Supporting a Medical Device Start-Up from HIPAA to GDPR to China’s PIPL

Challenge

A medical device start-up, on the cusp of launching an innovative technology enabling health-monitoring data sharing between individuals and their healthcare providers, was approached by 2 global biotech organizations that expressed interest in leveraging the technology for clinical trials across multiple jurisdictions.

Key issues included:

GDPR & PIPL: The need to quickly get up to speed on GDPR, China’s PIPL, and requirements around international data transfers of health data.
HIPAA: An interest in proactively evaluating its operations against HIPAA requirements to demonstrate its commitment to safeguarding sensitive health information.
A Lean Team: focused on product development not regulatory compliance and data protection laws.

Solution

The DPS Privacy team collaborated closely with the founders to understand the operational nuances of the technology, the clinical trial space, and the specific requirements of their global clients.

We provided a clear roadmap that brought their small team up to the level of their global clients, without overwhelming an organization focused on innovation and growth:

Global Data Transfer Strategy: We developed a tailored approach for managing cross-border data flows, ensuring alignment with the EU-US Data Privacy Framework and other applicable data transfer mechanisms, taking data localization requirements into account.
HIPAA Comparative Analysis: Though not directly covered by HIPAA, we mapped data practices against HIPAA’s privacy and security standards, identifying potential areas for improvement to meet expectations:
- Data Safeguards Review: Validated encryption protocols, access controls, and pseudo-anonymization practices.
- Risk Management Alignment: Constructed a simplified version of a HIPAA-compliant risk management process, tailored to the start-up's resource constraints and focused on high-risk areas.
- Vendor Management: Assisted in implementing a light-weight vendor risk management program to ensure that any third-party partners handling health data followed HIPAA-aligned privacy and security practices.
Practical, Scalable Privacy Governance:
- Notice & Policies: Drafted website and study-participant privacy notices; internal policies for conducting DPIAs, managing data retention, and processing personal data; and Data Processing Agreements to use with all vendors.
- Privacy by Design Framework: Introduced a streamlined Privacy by Design approach that could be easily integrated into the product development lifecycle, enabling the start-up to scale its privacy compliance efforts as the technology evolved.
- Employee Training and Awareness: Developed a concise, role-specific privacy training program to ensure all team members understood their responsibilities under global privacy regulations, including GDPR and HIPAA.

Results

By implementing these strategies, the start-up was able to confidently demonstrate compliance to its global partners and mitigate the risk of regulatory scrutiny.

DPS Privacy Advisors continues to provide Privacy Expert on Demand support as the start-up continues to secure contracts with multinational biotechnology companies and expand their technology’s reach in global clinical trials, without sacrificing innovation or agility.