While the EU General Data Protection Regulation will establish strict requirements for how personal information for EU data subjects is handled, U.S. health care providers who have no European locations and who do not market to EU residents will have little to worry about, HealthITSecurity reports. Attorney Stephen Wu of the Silicon Valley Law Group said, “If it's a strictly within-the-U.S. health care provider, where it's not attempting to market to Europeans; it's not putting up a website in foreign languages saying, 'We'll take your euros,' and if it's not located in the EU, then that entity is not covered by GDPR." Wu also noted that if a U.S. health care provider is found to be under the jurisdictional scope of the GDPR, simply complying with HIPAA rules will not be sufficient.
Full Story