Health data privacy laws

Regulations worldwide that deal with health data, with every phased deadline and the official source for each.

Regulations

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Connecticut Data Privacy Act (CTDPA)Comprehensive privacy law with access, correction, deletion, portability and opt-out rights. PA 25-113 (effective July 1, 2026) sharply lowered applicability thresholds, broadened sensitive data, added profiling impact assessments, and requires disclosure of whether personal data is used to train large language models. PA 26-64 (effective Oct 1, 2026) bans the sale of precise geolocation data and creates a data broker registry (registration required from Jan 1, 2027) and a state deletion mechanism brokers must honor from Oct 1, 2028.Next: Jan 1, 2027 Data broker registration required · in 2 months

EnactedEuropean Union

European Health Data Space (EHDS)Gives individuals electronic access to, and control over, their health data across the EU (primary use), with a cross-border MyHealth@EU infrastructure and mandatory requirements for electronic health record (EHR) systems. It also creates a permit-based framework for secondary use of health data (research, innovation, policy) through national Health Data Access Bodies, with data holders required to make data available.Next: Mar 26, 2027 EHDS general application date · in 5 months

AmendedMaryland

Maryland Online Data Privacy Act (MODPA)The strictest US state comprehensive privacy law: imposes data minimization limited to what is strictly necessary, bans the sale of sensitive data outright, and bans targeted advertising to and sale of data of consumers under 18 (known or should have known). Took effect Oct 1, 2025 but does not apply to personal data processing activities before April 1, 2026.Next: Apr 1, 2027 Discretionary 60-day cure period ends · in 5 months

AmendedEuropean Union

GDPRThe EU's core data protection law: any processing of personal data needs a lawful basis, must follow principles such as purpose limitation and data minimisation, and gives individuals rights of access, erasure, portability and objection. Controllers must notify breaches to the supervisory authority within 72 hours and restrict transfers outside the EEA to adequate countries or safeguarded mechanisms. Regulation (EU) 2025/2518 adds harmonised procedural rules for cross-border enforcement from 2 April 2027.Next: Apr 2, 2027 GDPR Procedural Regulation applies · in 5 months

EnactedVermont

Vermont VDPOSANew comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.Next: Jan 1, 2028 Vermont Data Privacy and Online Surveillance Act takes effect · in 14 months

In forceUnited States (Federal)

DOJ Bulk Data RuleProhibits U.S. persons from data brokerage and genomic-data transactions with countries of concern or covered persons, and restricts vendor, employment and investment agreements involving bulk U.S. sensitive personal data or government-related data unless CISA security requirements are met. Restricted transactions require a data compliance program, due diligence, audits, recordkeeping and reporting.In effect since Apr 8, 2025

AmendedUnited States (Federal)

FTC Health Breach Notification RuleRequires vendors of personal health records (including health and wellness apps) and PHR related entities not covered by HIPAA to notify affected individuals, the FTC and, for 500+ residents of a state, prominent media, after a breach of unsecured PHR identifiable health information. The 2024 amendments confirm that unauthorized disclosures (not just hacks) are breaches, clarify coverage of health apps drawing data from multiple sources, allow email notice, and expand notice content.In effect since Sep 24, 2009

AmendedUnited States (Federal)

HIPAASets national standards for the use and disclosure of protected health information (Privacy Rule), administrative, physical and technical safeguards for electronic PHI (Security Rule), and notification of breaches of unsecured PHI. A proposed overhaul of the Security Rule (Jan. 2025 NPRM) would make most 'addressable' specifications mandatory, require asset inventories, MFA, encryption, annual compliance audits and 72-hour restoration planning, but it is not final. The 2024 reproductive health care privacy amendments were vacated nationwide in June 2025.In effect since Apr 14, 2003

ProposedUnited States

HIPAA Security Rule update (NPRM)Proposed overhaul of the HIPAA Security Rule. It would remove the addressable versus required distinction, and require a technology asset inventory and network map, encryption, multi-factor authentication, vulnerability scanning, penetration testing and 72-hour restoration planning. No final rule has been issued.No date set

In forceNevada

Nevada consumer health data lawWashington-style consumer health data law. Regulated entities need consent to collect and share consumer health data, must publish a health data privacy policy, honor access and deletion rights, and cannot geofence health care facilities. Selling consumer health data needs written authorization.In effect since Mar 31, 2024

In forceWashington

Washington My Health My Data ActRegulated entities must publish a consumer health data privacy policy linked from their homepage and get opt-in consent to collect or share consumer health data. Selling it requires a signed authorization. Consumers get rights to access, delete and withdraw consent. Geofencing within 2,000 feet of health care facilities is banned. 'Consumer health data' is defined broadly and includes inferences from non-health data.In effect since Mar 31, 2024

