Cross-border health data trust: GDPR and HIPAA combined compliance requirements

Health data does not respect borders. A clinical trial enrolling patients in Berlin, Boston, and Barcelona generates records that must comply with at least two major privacy frameworks before any AI model, research consortium, or payer touches them. GDPR (General Data Protection Regulation) governs EU residents. HIPAA (Health Insurance Portability and Accountability Act) governs US covered entities and their business associates. When data crosses the Atlantic, both apply.

Most organizations treat dual compliance as a checklist exercise. They hire separate legal teams for each jurisdiction, bolt on contractual clauses, and hope for the best. This approach fails because GDPR and HIPAA do not define health data the same way, do not grant individuals the same rights, and do not enforce violations with the same mechanisms. The result is a compliance gap that grows wider every time a record moves.

What does it mean to be HIPAA compliant and GDPR compliant?

HIPAA compliance means a covered entity or business associate has implemented administrative, physical, and technical safeguards to protect Protected Health Information (PHI). It requires a designated privacy officer, risk assessments, breach notification within 60 days, workforce training, and Business Associate Agreements (BAAs) with any vendor handling PHI.

GDPR compliance means an organization processing EU personal data has established a lawful basis for processing, implemented data protection by design, appointed a Data Protection Officer (DPO) where required, and can demonstrate accountability through documentation. Breach notification must occur within 72 hours.

Being compliant with both means satisfying the stricter standard at every decision point. GDPR's 72-hour breach notification window supersedes HIPAA's 60-day window. HIPAA's specific technical safeguard requirements for encryption and access controls often exceed GDPR's principle-based approach. An organization operating across both frameworks must apply the higher bar consistently, not selectively.

The critical difference most compliance teams miss: GDPR applies to any health data about an EU resident, regardless of where the processing organization sits. HIPAA only applies to covered entities (health plans, providers, clearinghouses) and their business associates. A US-based health AI company that is not a covered entity can process American health data without HIPAA obligations, but the moment it touches a single EU resident's record, GDPR applies in full.

What are the 7 GDPR requirements?

GDPR is built on seven core principles codified in Article 5. Every cross-border health data transfer must satisfy all seven:

Lawfulness, fairness, and transparency. Processing must have a legal basis (consent, contract, legitimate interest, vital interest, public task, or legal obligation). For health data, explicit consent under Article 9 is almost always required.

Purpose limitation. Data collected for one purpose cannot be repurposed without a new legal basis. A clinical trial dataset collected under informed consent for oncology research cannot be redirected to train a commercial AI model without separate authorization.

Data minimization. Organizations must collect only the data strictly necessary for the stated purpose. Collecting entire EHR histories when only lab values are needed violates this principle.

Accuracy. Personal data must be kept accurate and up to date. Inaccurate data must be corrected or erased without delay.

Storage limitation. Data cannot be retained longer than necessary for its stated purpose. Open-ended retention policies violate GDPR.

Integrity and confidentiality. Appropriate technical and organizational measures must protect data against unauthorized access, loss, or destruction.

Accountability. The data controller must demonstrate compliance, not just claim it. This requires documentation, impact assessments, and audit trails.

HIPAA has no equivalent principle-based framework. It prescribes specific rules through the Privacy Rule, Security Rule, and Breach Notification Rule. Where GDPR says "demonstrate accountability," HIPAA says "conduct a risk assessment every year." Organizations satisfying both must maintain the documentation GDPR demands while implementing the specific controls HIPAA requires.

What are the restrictions on cross-border data transfers under the GDPR?

GDPR Chapter V (Articles 44-49) restricts transfers of personal data outside the European Economic Area (EEA). The restrictions are among the strictest in any global privacy framework.

Data can only leave the EEA through one of these mechanisms:

Adequacy decision. The European Commission determines that the receiving country provides an adequate level of data protection. The US lost its adequacy status when the Court of Justice of the EU invalidated Privacy Shield in the 2020 Schrems II decision. The EU-US Data Privacy Framework (DPF), adopted in July 2023, restored a pathway for US organizations that self-certify under it.

