Which compliance regime applies? A decision guide

Last reviewed: 2026-06-29 — see the freshness policy.

Learning objectives

After this chapter you will be able to:

• Determine which compliance regimes apply to a given HLS system in one pass.
• Combine segment, jurisdiction, and data-type answers into a concrete control set.
• Use this guide as the entry point to the detailed chapters, not a replacement for them.

Why this chapter exists

Parts 3's chapters — HIPAA, HITRUST, GxP, GDPR, de-identification, and regional compliance — are each excellent on their own regime. What's missing is the thirty-second triage: given a real system, which of these actually apply, and in what combination? This chapter is that triage — a decision tree you run once at the start of discovery, then dive into the relevant chapters for depth.

The decision tree

flowchart TD
  Start["What kind of data/system is this?"] --> Q1{"Does it touch\nindividually identifiable\nhealth data (PHI)?"}
  Q1 -->|No| Skip["No health-privacy regime —\nstill check general privacy law\n(GDPR/PIPEDA/PDPA if personal data)"]
  Q1 -->|Yes| Q2{"Which segment?\n(see industry map)"}

  Q2 -->|Provider / payer / digital health| Q3{"Which jurisdictions'\npatients/users?"}
  Q2 -->|Pharma/biotech R&D,\nmanufacturing, trials| GxP["GxP + 21 CFR Part 11\n(data integrity, ALCOA+)"]
  Q2 -->|Medical device / SaMD| Device["FDA SaMD pathway\n(510k/De Novo/PMA)\n+ regional device regs"]

  Q3 -->|US| US["HIPAA + state law\n(+ 42 CFR Part 2 if SUD)"]
  Q3 -->|Canada| CA["PIPEDA + provincial\n(PHIPA, Law 25...)"]
  Q3 -->|EU/EEA| EU["GDPR Art. 9 + member state\n+ EHDS (forward-looking)"]
  Q3 -->|UK| UK["UK GDPR + NHS DSPT\n(if NHS data)"]
  Q3 -->|APAC| APAC["Market-specific:\nJP PMDA, AU TGA, SG PDPA"]

  US & CA & EU & UK & APAC --> Q4{"Does it use\nAI/ML?"}
  GxP --> Q4
  Device --> Q4

  Q4 -->|Yes, in certified US health IT| HTI1["+ ONC HTI-1\n(Predictive DSI, FAVES)"]
  Q4 -->|Yes, in the EU| AIAct["+ EU AI Act\n(high-risk if a device)"]
  Q4 -->|No| Cert["Consider HITRUST\nas a certification layer"]
  HTI1 --> Cert
  AIAct --> Cert

Worked triage examples

How to use this in discovery

1. Run the tree once per system, not once per company — a single platform can straddle multiple branches (the trial-EDC example above hits both GxP and GDPR).
2. List every regime the tree surfaces in your requirements summary as a distinct NFR, not a single "must be compliant" line.
3. Go deep on each hit. This chapter tells you which regimes apply; the dedicated chapters tell you what to build.
4. Re-run after scope changes. Adding an AI feature, a new country's users, or a new data type (e.g. adding genomic data to a clinical platform) can add a branch.
5. When in doubt, escalate to compliance/legal — this tree is a triage tool for an SA, not a substitute for counsel on a genuinely ambiguous case.

This is exactly the exercise the capstone grades on its "Compliance" dimension — practice it there before you need it live.

This guide answers "which rules bind us?" For the questions no regulation answers — where a design is permitted but still wrong — see Ethics in health informatics & AI.

Check yourself

1. A US pharma company runs a trial with sites in Germany. Walk the tree — which two regimes both apply, and why is it "both," not "whichever is stricter"?
2. An AI-enabled diagnostic imaging device is sold in both the US and the EU. Which device pathway and which AI-transparency regime apply in each market?
3. Why should you re-run this tree when a product adds an AI feature, even if the underlying data hasn't changed?

Further reading

• HIPAA · HITRUST · GxP & 21 CFR Part 11
• GDPR & data residency · Regional compliance
• EU AI Act & global AI regulation · FDA SaMD & GMLP