privacy data-protection health data-ownership hipaa
United States HIPAA and New Zealand HISO from outside these countries
<p>We are developing a software product for storing and managing health records in Australia, with the software product primarily targeted towards Australian healthcare organisations. This requires us to be compliant with the Australian Privacy Principles among other things.</p>
<p>I have two questions that are not immediately clear to me:</p>
<ol>
<li><p>This is a SaaS product, where end users sign up themselves. If someone from the United States or New Zealand sign up, and we end up inadvertently storing data from patients who reside in these countries, are we violating any rules? Or is it a best practise to ensure this is not possible?</p>
</li>
<li><p>If we wish to willingly engage with customers from these countries, must we also comply with their local healthcare codes of practise? I.e. if we wish to additionally target customers in New Zealand or the United States, is it also now a requirement we adhere to HIPAA, HISO (and all other mandated requirements) despite the fact that we are an Australian incorporated company?</p>
</li>
</ol>

<h2>You have to comply with the law everywhere you operate</h2>

<p>If you have US, NZ or Iraqi customers (knowingly or not) you have to comply with the laws of the US, NZ and Iraq.</p>