Standard Contractual Clauses (SCCs). Pre-approved contract templates that bind the data importer to GDPR-equivalent protections. Post-Schrems II, SCCs require a Transfer Impact Assessment (TIA) evaluating whether the destination country's surveillance laws undermine the contractual protections.

Binding Corporate Rules (BCRs). Intra-group transfer mechanisms approved by supervisory authorities. These take 12-18 months to establish and are practical only for large multinational organizations.

Derogations under Article 49. Explicit consent, contract performance, or important public interest can justify transfers, but only for occasional, non-systematic transfers. Routine health data flows between EU research partners and US AI companies do not qualify.

For health data specifically, Article 9's restrictions on special category data add another layer. Even with a valid transfer mechanism, the receiving organization must have a lawful basis for processing health data under Article 9(2). The transfer mechanism gets data across the border. Article 9 determines whether you can do anything with it once it arrives.

HIPAA imposes no equivalent cross-border transfer restrictions. There is no concept of "adequacy" for receiving countries. A US covered entity can send PHI to a processor in any country, provided the BAA is in place and the processor meets Security Rule requirements. This asymmetry creates a false sense of security for US organizations that assume their HIPAA compliance extends to EU data.

What is the new HIPAA rule in 2026?

The US Department of Health and Human Services (HHS) proposed a major update to the HIPAA Security Rule in January 2025, with final implementation expected to begin affecting covered entities in 2026. The proposed rule represents the most significant HIPAA Security Rule revision since 2013.

Key changes include:

Mandatory encryption. The current rule treats encryption as an "addressable" specification, meaning organizations can document why they chose an alternative. The 2026 update eliminates this flexibility. All electronic PHI (ePHI) must be encrypted at rest and in transit. No exceptions.

Multi-factor authentication (MFA). Required for all access to ePHI systems. The current rule only requires "unique user identification" and allows single-factor authentication.

72-hour incident response. Organizations must restore critical systems within 72 hours of a security incident. This aligns closer to GDPR's 72-hour breach notification timeline.

Annual penetration testing and vulnerability scanning. Currently, HIPAA requires periodic technical evaluations. The new rule specifies annual penetration tests and vulnerability scans every six months.

Technology asset inventory and network mapping. Covered entities must maintain a complete, current inventory of all technology assets that create, receive, maintain, or transmit ePHI, with network diagrams updated at least annually.

Business associate verification. Covered entities must verify that business associates have implemented required safeguards, not just contractually require them.

For cross-border operations, the 2026 rule tightens requirements significantly. Any EU-based processor handling US PHI under a BAA will need to demonstrate compliance with mandatory encryption, MFA, and the new technical standards. Any US organization receiving EU health data will face overlapping obligations: GDPR's accountability principle and the new HIPAA Security Rule's verification requirements.

Key statistics

The scale of cross-border health data compliance failures is quantifiable and growing:

GDPR health data fines exceeded €1.6 billion across all sectors from 2018 through 2024, with healthcare and life sciences accounting for a rising share of enforcement actions.

The average cost of a healthcare data breach reached $10.93 million in 2023, according to IBM's Cost of a Data Breach report, the highest of any industry for the 13th consecutive year.

Only 12% of US healthcare organizations that process EU patient data have fully implemented Transfer Impact Assessments, according to a 2024 IAPP survey of privacy professionals.

SuperTruth's DTI scoring reduced standardization time by 95% in the imaware case study, processing 105,000 diagnostic records in 2 hours instead of 3 weeks, demonstrating that trust-scored data pipelines eliminate compliance ambiguity at the record level.

The EU-US Data Privacy Framework covers approximately 2,800 US organizations as of early 2025, but fewer than 200 are healthcare or life sciences companies, leaving the majority of cross-border health data transfers reliant on SCCs with TIAs.

