0

We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to be compliant with the Australian Privacy Principles among other things.

I have two questions that are not immediately clear to me:

  1. This is a SaaS product, where end users sign up themselves. If someone from the United States or New Zealand sign up, and we end up inadvertently storing data from patients who reside in these countries, are we violating any rules? Or is it a best practise to ensure this is not possible?

  2. If we wish to willingly engage with customers from these countries, must we also comply with their local healthcare codes of practise? I.e. if we wish to additionally target customers in New Zealand or the United States, is it also now a requirement we adhere to HIPAA, HISO (and all other mandated requirements) despite the fact that we are an Australian incorporated company?

Improve this question

1 Answer 1

Reset to default
1

You have to comply with the law everywhere you operate

If you have US, NZ or Iraqi customers (knowingly or not) you have to comply with the laws of the US, NZ and Iraq.

Improve this answer
3
  • Are you sure about that? What is the US going to do to an Australian company, operating in Australia, that winds up breaking its laws? You can't extradite a company...
    – nick012000
    Sep 1, 2021 at 7:52
  • The GDPR protects EU people, even if the business mishandling data covered by it are outside the EU. I think it's likely that other laws that protect a country's citizens would include similar consequences, even though enforcement could be difficult. It would depend on the specifics of the laws though. @nick012000 This question on Politics talks about enforcement of the GDPR - maybe some of that applies here? How are GDPR fines actually enforced for US companies with no physical presence in the EU?
    – ColleenV
    Sep 1, 2021 at 17:01
  • 1
    @ColleenV GDPR only applies to businesses operating in or targeting Europe. An online business clearly directed at, say, North American customers does not have to comply with GDPR even if some of their customers are in Europe.
    – Dale M ♦
    Sep 1, 2021 at 21:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .