HIPAA vs GDPR: Key Differences Small Businesses Need to Know

The Confusing Intersection Where Two Worlds Collide

You run a small physical therapy practice in Austin. Most of your patients are locals. Then one day, a tourist from France walks in with a sprained ankle. You treat her, create a patient file, and send her on her way. A few months later, she emails you. She wants you to delete every record of her visit. She cites something called GDPR, and the request feels more formal than anything you have received from an American patient.

Now you are scratching your head. You thought you had a handle on HIPAA. You encrypted your patient records. You trained your staff on phishing. But this GDPR thing is a different beast. Does it apply to you? Can you keep her records for insurance purposes or must you erase everything? And if you get it wrong, what is the actual risk?

This scenario is becoming more common. Small businesses that handle health data or any personal information now operate in a world where multiple privacy laws overlap. HIPAA and GDPR are two of the biggest. They share some DNA, but they differ in ways that can trip up a small business without a compliance team. Understanding those differences is not just an academic exercise. It can save you from fines, lawsuits, and the quiet loss of customer trust.

What HIPAA Actually Protects and Who Must Follow It

HIPAA, the Health Insurance Portability and Accountability Act, is a United States law. It applies to covered entities and their business associates. Covered entities include healthcare providers like doctors, dentists, physical therapists, chiropractors, and even some alternative medicine practitioners who transmit health information electronically. Health plans and healthcare clearinghouses also fall under the rule.

The law protects protected health information, or PHI. PHI is any individually identifiable health information held or transmitted by a covered entity. It includes medical records, billing information, lab results, x-rays, and even appointment dates. If a piece of information can be linked to a specific person and relates to their health or payment for care, HIPAA likely covers it.

Small practices often assume HIPAA only applies to large hospitals. That is dangerously wrong. A solo dentist, a small counseling office, or a two-person optometry shop falls under HIPAA if they bill electronically or handle health data in any digital form. There is no small business exemption. If you touch PHI, you are on the hook.

The Privacy Rule and the Security Rule

HIPAA is really two rules with different jobs. The Privacy Rule controls how PHI can be used and disclosed. It gives patients rights to access their records, request corrections, and receive a notice of privacy practices. It also requires covered entities to have written policies and to train their workforce.

The Security Rule is more technical. It mandates administrative, physical, and technical safeguards to protect electronic PHI. This includes encryption, access controls, audit logs, and risk assessments. The rule is flexible. It uses the phrase “reasonable and appropriate” so that a small practice can tailor security measures to its size and resources. But it does not let you off the hook entirely. You must still document your decisions and address risks.

What GDPR Actually Protects and Who Must Follow It

The General Data Protection Regulation is a European Union law. Unlike HIPAA, which focuses on the healthcare sector, GDPR applies to any organization that processes personal data of individuals in the EU, regardless of the organization’s location. If you are a small business in Kansas selling handmade soap online and a customer from Germany places an order, GDPR potentially applies to the data you collect from that transaction.

Personal data under GDPR is a broad concept. It covers names, email addresses, IP addresses, cookie identifiers, location data, and even device fingerprints. Health information is a special category called sensitive data, which receives stricter protections. If you process health data about EU individuals, you must comply with both the general rules and the enhanced requirements for sensitive information.

GDPR does have a small business consideration, but it is not a blanket exemption. If your processing of personal data is occasional, low risk, and does not involve sensitive data on a large scale, some obligations like appointing a Data Protection Officer or maintaining detailed records of processing activities are relaxed. But the core principles still apply. Transparency, purpose limitation, data minimization, and the requirement to honor individual rights are non-negotiable.

Where the Two Laws Overlap and Why That Matters

Small businesses sometimes assume that complying with HIPAA automatically means they comply with GDPR, or vice versa. That is a mistake. The laws share some common ground. Both require security measures. Both require notifications in the event of a breach. Both give individuals rights over their data.

But the similarities are broad strokes. The details differ significantly. A HIPAA authorization form does not satisfy GDPR’s consent requirements. A HIPAA business associate agreement does not fulfill GDPR’s mandatory contract terms for data processors. The breach notification timelines are different. The definitions of what counts as sensitive data have different boundaries. For a small business caught between both laws, the safe route is to understand each regime independently and build a program that meets the higher standard in each area.

Consent and Individual Rights: The Biggest Practical Divide

This is where small business owners feel the friction most directly. HIPAA and GDPR treat consent and individual control in fundamentally different ways.