The consent gap between GDPR and HIPAA

GDPR and HIPAA define consent differently, and those differences create operational chaos for cross-border transfers.

Under HIPAA, consent for treatment, payment, and healthcare operations (TPO) is implicit. A patient does not need to sign a consent form for their physician to share records with a specialist for treatment purposes. HIPAA authorizations are required for uses beyond TPO, such as research or marketing.

Under GDPR, consent must be freely given, specific, informed, and unambiguous. For health data (a special category under Article 9), consent must be explicit. Pre-checked boxes do not count. Bundled consent does not count. Consent must be as easy to withdraw as it was to give.

The operational problem: a US health system receives referral data from a German hospital for a patient seeking treatment abroad. Under HIPAA, the US system can process that data for treatment without specific patient consent. Under GDPR, the German hospital needed explicit consent to transfer the data, the transfer mechanism (SCC or DPF) must be in place, and the US system must process the data only for the purpose the patient consented to.

When the US system later wants to include that patient's data in a retrospective outcomes study, HIPAA might allow it under the research exception with IRB waiver. GDPR requires a new legal basis, which likely means going back to the patient for fresh consent or demonstrating that a different Article 9 derogation applies.

ConsentOS, SuperTruth's consent governance architecture, tracks these overlapping requirements at the record level. Each data element carries its consent status, purpose limitation, and jurisdictional requirements. When a consent scope changes or a patient withdraws authorization, the system propagates that change across every downstream use.

Where HIPAA and GDPR conflict, not just differ

Cross-border compliance gap: GDPR vs HIPAA requirements compared

Some differences between the frameworks create outright conflicts, not just different standards.

Data retention. HIPAA requires covered entities to retain certain records for six years from creation or last effective date. GDPR's storage limitation principle requires deletion when data is no longer necessary for its purpose. A clinical trial that ends in 2024 may trigger GDPR deletion obligations in 2025, while HIPAA mandates retention until 2030. Organizations must document which framework governs which records and maintain both timelines simultaneously.

Right to erasure. GDPR grants data subjects the right to erasure (Article 17). HIPAA has no equivalent right. A patient can request amendment of their records under HIPAA, but a covered entity can deny the request and is never required to delete records. When an EU patient exercises their right to erasure against a US health system that is both GDPR-bound (for the EU patient) and HIPAA-bound (as a covered entity), the organization faces a genuine legal conflict.

De-identification standards. HIPAA offers two de-identification methods: Safe Harbor (removing 18 specified identifiers) and Expert Determination. GDPR requires anonymization that makes re-identification "reasonably" impossible, considering all means "reasonably likely" to be used. HIPAA Safe Harbor may not satisfy GDPR anonymization requirements, particularly given modern re-identification techniques using machine learning on sparse datasets.

Breach notification scope. HIPAA requires notification for breaches of unsecured PHI affecting 500 or more individuals to HHS, media, and affected individuals. GDPR requires notification for any breach likely to result in risk to individuals' rights and freedoms, with no minimum threshold. A breach affecting 50 EU patients requires GDPR notification within 72 hours. The same breach under HIPAA alone would require individual notification but not HHS or media notification.

The trust scoring approach to dual compliance

DTI dimension weights mapped to GDPR and HIPAA requirements

Checklist compliance fails for cross-border health data because it treats each framework in isolation. A record can be HIPAA-compliant and GDPR-noncompliant at the same time. A transfer mechanism can be legally valid but operationally meaningless if the underlying data lacks provenance documentation.

The Data Trust Index addresses this by scoring every health data record across eight dimensions that map to both frameworks simultaneously:

Provenance (25% weight): Where did this data originate? Can the chain of custody be documented from source to current holder? Both GDPR's accountability principle and HIPAA's documentation requirements demand this.

Consent (20% weight): What was the patient's consent scope? Does it cover the current use? Is it valid under both GDPR Article 9 and HIPAA authorization requirements? Has it been withdrawn?

