Health Data
What is Health Data?
Personal data related to the physical or mental health of a natural person, including the provision of health care services. Health data is treated as special category data under GDPR and regulated by HIPAA in the United States.
Terms that appear alongside health data
Each of these is named in at least one of the same controls as health data. The number is how many controls name both.
- consent 43 shared controls
- gdpr 33 shared controls
- biometric data 26 shared controls
- genetic data 20 shared controls
- data subject 17 shared controls
- sensitive personal data 15 shared controls
- data protection 13 shared controls
- profiling 11 shared controls
Frameworks that govern health data
What the standards actually require on health data
Requirements naming health data across 6 standards, quoted from the control text.
Sale of Consumer Health Data is prohibited without a written, statute-compliant Valid Authorization that includes specific data, recipient, purpose, expiration not exceeding one year, and consumer right to revoke.
MHMD-SAL.1 · Valid authorization to sell Consumer Health Data →Per EHDS: cross-border health data. Requirements include (a) implement Cross-Border Data Transfers per Article 7 + (b) cooperate with MyHealth@EU + (c) maintain inventory of cross-border flows + (d) implement appropriate safeguards + (e) cooperate with EHDS Bo...
EHDSREG-5 · Cross-Border Health Data Flows →Data captured through digital health systems should be subject to defined data quality standards, with routine audit, validation, and feedback loops to source facilities.
WHO-DH-IMP.4 · Health data quality and integrity →Recognise Universal Opt-Out Mechanism (Global Privacy Control GPC) mandatory from 31 July 2025 + process sensitive data and consumer health data under enhanced conditions.
MN-CDPA-Universal-Opt-Out-GPC-Sensitive-Data-Section-325O-02-Consumer-Health-Data-Children-Known-Child-Transgender · Minnesota CDPA Universal Opt-Out + GPC + Sensitive + Section 325O.02 + Consumer Health Data + Children + Known Child + Transgender →Connecticut's 2023 amendment adds protections for consumer health data, including consent for processing and restrictions on sale.
CTDPA-42-525-CHD · Consumer Health Data (PA 23-56) →Public and private health establishments and health professionals may collect and process data relating to physical or mental health of patients subject to professional secrecy.
AR-25326-ART8-HEALTH · Health Data Special Rules →Questions people ask about health data
What is Health Data?
Why is Health Data important for compliance?
Which compliance frameworks address Health Data?
Where can I learn more about Health Data?
See how Health Data applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.