Upcoming deadlines

ComplianceJan 1, 2027 · in 2 months

Connecticut Data Privacy Act (CTDPA)Data broker registration requiredData brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection ($2,500 initial fee).Connecticut

Takes effectMar 26, 2027 · in 5 months

European Health Data Space (EHDS)EHDS general application dateThe regulation applies generally from 26 Mar 2027, subject to the phased exceptions below (final article).European Union

EnforcementApr 1, 2027 · in 5 months

Maryland Online Data Privacy Act (MODPA)Discretionary 60-day cure period endsThe Division's discretionary notice-and-cure (at least 60 days) applies only to violations occurring on or before April 1, 2027 (Com. Law 14-4614).Maryland

EnforcementApr 2, 2027 · in 5 months

GDPRGDPR Procedural Regulation appliesHarmonised rules for cross-border complaint admissibility, rights to be heard and access to preliminary findings, and investigation timelines apply to DPAs from 2 April 2027 (Regulation (EU) 2025/2518, final article).European Union

Takes effectJan 1, 2028 · in 14 months

Vermont VDPOSAVermont Data Privacy and Online Surveillance Act takes effectAll obligations under Act 145 apply (sec. 4).Vermont

ComplianceOct 1, 2028 · in 23 months

Connecticut Data Privacy Act (CTDPA)Data brokers must process state deletion mechanism requestsRegistered data brokers must access the DCP accessible deletion mechanism at least every 45 days and process deletion requests.Connecticut

ComplianceMar 26, 2029 · in 2.4 years

European Health Data Space (EHDS)Primary use for first data categories; secondary use framework appliesPatient rights and EHR rules apply to patient summaries, ePrescriptions and eDispensations (Art 14(1)(a)-(c)). Chapter IV secondary-use rules (data permits, Health Data Access Bodies) apply.European Union

EnforcementJun 30, 2029 · in 2.7 years

Vermont VDPOSAMandatory 60-day cure period expiresThe AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).Vermont

ComplianceMar 26, 2031 · in 4.4 years

European Health Data Space (EHDS)Primary use for second data categories; EHR systems in service; extra secondary-use categoriesPrimary-use rules extend to medical images, lab results and discharge reports (Art 14(1)(d)-(f)). Chapter III applies to EHR systems put into service under Art 26(2). Additional secondary-use categories in Art 51(1)(b),(f),(g),(m),(p) apply.European Union

Takes effectMar 26, 2035 · in 8.4 years

European Health Data Space (EHDS)Third-country participation in secondary useArt 75(5) applies from 26 Mar 2035.European Union

Past deadlines

Takes effectOct 1 · 26 days ago

Connecticut Data Privacy Act (CTDPA)PA 26-64 (SB 4) amendments take effectProhibits controllers and third parties from selling precise geolocation data and enacts data broker and other consumer protection provisions.Connecticut

ComplianceAug 1 · 3 months ago

Connecticut Data Privacy Act (CTDPA)Profiling impact assessments applyImpact assessment requirements apply to profiling activities created or generated on or after Aug 1, 2026 (Conn. Gen. Stat. 42-522 as amended).Connecticut

Takes effectJul 1 · 4 months ago

Connecticut Data Privacy Act (CTDPA)PA 25-113 (SB 1295) amendments take effectThresholds drop to 35,000 consumers or any sensitive-data processing or data sale; expanded sensitive data, minors' protections, and LLM-training disclosure in privacy notices.Connecticut

ComplianceApr 1 · 7 months ago

Maryland Online Data Privacy Act (MODPA)MODPA applies to personal data processingThe act applies to personal data processing activities from April 1, 2026 (Section 2 of ch. 455).Maryland

ComplianceFeb 16 · 8 months ago

HIPAANotice of Privacy Practices updates (Part 2 alignment)Covered entities must update Notices of Privacy Practices under 45 CFR 164.520 for the 2024 Part 2 (substance use disorder records) changes; this NPP piece survived the Purl vacatur.United States (Federal)

Transition endsJan 1 · 10 months ago

GDPRGDPR Procedural Regulation enters into forceRegulation (EU) 2025/2518, published in the OJ on 12 December 2025, enters into force on the twentieth day after publication.European Union

Transition endsNov 26, 2025 · 11 months ago

GDPRGDPR Procedural Regulation adoptedRegulation (EU) 2025/2518 laying down additional procedural rules for cross-border GDPR enforcement signed by Parliament and Council.European Union

