Are there any HIPAA like technical requirements in EU for developing health related web software?

Question

It looks like in the USA developers adhere to HIPAA standards when developing and hosting health-related software. But I can't find anything similar to the EU. GDPR is all about being transparent and asking for consent and there nothing about any technical requirements that I must follow legally.

Does that mean I don't need all these expensive HIPAA hosting solutions? And can just get away with a GDPR compliant approach?

Maybe, there is another HIPAA like standard for the EU? I'd love to read about it.

My goal is to make sure our customers feel safe sharing health-related data with us through our web application. This web application collects some health-related data, stores it and analyses it. Everything will be done through the website (Wordpress based).

Answer 1

In France, one needs to ensure that the medical application respects the Code de la Santé Publique (CSP).

https://www.cnil.fr/fr/quest-ce-ce-quune-donnee-de-sante (mirror) gives an overview of different CSP laws pertaining to medical data.

• dispositions relatives aux référentiels de sécurité et d’interopérabilité des données de santé (art. L. 1110-4-1 du CSP) ;
• dispositions sur l’hébergement des données de santé (art. L. 1111-8 et R. 1111-8-8 et s. du CSP) ;
• dispositions sur la mise à disposition des données de santé (art. L. 1460-1 et s. du CSP) ;
• interdiction de procéder à une cession ou à une exploitation commerciale des données de santé (art. L. 1111-8 du CSP, art. L 4113-7 du CSP)

Google Translate:

• provisions relating to the security and interoperability standards for health data (art. L. 1110-4-1 of the CSP);
• provisions on the hosting of health data (art. L. 1111-8 and R. 1111-8-8 and s. of the CSP);
• provisions on the provision of health data (art. L. 1460-1 et seq. of the CSP);
• prohibition to proceed with a transfer or a commercial exploitation of health data (art. L. 1111-8 of the CSP, art. L 4113-7 of the CSP)

In my experience living in France and the US, CSP is more strict than HIPAA. E.g. medical professionals in the United States keep selling patient data to commercial, private entities (mirror), which would typically send you straight to jail if you were to do so in France.

Answer 2

Does that mean I don't need all these expensive HIPPA hosting solutions? And can just get away with a GDPR compliant approach?

It certainly doesn't mean that. It's true that the GDPR does not provide technical guidance. Instead what it requires is that you perform your own analysis of what technical measures are appropriate. Notably, several relevant passages are prefaced by a proposition like this one

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing […]

That might sound like a bunch of abstract legalese but that means the onus is on you to prove that each piece of information you process is handled appropriately. In particular, health-related information is especially sensitive and singled out as such in several recitals and in article 9 so relying on generic “GDPR compliant” third-party offerings is not going to cut it.

In practice, what that could mean is that you have to implement something that's substantially similar to the HIPAA but that still wouldn't be enough: you also have to convince yourself that it follows the state of the art now and keep monitoring it in the future. Strict GDPR compliance is therefore more (not less) demanding than a narrow technical norm.