HIPAA, GDPR & DPDP interview questions

HIPAA (the US Health Insurance Portability and Accountability Act of 1996) includes rules, enforced by the HHS Office for Civil Rights, that protect individually identifiable health information (Protected Health Information, PHI).

• Covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct certain transactions electronically.
• Business associates: organisations that create, receive, maintain or transmit PHI on behalf of a covered entity (e.g. many healthcare technology, billing and cloud providers). The HITECH Act (2009) made business associates directly liable for compliance with parts of HIPAA.

Key rules: the Privacy Rule, the Security Rule and the Breach Notification Rule.

A BAA is a contract required by HIPAA between a covered entity and a business associate (or between a business associate and its subcontractor). It sets out:

• Permitted uses and disclosures of PHI.
• Requirements to implement appropriate safeguards (Security Rule).
• Obligations to report breaches and security incidents.
• Flow-down obligations to subcontractors.
• Return or destruction of PHI at contract end.

GDPR (EU General Data Protection Regulation, applicable since 25 May 2018) Article 5 sets out seven principles:

• Lawfulness, fairness and transparency.
• Purpose limitation.
• Data minimisation.
• Accuracy.
• Storage limitation.
• Integrity and confidentiality (security).
• Accountability — the controller must be able to demonstrate compliance.

GDPR also applies to organisations outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU.

• Protected Health Information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate, in any form. ePHI is PHI in electronic form, which the Security Rule protects.
• It covers information about health condition, care provided or payment for care that identifies the person or could reasonably be used to identify them.
• The Safe Harbor de-identification method lists 18 identifiers (such as names, small geographic areas, dates other than year, phone numbers, email, medical record numbers, device identifiers, full-face photos) that must be removed, with no actual knowledge that the rest could identify someone.
• The alternative is Expert Determination by a qualified statistician.

• Covered entities and business associates must make reasonable efforts to use, disclose and request only the minimum PHI needed for the purpose.
• It applies to most uses and disclosures, but not to disclosures for treatment, to the individual, or where required by law, among other exceptions.
• In practice it is implemented through role-based access, data minimisation in reports and standard protocols for routine disclosures.

• Right to be informed (transparency).
• Right of access (subject access request), usually answered within one month.
• Right to rectification.
• Right to erasure ('right to be forgotten'), with exceptions.
• Right to restriction of processing.
• Right to data portability.
• Right to object, including to direct marketing.
• Rights related to automated decision-making, including profiling (Article 22).

The DPDP Act 2023 is India's general data protection law for digital personal data. The DPDP Rules were notified in November 2025, with most obligations phased in over the following months. Check the official timeline.

• Data Fiduciary (similar to a controller) and Data Processor; Significant Data Fiduciaries have extra duties such as a DPO, independent audits and DPIAs.
• Processing is based on consent (free, specific, informed, unambiguous, with clear notice) or certain 'legitimate uses' listed in the Act.
• Data Principal rights: access to information, correction and erasure, grievance redressal and nomination.
• Duties: reasonable security safeguards, breach notification to the Data Protection Board and affected individuals, and erasure when the purpose is served.
• Extra protections for children's data, and Consent Managers as a new type of registered intermediary.
• Enforcement by the Data Protection Board of India, with significant financial penalties.

The Security Rule protects electronic PHI (ePHI) through three categories of safeguards:

• Administrative: security management process (including risk analysis and risk management), assigned security responsibility, workforce security, training, incident procedures, contingency planning, evaluation and business associate agreements.
• Physical: facility access controls, workstation use and security, device and media controls.
• Technical: access control, audit controls, integrity, person or entity authentication, transmission security.

Implementation specifications are either 'required' or 'addressable'.

'Addressable' does not mean optional. For each addressable implementation specification, the organisation must assess whether it is reasonable and appropriate in its environment and then:

• implement it, or
• implement an equivalent alternative measure, or
• not implement it if neither is reasonable and appropriate —

and in every case document the decision and rationale. Encryption of ePHI is a well-known addressable specification.

When unsecured PHI is breached (unless a risk assessment shows a low probability that the PHI has been compromised):

• Affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery.
• Breaches affecting 500 or more individuals: notify HHS within the same timeframe and, where more than 500 residents of a state or jurisdiction are affected, prominent media outlets.
• Breaches affecting fewer than 500 individuals: log them and report to HHS within 60 days of the end of the calendar year.
• Business associates must notify the covered entity of a breach.

PHI that is properly encrypted according to HHS guidance is not considered 'unsecured'.

Article 6 lawful bases:

• Consent.
• Contract.
• Legal obligation.
• Vital interests.
• Public task.
• Legitimate interests.

Special category data (e.g. health data) additionally needs an Article 9 condition.

The 72-hour rule (Article 33): a controller must notify the supervisory authority of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. High-risk breaches must also be communicated to affected individuals. Processors must notify the controller without undue delay.

• Controller: decides why and how personal data is processed.
• Processor: processes personal data on behalf of and on the instructions of the controller (e.g. a SaaS or cloud provider). A written contract with required terms (GDPR Article 28) is needed.

A Data Protection Impact Assessment (DPIA, Article 35) is required before processing that is likely to result in a high risk to individuals — e.g. large-scale processing of special category data such as health data, or systematic monitoring. It describes the processing, assesses necessity and proportionality, identifies risks to individuals and the measures to address them.

The HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of all ePHI the organisation creates, receives, maintains or transmits.

