# Standards and References

## GDPR
- Art. 4(13): Genetic data definition. Art. 4(15): Health data definition.
- Art. 9(1): Prohibition on processing special categories. Art. 9(2)(h)-(j): Health-specific exemptions.
- Art. 9(3): Professional secrecy requirement. Art. 9(4): Member State derogations.
- Art. 35(3)(b): Mandatory DPIA for large-scale special category processing.
- Art. 89: Safeguards for scientific research processing (including clinical trials).

## EU Clinical Trials Regulation 536/2014
- Art. 28: Informed consent. Art. 56: Transparency. Art. 58: Archiving. Art. 61: Facility requirements.

## HIPAA (US)
- Privacy Rule (45 CFR 164.500-534), Security Rule (45 CFR 164.302-318), Breach Notification Rule (45 CFR 164.400-414).
- HITECH Act: Enhanced enforcement and breach notification.

## National Health Data Laws
- Germany: GenDG (genetic diagnostics), PatDSG (patient data protection).
- France: Code de la sante publique. CNIL health data guidance.
- UK: NHS Code of Practice, Caldicott Principles, Health and Social Care Act 2012.

## Standards
- ISO 27799:2016: Health informatics — information security management.
- ISO/IEC 27701:2019: Privacy information management (health sector guidance in Annex D).
- HL7 FHIR: Health data interoperability standard with privacy extensions.