We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to be compliant with the Australian Privacy Principles among other things.

I have two questions that are not immediately clear to me:

  1. This is a SaaS product, where end users sign up themselves. If someone from the United States or New Zealand sign up, and we end up inadvertently storing data from patients who reside in these companies, are we violating any rules? Or is it best practise to ensure this is not possible?

  2. If we wish to willingly engage with customers from these countries, must be also comply with their local healthcare codes of practise? I.e. if we wish to additionally target customers in New Zealand or the United States, is it also now a requirement we adhere to HIPAA, HISO (and all other mandated requirements) despite the fact we are an Australian incorporated company?


You have to comply with the law everywhere you operate

If you have US, NZ or Iraqi customers (knowingly or not) you have to comply with the laws of the US, NZ and Iraq.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.