How HIPAA Approaches Patient Authorization

Under HIPAA, treatment, payment, and healthcare operations do not require patient consent. You can use and disclose PHI for these core functions without asking permission. If you want to use PHI for something else, like marketing or research, you generally need a written authorization. That authorization must contain specific elements and describe exactly what data will be shared, with whom, and for what purpose.

Patients have the right to access their records, request amendments, and receive an accounting of disclosures. They do not have a broad right to demand deletion. HIPAA requires retention of medical records for at least six years in many states, often longer. Even if a patient asks you to delete their file, you can decline if the record is needed for legal or operational reasons.

How GDPR Treats Personal Data Control

GDPR puts individual control at the center. It defines six lawful bases for processing, and consent is only one of them. You might also process data because you have a contract, a legal obligation, or a legitimate interest. But if you rely on consent, it must be freely given, specific, informed, and unambiguous. Pre-checked boxes, silence, or bundled consent forms do not satisfy GDPR. The individual must take a clear affirmative action.

The rights under GDPR go further than HIPAA. In addition to access and correction, individuals have the right to erasure, often called the right to be forgotten. They can request deletion of their personal data if the data is no longer necessary for the purpose you collected it, if they withdraw consent, or if they object to processing. There are exceptions, such as when you need to retain the data for legal claims or public health purposes, but the default stance is erasure, not retention.

GDPR also includes the right to data portability, allowing individuals to receive their data in a machine-readable format and transfer it to another provider. HIPAA has a similar right to access records, but GDPR’s portability right is more structured and applies across industries. There is also a right to restrict processing and a right to object to processing based on legitimate interests or direct marketing.

For a small business, this means a European patient or customer can demand things an American patient cannot. If you are a US physical therapist treating an EU resident, that person can ask you to delete their records under GDPR, while a local patient cannot under HIPAA. Handling these conflicting obligations requires a clear policy and sometimes legal advice.

Breach Notification: Different Clocks, Different Triggers

When things go wrong, both laws require you to tell people. But the rules diverge on when, how, and to whom.

HIPAA’s Breach Notification Rule

HIPAA defines a breach as an impermissible use or disclosure that compromises the security or privacy of PHI, unless it falls under a low-probability exception determined by a risk assessment. If a breach affects fewer than five hundred individuals, you must notify affected individuals within sixty days of discovery. You also log the breach and report it to the Department of Health and Human Services at the end of the year. If it affects five hundred or more, you notify individuals, HHS immediately, and in some cases, the media.

The notification must describe what happened, what data was involved, what steps the individual should take, and what you are doing to mitigate the situation. HIPAA requires notification to individuals by first-class mail or email if the individual has agreed to electronic communications.

GDPR’s Breach Notification Rule

GDPR sets a stricter timeline. You must notify the relevant supervisory authority within seventy-two hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. If you cannot provide all the details within that window, you must give what you have and follow up later.

Notification to affected individuals is required without undue delay if the breach is likely to result in a high risk to their rights and freedoms. The threshold for individual notification is higher than the authority notification, but when it applies, the communication must be clear and plain, describing the nature of the breach, likely consequences, and measures taken.

For a small business, the seventy-two-hour GDPR clock is a shock compared to HIPAA’s sixty days. It forces you to have a response plan that can move fast, even on a weekend. If you operate in both regimes, the tighter deadline should drive your incident response planning.

Security Standards: Prescriptive vs. Principle-Based

Both laws require security measures, but the way they articulate those requirements reflects different philosophical approaches.

HIPAA’s Security Rule is structured around administrative, physical, and technical safeguards with implementation specifications that are either required or addressable. Addressable does not mean optional. It means you must implement the specification or document why it is not reasonable and implement an equivalent alternative. This structure gives small practices a checklist to work through. Encryption, for example, is addressable. You must assess whether it is reasonable and, if you decide not to encrypt, document your reasoning and use another method to protect data.

GDPR takes a principle-based approach. Article 32 requires controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. It then lists considerations like encryption, pseudonymization, resilience, and testing. There is no addressable category. Instead, you must demonstrate that your security measures reflect the state of the art, the costs of implementation, and the severity of the risk to individuals.

For a small business, HIPAA can feel more like a concrete path. You work through the specifications and document your decisions. GDPR requires you to think more broadly about risk and justify your choices with less detailed regulatory guidance. Both demand ongoing evaluation, but the documentation burden can feel different.

Fines and Enforcement: The Fear Factor

The penalties under both laws are serious, but the structure and maximum amounts differ, and the perception of enforcement risk matters.

