# Health Data PIA — Standards and Legal References

## Primary Legislation

- **GDPR Article 9** — Processing of special categories of personal data including health data. Prohibits processing except under enumerated exceptions in Art. 9(2).
- **GDPR Article 35(3)(b)** — Mandatory DPIA for processing on a large scale of special categories of data under Article 9(1).
- **GDPR Article 89** — Safeguards and derogations relating to processing for scientific or historical research purposes and statistical purposes.
- **HIPAA Privacy Rule (45 CFR Part 160, 164)** — US federal regulation governing use and disclosure of Protected Health Information by covered entities and business associates.
- **HITECH Act (2009)** — Strengthened HIPAA enforcement, introduced breach notification for health data, extended requirements to business associates.
- **42 CFR Part 2** — US federal regulation providing heightened privacy protections for substance use disorder treatment records.
- **EU Clinical Trials Regulation (536/2014)** — Personal data processing in clinical trial conduct with specific transparency and subject rights provisions.

## Regulatory Guidance

- **EDPB WP248rev.01** — Guidelines on Data Protection Impact Assessments; identifies health data as triggering multiple DPIA criteria.
- **EDPB Guidelines 03/2020 on Health Data in COVID-19** — Guidance on processing health data during public health emergencies; balancing public health and individual rights.
- **ICO Health Data Guidance** — UK Information Commissioner's Office guidance on processing health data under the UK GDPR and DPA 2018.
- **HHS OCR Guidance on HIPAA Privacy** — US Department of Health and Human Services Office for Civil Rights guidance on HIPAA compliance.
- **Article 29 WP Opinion 06/2014 on Legitimate Interests** — Guidance on balancing test relevant to health data processing under legitimate interests.

## Industry Standards

- **ISO 27799:2016** — Health informatics — Information security management in health using ISO/IEC 27002.
- **ISO/IEC 27001:2022** — Information security management system standard applicable to health data processing environments.
- **ISO/IEC 27701:2019** — Privacy information management extension; supports health data controller and processor compliance.
- **NIST SP 800-66 Rev. 2** — Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide.
- **HITRUST CSF** — Health Information Trust Alliance Common Security Framework; health-sector-specific security and privacy controls.

## Ethical Frameworks

- **Declaration of Helsinki (WMA)** — Ethical principles for medical research involving human subjects, including data protection provisions.
- **Council of Europe Recommendation CM/Rec(2019)2** — Protection of health-related data.
- **Nuffield Council on Bioethics** — The collection, linking and use of data in biomedical research and health care: ethical issues.