covered entities.

Run one control environment with two evidence views. Encryption, access control, logging, vendor management and incident response are shared; the framework-specific layers — lawful basis, DSARs and transfer mechanisms on one side, BAAs, minimum necessary and HHS notification on the other — sit above them. Maintaining two parallel programs is how small compliance teams burn out and how evidence starts to contradict itself.

Frequently asked

The short version

European healthtech does not start HIPAA from zero. GDPR has already forced you to know your data, control access, encrypt sensibly and respond to incidents. What is missing is a contract you can sign, a definition of PHI you can defend, a de-identification method that meets the standard, and a breach path that ends at HHS rather than a DPA.

Put agents on the mapping, the drafting and the evidence, and the bridge from GDPR to HIPAA becomes a few weeks of focused work instead of two quarters of consultancy — with your team spending its attention on the clinical product rather than the paperwork around it.