• Scope must cover all ePHI, wherever it is: EHR, imaging, email, laptops, backups, medical devices, cloud apps.
• It should identify threats and vulnerabilities, current controls, likelihood, impact and risk level, and be documented.
• It must be reviewed and updated periodically and after changes, and lead to a risk management plan.
• HHS enforcement actions frequently cite the lack of an accurate, enterprise-wide risk analysis.

Chapter V of the GDPR restricts transfers of personal data to countries outside the EEA unless protection travels with the data:

• Adequacy decisions: the European Commission has recognised certain countries (and the EU-US Data Privacy Framework for certified US companies).
• Appropriate safeguards: Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs) and others.
• After the Schrems II judgment, exporters using SCCs should assess the destination's laws and practices (a transfer impact assessment) and add supplementary measures if needed.
• Limited derogations (such as explicit consent) apply for occasional, specific transfers.

Article 30 GDPR requires controllers and processors (with some exceptions) to keep a record of processing activities, including purposes, categories of data and data subjects, recipients, transfers, retention and security measures.

• It acts as the privacy equivalent of an asset inventory.
• It helps with DSARs (where is the data?), breach assessment (whose data is affected?), DPIA triggers and vendor management.
• It should be maintained by process owners with privacy oversight and reviewed regularly.

1. Contain: ask the recipient to delete it and confirm in writing, recall the message if possible, and preserve the details.
2. Assess: what data (identifiers, diagnoses?), how many people, who received it, and whether it was opened or forwarded.
3. Apply the legal tests: HIPAA's 4-factor risk assessment for a breach of unsecured PHI, GDPR Article 33 risk-to-individuals test, and any local law or contract.
4. Notify where required, within the deadlines (GDPR 72 hours to the authority, HIPAA without unreasonable delay and within 60 days), with legal involved.
5. Document everything, even if you conclude notification is not required.
6. Fix the root cause: email DLP rules, auto-complete clean-up, and training.

• Without a BAA, the hospital cannot let the vendor create, receive, maintain or transmit PHI on its behalf. Doing so would breach HIPAA.
• Options: find a vendor that will sign a BAA, use the vendor only for non-PHI messages (such as generic reminders with no health information), or negotiate.
• If the business still wants the vendor, document the decision and design controls so PHI cannot enter it.
• Check the vendor's security anyway: SOC 2 or ISO 27001, encryption and access controls.

• Erasure is not absolute. Article 17(3) GDPR allows retention when needed to comply with a legal obligation.
• Delete what is not needed: marketing data, profiles, support chats beyond retention periods.
• Keep only the invoice data the law requires, restrict access to it, and delete it when the legal retention period ends.
• Reply to the person within the deadline explaining what was erased, what is retained, the legal reason and how long it will be kept.
• Record the request and the decision.

1. Confirm applicability: digital personal data processed in India, or outside India in connection with offering goods or services to people in India.
2. Build or update the data inventory and data flows, including processors and cross-border transfers.
3. Review notices and consent flows against DPDP requirements (clear, itemised notice, easy withdrawal, language options).
4. Set up processes for Data Principal rights, grievance handling and breach notification to the Data Protection Board and affected individuals.
5. Check retention and erasure rules, children's data handling and security safeguards.
6. Assess whether you may be a Significant Data Fiduciary, and plan against the phased compliance dates in the Rules.

In January 2025, HHS's Office for Civil Rights published a Notice of Proposed Rulemaking to update the HIPAA Security Rule. Main proposals included:

• Removing the distinction between 'required' and 'addressable' implementation specifications, making most of them required.
• Explicit requirements such as encryption of ePHI at rest and in transit, MFA, an asset inventory and network map, vulnerability scanning and penetration testing, and documented restoration capabilities.
• More specific requirements for business associates and for contingency planning.

A proposed rule is not final law. Check the current status before treating any of these as mandatory, and remember that many are already good practice.

• Lawful basis and purpose: is training or using AI on this data compatible with the original purpose and the notice given to people?
• Do a DPIA (and where relevant an AI impact assessment) before deployment, covering bias, accuracy, explainability, security and automated decision-making rights.
• Minimise and de-identify data used for training, and control whether vendors may use your data to train their models.
• Ensure human oversight for decisions with significant effects on individuals.
• Address vendor terms (data location, retention, sub-processors) and security (prompt injection, data leakage).
• Keep records that let you answer regulators' and patients' questions.

• Activate incident response and legal counsel. Get facts from the business associate quickly: what systems, what data, which patients, what timeline.
• Under HIPAA, the business associate must notify the covered entity of a breach. The covered entity is generally responsible for notifying individuals, HHS and, where 500+ residents of a state are affected, the media, unless the BAA delegates this.
• HHS guidance treats ransomware encryption of PHI as a presumed breach unless a low probability of compromise can be shown.
• Check other laws that apply (state laws, GDPR, local rules) and contract duties to customers.
• Review the BAA and the vendor's controls afterwards, and decide whether to continue the relationship.

• Under HIPAA, most marketing communications using PHI need the patient's written authorisation. There are limited exceptions, such as face-to-face communications.
• Under GDPR or the DPDP Act, check the lawful basis (often consent for marketing), the original purpose and the notice given.
• Health data is special category or sensitive, which requires higher standards.
• Check opt-outs, electronic marketing rules and whether third-party tools (email platforms, ad pixels) would receive health information.
• Recommend an approach based on opt-in consent, collected separately from treatment consent.