Do health data rules apply to an importer?
Short answer
Yes when importing products that carry health records, and for the service records the importer keeps.
Read against the registers 2026-08-26.
Who the role is
Whoever places a product from outside the union on the union market steps into the manufacturer's line of duties.
What the topic covers
Health records are a special category everywhere, but the boundary differs. The GDPR follows the data. HIPAA follows the covered entity. PIPL follows the sensitive category and asks for separate consent.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Health data is a special category: processing needs a condition in addition to the legal basis.
United States
- HIPAA Security Rule: Applies to covered entities and business associates, with administrative, physical and technical safeguards.
China
- Personal Information Protection Law of the People's Republic of China: Health data is sensitive personal information: separate consent and a necessity assessment apply.
Where companies usually start
- Decide first whether you are a covered entity in the US sense, then read the EU and Chinese tests separately.
- Write the necessity assessment before the product decision, not after it.
- Keep access logs for health records apart from general application logs.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for importer
- Do ai governance rules apply to an importer?
- Do personal data rules apply to an importer?
- Do cross-border data rules apply to an importer?
- Do cybersecurity rules apply to an importer?
- Do online platforms rules apply to an importer?
- Do consumer rights rules apply to an importer?
- Do product safety rules apply to an importer?
- Do climate disclosure rules apply to an importer?
- Do export controls rules apply to an importer?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