Recency (15% weight): Is this data current enough for its intended use? GDPR's accuracy principle and clinical validity requirements both degrade with data age.

Quality (10% weight): Are the data elements complete, correctly formatted, and clinically meaningful?

Concordance (10% weight): Does this record agree with other records about the same patient or event?

Validation (10% weight): Has the data been independently verified against a source of truth?

Breadth (5% weight): Does the record cover sufficient clinical context for its intended use?

Stability (5% weight): Has the data remained consistent across observations, or does it fluctuate in ways that suggest collection problems?

A record scoring below 60 on the DTI should not cross a border. A record scoring below 40 should not be processed at all. These thresholds are not arbitrary; they reflect the minimum documentation, consent verification, and provenance tracking that satisfies both GDPR accountability and HIPAA safeguard requirements.

Building a dual-compliance data architecture

Organizations handling cross-border health data need five infrastructure components that most current systems lack:

1. Jurisdictional tagging at the record level. Every data element must carry metadata identifying which regulatory framework governs it. A single patient record can contain elements governed by GDPR (collected during treatment in France), HIPAA (collected during follow-up in the US), and potentially other frameworks (PIPL for Chinese nationals, LGPD for Brazilian patients).

2. Purpose-bound processing controls. Data collected for clinical care cannot silently flow into research pipelines or AI training datasets. Purpose limitation under GDPR and the HIPAA Minimum Necessary standard both require technical enforcement, not just policy statements.

3. Transfer mechanism documentation. Every cross-border transfer needs a documented legal basis: SCC reference, DPF certification number, or Article 49 derogation justification. This documentation must be queryable and auditable.

4. Consent lifecycle management. Consent is not a one-time event. It is a living status that changes when patients withdraw, when purposes shift, or when new regulations take effect. The system must propagate consent changes in real time across all downstream uses.

5. Automated breach assessment. When a security incident occurs, the system must immediately identify which records are affected, which jurisdictions apply, and which notification timelines govern. A 72-hour GDPR clock and a 60-day HIPAA clock can run simultaneously for different records in the same breach.

Why the EU-US Data Privacy Framework is not enough

The EU-US Data Privacy Framework, adopted in July 2023, provides a legitimate transfer mechanism for participating US organizations. But it solves only one problem: the legal basis for moving data across the Atlantic.

It does not solve the consent scope problem. It does not verify that the receiving organization can process health data under GDPR Article 9. It does not ensure that de-identification meets GDPR anonymization standards. It does not address HIPAA's retention requirements conflicting with GDPR's storage limitation.

More fundamentally, the DPF faces the same legal vulnerability as its predecessors (Safe Harbor and Privacy Shield). Max Schrems and noyb have already signaled potential challenges. If the Court of Justice of the EU invalidates the DPF, organizations relying solely on it for cross-border health data transfers will face immediate compliance gaps.

Organizations building for durability need transfer mechanisms backed by trust-scored data, verifiable consent chains, and provenance documentation that satisfies both frameworks regardless of which transfer mechanism is legally available.

The 2026 convergence

The new HIPAA Security Rule and ongoing GDPR enforcement are converging toward a common set of expectations: mandatory encryption, rapid incident response, verified business associate compliance, and documented accountability. Organizations that build toward the higher standard now will spend less time retrofitting when enforcement actions accelerate.

The DTI Engine scores every health data record before it enters a pipeline, crosses a border, or trains a model. For organizations managing cross-border health data between the EU and US, this means every record carries a verifiable trust score that maps to both GDPR and HIPAA requirements at the field level. If your team is evaluating data for cross-border transfers, dual-framework compliance, or international research collaboration, contact Louis Simeonidis at louis@supertruth.ai or (215) 918-4140.

Further reading:

DTI™ Engine

Health systems solution

What HIPAA does not tell you about data trust

Purpose limitation in health AI: why secondary use consent is not a catch-all

ConsentOS: what five-tier consent architecture looks like in practice