Health data protection
In short
Health data protection is the set of rules and measures that define who may collect, use and share information about a person's health, on what legal basis, with what security and with what rights for the patient. The GDPR, the LGPD, Argentina's Law 25,326 and Japan's APPI treat health data as a special or sensitive category; HIPAA, in the United States, is a law specific to health information. The rules vary by country, and several of those laws expressly provide for their use in care.
- Type
- Concept
- Steward
- No single steward: general concept or generic technology
- Reviewed
- October 25, 2026
Explanation
What it is
Protecting health data does not mean banning their use: it means setting conditions. Each jurisdiction answers the same questions: what counts as health data, who is bound, on what basis data may be processed, what rights the person has, what security is required and who supervises.
Two models
- General law with a special category. One law covers every sector and gives health data a stricter regime: the GDPR in the European Union, the LGPD in Brazil, Law 25,326 in Argentina and the APPI in Japan.
- Sectoral law. HIPAA, in the United States, only binds covered entities (health plans, clearinghouses and certain providers) and their business associates. In Canada, PIPEDA coexists with provincial health information laws.
Comparison
| Jurisdiction | Law | How it treats health data |
|---|---|---|
| European Union | GDPR, Art. 9 | Special category: processing prohibited except in listed cases, such as explicit consent or health care |
| United States | HIPAA, 45 CFR 164 | Protected health information; use for treatment, payment and operations without authorization |
| Canada | PIPEDA | Defines "personal health information"; exemption orders defer to provincial laws, such as Ontario's |
| Brazil | LGPD, Arts. 5 and 11 | Sensitive data: specific and highlighted consent or legal cases, such as health protection |
| Argentina | Law 25,326, Arts. 2, 7 and 8 | Sensitive data; health establishments and professionals may process their patients' data, respecting professional secrecy |
| Japan | APPI, Arts. 2 and 20 (reference version: Act No. 37 of 2021, per the official translation) | Medical history is sensitive personal information; acquiring it requires prior consent, with exceptions |
Recurring elements
- Legal bases other than consent for care and public health.
- Patient right of access: for example, 30 days, extendable, under HIPAA.
- Security and breach notification: 72 hours to the authority under the GDPR, as a general rule.
- Supervisory authority: national authorities in the EU, the ANPD in Brazil, the Privacy Commissioner in Canada and HHS for HIPAA.
Common misconceptions
- Confusing protection with prohibition. The GDPR (Art. 9(2)(h)), HIPAA (§ 164.506) and the LGPD (Art. 11(II)(f)) provide for use in care.
- Assuming one law covers everything. HIPAA does not reach anyone who is not a covered entity or business associate.
- Believing anonymization always takes data out of scope. The LGPD treats anonymized data as personal if the anonymization can be reversed with reasonable effort (Art. 12).
- Reducing it to IT security. Security is one element; legal basis, purpose and rights also count.
Usage examples
In the European Union, a hospital processes health data for diagnosis and care on the basis of GDPR Article 9(2)(h), under professional secrecy.
In Brazil, private health plan operators cannot use health data to select risks (LGPD, Art. 11 §5).
In Argentina, Article 8 of Law 25,326 allows health establishments and professionals to process their patients' data, respecting professional secrecy.
In Canada, a PIPEDA exemption order defers Ontario health information custodians to the provincial law.
In Japan, the APPI includes medical history in sensitive personal information, whose acquisition requires prior consent except in listed cases.
In the Caribbean, Puerto Rico is included in HIPAA's definition of "State" (§ 160.103).
Relation to other terms
Relies on0
This term does not rely on other glossary terms.
Depend on this one2
- Consent for processing health dataStrong
Consent is one of the legal bases that health data protection laws regulate; its requirements depend on those laws.
- Health data residency and sovereigntyMedium
Residency and international transfer rules are part of data protection laws, such as Chapter V of the GDPR.
Sources
- EUR-Lex — Regulation (EU) 2016/679 (GDPR)eur-lex.europa.eu
- eCFR — 45 CFR Subchapter C, Administrative Data Standards and Related Requirements (HIPAA)ecfr.gov
- Justice Laws Website — Personal Information Protection and Electronic Documents Act (Canada)laws-lois.justice.gc.ca
- Planalto — Lei nº 13.709/2018 (LGPD), texto compiladoplanalto.gov.br
- Argentina.gob.ar — Ley 25.326 de Protección de los Datos Personalesargentina.gob.ar
- Japanese Law Translation — Act on the Protection of Personal Information (Act No. 57 of 2003)japaneselawtranslation.go.jp