We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to be compliant with the Australian Privacy Principles among other things.
I have two questions that are not immediately clear to me:
This is a SaaS product, where end users sign up themselves. If someone from the United States or New Zealand sign up, and we end up inadvertently storing data from patients who reside in these companies, are we violating any rules? Or is it best practise to ensure this is not possible?
If we wish to willingly engage with customers from these countries, must be also comply with their local healthcare codes of practise? I.e. if we wish to additionally target customers in New Zealand or the United States, is it also now a requirement we adhere to HIPAA, HISO (and all other mandated requirements) despite the fact we are an Australian incorporated company?