HIPAA vs GDPR vs NABIDH: what does each change in healthcare software?
HIPAA, GDPR and Dubai's NABIDH rules were written for different jobs. HIPAA governs covered entities and their business associates in the US. GDPR governs the processing of personal data about people in the EU. NABIDH is the Dubai Health Authority's health information exchange, set within UAE federal health data law. A product sold in all three markets has to meet each one.
How do HIPAA and GDPR differ, row by row?
Quick answer
HIPAA vs GDPR vs NABIDH is not a choice: a product sold in the US, the EU and Dubai meets all three. HIPAA requires business associate agreements and breach notice within 60 days, GDPR requires Article 28 contracts and 72-hour authority notice, and Dubai adds DHA's NABIDH policies. Agnotic Technologies builds one control set that answers each.
| Criterion | HIPAA | GDPR |
|---|---|---|
| Who is regulated | Covered entities and their business associates | Controllers and processors handling personal data of people in the EU, inside or outside the EU |
| Data covered | Protected health information held by a covered entity or business associate | All personal data; health data is a special category under Article 9 |
| Basis for use | Permitted uses and disclosures, such as treatment, payment and operations, or an authorization | A lawful basis under Article 6 plus an Article 9 condition for health data |
| Vendor contract | Business associate agreement | Article 28 processor contract, in writing and binding |
| Breach notice to people or regulator | Individuals without unreasonable delay and no later than 60 calendar days after discovery | Supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware |
| Vendor to customer notice | Business associate to covered entity, no later than 60 calendar days after discovery | Processor to controller without undue delay |
| Individual rights | Access, amendment and an accounting of disclosures | Access, rectification, erasure, restriction, portability and objection |
| Data location | No HIPAA rule on where data is stored | Transfers outside the EEA need an adequacy decision or safeguards such as standard contractual clauses |
| Controls to build | Access control, audit logs, BAA register, breach runbook | Records of processing, impact assessments, rights workflows, transfer register |
What they are
What is HIPAA
HIPAA's Privacy, Security and Breach Notification Rules apply to covered entities, meaning health plans, clearinghouses and providers that conduct standard transactions electronically, and to their business associates. They protect protected health information and allow uses for treatment, payment and health care operations without separate authorization.
What is GDPR
The EU General Data Protection Regulation applies to controllers and processors of personal data about people in the EU, including organizations outside the EU that offer them services. Health data is a special category under Article 9 and needs both a lawful basis and an Article 9 condition.
Key differences
Why is the breach clock different?
HIPAA counts in days. A covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering a breach (45 CFR 164.404), and a business associate must tell the covered entity within the same limit (164.410). GDPR counts in hours: the European Data Protection Board's breach guidelines restate Article 33, under which the controller notifies the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Design one incident process to the shortest clock.
BAA or Article 28 contract: can one agreement cover both?
They have different required contents, so most teams keep two documents or one agreement with two schedules. The EDPB's guidelines on controllers and processors state that any processing by a processor must be governed by a contract or other legal act that is in writing, including electronic form, and binding, and that parties may rely on standard contractual clauses. A BAA alone does not meet that requirement for EU data.
What does NABIDH add for a product used in Dubai?
NABIDH is the Dubai Health Authority's health information exchange. Its obligations come from DHA's NABIDH policies and standards, which we read in their current version with the client before design. The questions to settle are which facilities must connect, which events and documents they must send, which message standards and terminology the exchange expects, how consent and access are recorded, and how a new connection is tested and approved.
Where must health data be stored for UAE use?
The UAE government portal lists Federal Law No. 2 of 2019 on the use of information and communication technology in health fields, which regulates ICT in the UAE health sector, including its free zones. Before choosing a hosting region for UAE patients, ask UAE counsel what the law and DHA policy require for where health data is stored and processed, and whether any exceptions apply to your case.
Which patient rights need product features?
HIPAA's access right means patients can get copies of their records, and amendment requests need a workflow. GDPR adds erasure, restriction, portability and objection, each of which needs a request queue, identity checks, deadlines and a record of the response. Erasure collides with clinical record retention, so the product needs legal hold rules that say which data stays and why.
When to use each
When to use HIPAA
- You build or run software for a US provider, health plan or clearinghouse.
- You process PHI on a covered entity's behalf as a business associate.
- You need US breach notification to individuals, HHS and, for large breaches, the media.
When to use GDPR
- Your product serves patients, clinicians or customers in the EU.
- You process personal data for an EU controller as its processor.
- You move EU personal data to systems or support teams outside the EU.
Which engineering controls cover HIPAA, GDPR and NABIDH together?
1. A data map per market. Record which data about which people flows where, tagged by the rules that apply: HIPAA, GDPR, UAE law and NABIDH policy.
2. Region-tagged storage. Every record carries the market it belongs to, and storage, backups and support access follow that tag.
3. One contract register. Track BAAs, Article 28 contracts, transfer clauses and DHA approvals per customer and per vendor.
4. One incident runbook with three clocks. Start the 72-hour, 60-day and Dubai timelines from the same detection event, with owners for each notice.
5. Rights workflows. Build access, amendment, erasure and portability requests once, with market rules deciding which apply and which deadlines run.
6. Consent and lawful basis records. Store what basis or permission each use relies on, by market, with history.
7. Audit logs that answer all three. Log who accessed what, from where, and why, in a form your security team can search.
8. The exchange connector as its own module. Keep NABIDH messaging, terminology mapping and testing in a separate service so policy updates do not touch the core product.
Which sources does this comparison rely on?
- 45 CFR 164.404: notification to individuals (eCFR)
- EDPB Guidelines 9/2022 on personal data breach notification under GDPR (edpb.europa.eu)
- EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR (edpb.europa.eu)
- UAE government portal: data protection laws, including Federal Law No. 2 of 2019 (u.ae)