Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
In the US, HIPAA mandates that data communication with patient or healthcare data must be done according to FIPS 140-2 (pdf). E.g. use AES encryption with 128 bit keys or greater to encrypt.
Are there corresponding healthcare/encryption regulations in the EU? What are they?
There is currently no specific law mandating encryption for healthcare data communication. This is not because it isn't desired, but because the applicable law in question—the Data Protection Directive (DPD)—is written in a technology neutral manner. In particular, Article 17 (1) states:
Member States shall provide that the controller must implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
Additionally, health data is included as a type of data given additional safeguards in Article 8.
For additional analysis, see this Spamina paper (PDF) on the subject. In particular they note that Italy and Spain have mandated encryption of sensitive data in their implementations of the DPD. I personally don't want to spend more time on this law because...
It was passed in 1995 and the General Data Protection Regulation (GDPR) passed in 2016 is going to take effect on May 25, 2018 and will repeal the Data Protection Directive. As a regulation, it will have immediate binding effect and the law will be harmonized across the Union.
Like the DPD, the GDPR is technology neutral, but unlike the DPD it specifically mentions encryption as a means of fulfilling some of its requirements. Encryption may in fact be the simplest way of doing so as the requirements and penalties are strict. In particular, I would like to call out the following articles:
Article 6 (4), noting that "processing" is defined broadly, including transmission:
Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent [...] the controller shall [...] take into account, inter alia: [...]
(e) the existence of appropriate safeguards, which may include encryption or pseudonymisation.
Article 32 (1) on security of data processing:
[...] the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
(a) the pseudonymisation and encryption of personal data; [...]
Article 34 requires that in the event of a data breach, those affected are notified except when:
[...] the controller has implemented appropriate technical and organisational protection measures, [...] in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; [...]
Note that all this is generic to all personal data, though again, health data is given additional safeguards in the GDPR in Article 9.
And then there are the penalties that everyone is worried about. Depending on the type of violation, there may be under Article 83 (4) "fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher." Encryption is a way of ensuring that should a data breach occur, these fines are avoided or at the very least significantly lessened.