ComplianceOct 6, 2025 · 13 months ago

DOJ Bulk Data RuleDue diligence, audit and reporting obligations applySubpart J (data compliance program, due diligence and audits for restricted transactions) and reporting requirements in 202.1103 and 202.1104 apply.United States (Federal)

Takes effectOct 1, 2025 · 13 months ago

Maryland Online Data Privacy Act (MODPA)MODPA takes effectAct takes effect; data protection assessments apply to processing activities on or after Oct 1, 2025.Maryland

Takes effectApr 8, 2025 · 19 months ago

DOJ Bulk Data RuleProhibitions and restrictions take effectCore prohibitions on covered data transactions and security requirements for restricted transactions apply.United States (Federal)

Takes effectMar 25, 2025 · 19 months ago

European Health Data Space (EHDS)EHDS enters into forceRegulation (EU) 2025/327, published 5 Mar 2025, enters into force on the twentieth day following publication.European Union

ReportingMar 7, 2025 · 20 months ago

HIPAA Security Rule update (NPRM)Comment period closesPublic comments on the NPRM due.United States

Transition endsMar 7, 2025 · 20 months ago

HIPAASecurity Rule NPRM comment period closedComments closed on the proposed HIPAA Security Rule update (90 FR 898); OCR has not issued a final rule.United States (Federal)

MilestoneJan 6, 2025 · 22 months ago

HIPAA Security Rule update (NPRM)NPRM publishedProposed Security Rule changes published in the Federal Register.United States

ComplianceJan 1, 2025 · 22 months ago

Connecticut Data Privacy Act (CTDPA)Universal opt-out preference signals requiredControllers must honor opt-out preference signals for targeted advertising and sale (effective Jan 1, 2025).Connecticut

EnforcementDec 31, 2024 · 22 months ago

Connecticut Data Privacy Act (CTDPA)Mandatory 60-day cure period expiresAfter Dec 31, 2024, the AG is no longer required to offer a 60-day cure before enforcement; cure becomes discretionary.Connecticut

ComplianceDec 23, 2024 · 22 months ago

HIPAAReproductive health privacy compliance date (vacated)Original compliance date for the reproductive health care privacy provisions, including the attestation requirement; these provisions no longer apply after the June 2025 vacatur.United States (Federal)

Takes effectJul 29, 2024 · 2.2 years ago

FTC Health Breach Notification Rule2024 amendments effectiveAmendments clarifying health app coverage, unauthorized disclosure as breach, email notice and FTC notice timing took effect.United States (Federal)

ComplianceJun 30, 2024 · 2.3 years ago

Washington My Health My Data ActSmall businesses must complySections 4-9 apply to small businesses.Washington

Takes effectJun 25, 2024 · 2.3 years ago

HIPAAReproductive health care privacy rule effective (later vacated)The HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976) took effect; it was vacated nationwide on June 18, 2025 in Purl v. HHS (N.D. Tex.).United States (Federal)

ComplianceMar 31, 2024 · 2.6 years ago

Washington My Health My Data ActRegulated entities must complySections 4-9 (privacy policy, consent, consumer rights, sale authorization) apply to regulated entities.Washington

Takes effectMar 31, 2024 · 2.6 years ago

Nevada consumer health data lawTakes effectSection 36: act effective March 31, 2024.Nevada

Takes effectJul 23, 2023 · 3.3 years ago

Washington My Health My Data ActGeofencing ban (Section 10) effectiveBan on geofencing around health care facilities applies to all persons.Washington

Takes effectJul 1, 2023 · 3.3 years ago

Connecticut Data Privacy Act (CTDPA)CTDPA takes effectCore consumer rights and controller obligations apply.Connecticut

MilestoneJun 16, 2023 · 3.4 years ago

Nevada consumer health data lawApproved by GovernorChapter 525, Statutes of Nevada 2023.Nevada

MilestoneApr 27, 2023 · 3.5 years ago

Washington My Health My Data ActHB 1155 signedGovernor signs My Health My Data Act.Washington

Takes effectMay 25, 2018 · 8.4 years ago

GDPRGDPR appliesAll GDPR obligations apply from 25 May 2018 (Art 99(2)), replacing Directive 95/46/EC.European Union

Takes effectMay 24, 2016 · 10.4 years ago

GDPRGDPR enters into forceRegulation entered into force on the twentieth day after publication in OJ L 119 of 4 May 2016 (Art 99(1)).European Union

ComplianceFeb 22, 2010 · 16.7 years ago

FTC Health Breach Notification RuleFull compliance with original RuleFull compliance with the 2009 Health Breach Notification Rule was required.United States (Federal)