HIPAA Penalties

The Office for Civil Rights enforces HIPAA. Penalties are tiered based on culpability. For a violation you did not know about and could not have known about, the minimum fine is around one hundred twenty dollars per violation. For willful neglect that is not corrected, the maximum is over sixty-eight thousand dollars per violation, with an annual cap of over two million dollars for identical violations. The OCR can also refer cases for criminal prosecution if there is intentional wrongdoing.

Enforcement actions against small practices are less frequent than against large health systems, but they happen. The OCR publishes resolution agreements and corrective action plans that can require years of monitoring. A data breach that exposes patient information often triggers an investigation. For a small practice, the cost of a settlement and the associated legal fees can be existential.

GDPR Penalties

GDPR fines are famously steep. The maximum is twenty million euros or four percent of global annual turnover, whichever is higher. The authorities can also impose a smaller tier of up to ten million euros or two percent of turnover for certain violations. In practice, the fines are not automatically at the maximum. Regulators consider the nature, gravity, and duration of the infringement, whether it was negligent or intentional, and any mitigating steps taken.

Small businesses have faced GDPR fines. The French CNIL fined a small bakery for not securing customer data properly. While most headline fines target large tech companies, enforcement is spreading across sectors. For a small business, the mere threat of a GDPR investigation can divert enormous time and resources. Unlike HIPAA, GDPR also allows data subjects to sue for damages, including non-material damages like distress. This private right of action is a powerful motivator.

Practical Steps for Small Businesses Caught Between Both Laws

If you determine that both HIPAA and GDPR apply to your operations, do not panic. Build a compliance framework that meets the higher standard in each area, and you will be mostly covered.

Map Your Data Thoroughly

The first step is the same for both laws. You must understand what personal data and PHI you hold, where it lives, who can access it, and how it flows. A small medical practice might find that patient records sit in the EHR system, billing details sit in a separate accounting platform, and email communications float around in a cloud inbox. An e-commerce store selling health supplements might collect names, addresses, and health-related preferences. Map it all.

Write Clear Policies That Reflect Reality

Draft internal data protection policies that cover both HIPAA and GDPR requirements. Describe how you handle patient or customer rights, what your retention schedules are, and how you respond to breaches. Your public-facing privacy notice should address both American patients and EU data subjects, clearly explaining their respective rights. If you promise to delete data upon request under GDPR, make sure your team knows how to handle that without violating HIPAA retention rules.

Train Your Team Regularly

Your front desk staff may not know the difference between a HIPAA authorization and a GDPR consent withdrawal. Train them to recognize and escalate data protection requests immediately. Give them scripts or templates for common situations. A short monthly refresher can reduce the risk of a mishandled request turning into a complaint.

Build a Breach Response Plan That Meets Both Deadlines

Since GDPR requires notification within seventy-two hours, while HIPAA allows sixty days, aim for the shorter clock. Build a simple incident response plan that includes immediate containment, internal escalation, and external notification procedures. Identify the relevant authorities and know their contact points in advance. Practice the plan once a year so you are not fumbling during a real incident.

Seek Affordable Expertise When Needed

You do not need a full-time privacy officer. But investing a few hours with a healthcare attorney or a privacy consultant who understands both HIPAA and GDPR can pay off. They can review your policies, check your data map, and flag the highest-risk areas. For a small practice, this might cost a few hundred dollars and save tens of thousands in potential fines.

The False Comfort of Ignoring the Problem

Some small business owners hear about GDPR and think, “I’m too small for them to care.” That is a gamble. Regulators care about whether individuals’ rights are violated, not about the size of the violating company. A complaint from a single EU resident can trigger an inquiry. The same applies to HIPAA. A patient complaint about a denied access request can bring the OCR to your doorstep.

The cost of proactive compliance is always lower than the cost of reactive scrambling. A data protection program built on honesty, documentation, and regular improvement is your shield. It shows regulators that you acted in good faith. It reassures customers and patients that you respect their information. And it lets you focus on running your business instead of lying awake worrying about letters from foreign privacy agencies.

Conclusion

HIPAA and GDPR may feel like two different planets orbiting the same sun. HIPAA zooms in on health data within the United States and gives providers a structured, sometimes prescriptive, framework. GDPR casts a wide net over all personal data of EU residents and demands transparency, individual control, and rapid breach response. For a small business caught between them, the path forward is not about picking one or the other. It is about understanding the higher bar each law sets and rising to meet it. Map your data, write honest policies, train your team, and have a plan for when things break. A little effort now builds a compliance foundation that protects you from both American and European enforcement, and from the quiet erosion of trust that follows a mishandled data request. The French tourist with the sprained ankle deserves the same respect for her data as the neighbor down the street. When you treat privacy as a universal principle, the regulatory puzzle becomes much simpler.