By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: General Data Protection Regulation (GDPR)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
The General Data Protection Regulation (GDPR) is the European Union’s comprehensive law on the protection of personal data. It sets rules for how organizations collect, use, store, share, and delete information about identifiable people, and it gives individuals strong rights over their data.
The HIMSS Dictionary describes GDPR as an EU regulation that aligns privacy law among member states, strengthens and protects the privacy of people in the EU, and to change how organizations approach data privacy. It notes that GDPR replaced the earlier Data Protection Directive 95/46/EC and applies to companies processing the personal data of people in the EU, wherever the company is located.
GDPR has applied since May 25, 2018. It treats data concerning health, genetic data, and biometric data used for identification as special categories that may be processed only under specific conditions.
| GDPR Concept | What It Means | Healthcare Example |
|---|---|---|
| Personal Data | Any information relating to an identifiable person | Name, ID number, location data, online identifiers |
| Special Category Data | Sensitive data with extra protection, including health and genetic data | Diagnoses, lab results, genetic test results |
| Lawful Basis | A legal ground required for any processing | Providing medical care, legal obligation, consent |
| Data Controller and Processor | The organization deciding purposes versus the one processing on its behalf | A hospital and its cloud vendor |
| Data Subject Rights | Rights such as access, rectification, erasure, restriction, and portability | A patient requesting a copy of their data |
| Breach Notification | Notice to the supervisory authority, generally within 72 hours when required | Reporting a ransomware attack exposing patient data |
⚠️ Exam Alert: GDPR covers personal data broadly across sectors; HIPAA covers PHI held by covered entities and business associates. GDPR’s breach notice to regulators is generally due within 72 hours; HIPAA allows up to 60 days for individual notice. GDPR includes a right to erasure with exceptions; HIPAA has no general right to deletion. A controller under GDPR is roughly comparable to a covered entity, and a processor to a business associate, but the concepts are not identical.
🌐 Why It Matters: Real-World Healthcare IT Context
GDPR reshaped global privacy expectations. Its principles, such as lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality, and accountability, have influenced laws and practices far beyond Europe, including U.S. state privacy laws.
For health data, GDPR requires both a general lawful basis for processing and a specific condition for special category data. Healthcare providers can often rely on conditions related to medical diagnosis, treatment, and management of health systems under professional confidentiality, rather than on consent. Research and public health have their own conditions and safeguards.
Penalties are significant. Supervisory authorities can impose administrative fines of up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious violations.
U.S. healthcare organizations may need to consider GDPR when they offer services to people in the EU, monitor their behavior, participate in international research, operate facilities or subsidiaries in the EU, or use vendors and data flows that cross borders. Transfers of personal data from the EU to other countries are subject to specific rules and mechanisms.
GDPR is also a useful comparison point when thinking about privacy design. Its emphasis on data minimization, privacy by design and by default, and documented accountability offers practical lessons even for organizations it does not cover.
Artificial intelligence adds new dimensions. European rules on AI, along with GDPR provisions on automated decision-making, shape how health data can be used to train and deploy models in the EU. Organizations building or buying AI tools that touch EU data need to consider both data protection and AI-specific requirements.
Key differences between GDPR and HIPAA:
- Scope: GDPR covers most organizations processing personal data; HIPAA covers specific entities
- Data: GDPR protects all personal data; HIPAA protects PHI
- Rights: GDPR includes erasure and objection rights; HIPAA focuses on access, amendment, and accounting
- Breach timing: GDPR generally 72 hours to regulators; HIPAA up to 60 days to individuals
- Roles: GDPR requires a data protection officer in certain situations; HIPAA requires privacy and security officials
- Penalties: GDPR fines can be tied to global turnover
Practical steps for organizations with GDPR exposure:
- Map where EU personal data is collected, stored, and transferred
- Identify lawful bases and special category conditions for each purpose
- Update contracts with processors and transfer mechanisms
- Prepare for data subject requests and 72-hour breach reporting
- Apply data minimization and privacy by design
- Consult privacy counsel on applicability and obligations
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Most U.S. nurses will not apply GDPR directly, but its principles echo good privacy practice everywhere.
At the Bedside
Nurses caring for international patients, especially in academic medical centers and destination hospitals, may encounter requests about how data will be used or shared abroad. Directing those questions to the privacy office ensures they are handled consistently with applicable laws.
GDPR’s principle of data minimization aligns with HIPAA’s minimum necessary standard. Sharing only what is needed for the purpose, in conversations, messages, and documentation, protects patients regardless of which law applies.
In Clinical Workflow
Research nurses and coordinators may work on international studies where data from European sites is governed by GDPR. Consent forms, data transfer agreements, and data handling procedures will reflect those requirements, and following study protocols precisely matters.
Patient rights under GDPR, such as access and correction, resemble rights under HIPAA. Nurses can support those rights by helping patients find the appropriate process rather than handling requests informally.
In EHR Implementation (Go-Live Perspective)
Organizations with international operations may configure EHRs and data platforms to support GDPR requirements, such as restricting where data is stored, managing consent records, and supporting data subject requests. Those configurations are typically designed by privacy, legal, and technical teams.
At-the-elbow support analysts in multinational settings should be aware that data handling rules may differ by location and route privacy questions to the responsible team.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
GDPR appears in privacy and international policy questions:
| CAHIMS Domain | How GDPR Appears |
|---|---|
| Healthcare & Technology Environments | International privacy law; comparison with HIPAA; influence on U.S. state laws |
| Clinical Informatics | Patient rights; research data handling; data minimization |
| Healthcare Information & Systems Management | Data mapping, consent records, data residency, breach response |
| Management & Leadership | Compliance programs, vendor contracts, international transfers, risk |
Key Terms to Know Alongside GDPR
- Personal Data — any information relating to an identified or identifiable natural person
- Special Category Data — sensitive personal data, including health and genetic data, given extra protection
- Data Controller — the organization that determines the purposes and means of processing personal data
- Data Processor — an organization that processes personal data on behalf of a controller
- Data Protection Officer (DPO) — a role required in certain organizations to oversee GDPR compliance
- Right to Erasure — an individual’s right to have personal data deleted in certain circumstances
HIMSS Organizational Position
HIMSS, as a global organization with members in Europe and other regions, addresses data protection laws including GDPR through its privacy and cybersecurity work and international events. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- EUR-Lex — Regulation (EU) 2016/679 (General Data Protection Regulation) https://eur-lex.europa.eu/eli/reg/2016/679/oj
- European Commission — Data Protection https://commission.europa.eu/law/law-topic/data-protection_en
- European Data Protection Board https://www.edpb.europa.eu/home_en
- HHS — Summary of the HIPAA Privacy Rule https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html
- HHS — Breach Notification Rule https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply