european-union health encryption
EU regulation for medical device communication encryption
<p>In the US, HIPAA mandates that data communication with patient or healthcare data must be done according to FIPS 140-2 (<a href="http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf" rel="nofollow noreferrer">pdf</a>). E.g. use AES encryption with 128 bit keys or greater to encrypt.</p>

<p>Are there corresponding healthcare/encryption regulations in the EU? What are they?</p>

<h1>Current Law</h1>
<p>There is currently no specific law mandating encryption for healthcare data communication. This is not because it isn't desired, but because the applicable law in question—the <em><a href="https://en.wikipedia.org/wiki/Data_Protection_Directive" rel="nofollow noreferrer">Data Protection Directive</a></em> (DPD)—is written in a <strong>technology neutral</strong> manner. In particular, <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:31995L0046" rel="nofollow noreferrer">Article 17 (1)</a> states:</p>
<blockquote>
<p>Member States shall provide that the controller must implement <strong>appropriate technical and organizational measures</strong> to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.</p>
</blockquote>
<p>Additionally, health data is included as a type of data given additional safeguards in Article 8.</p>
<p>For additional analysis, see <a href="https://spamina.com/en/uploads/productos/cloud-email-encryption-dlp/whitepaper-encryption-law.pdf" rel="nofollow noreferrer">this Spamina paper (PDF)</a> on the subject. In particular they note that Italy and Spain <em>have</em> mandated encryption of sensitive data in their implementations of the DPD. I personally don't want to spend more time on this law because...</p>
<h1>The Data Protection Directive is about to be repealed</h1>
<p>It was passed in 1995 and the <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" rel="nofollow noreferrer">General Data Protection Regulation</a> (GDPR) passed in 2016 is going to take effect on May 25, 2018 and will repeal the Data Protection Directive. As a regulation, it will have <a href="https://law.stackexchange.com/a/7858/3209">immediate binding effect</a> and the law will be harmonized across the Union.</p>
<p>Like the DPD, the GDPR is technology neutral, but unlike the DPD it specifically mentions encryption as a means of fulfilling some of its requirements. Encryption may in fact be the simplest way of doing so as the requirements and penalties are strict. In particular, I would like to call out the <a href="http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679" rel="nofollow noreferrer">following articles</a>:</p>
<p>Article 6 (4), noting that &quot;processing&quot; is defined broadly, including transmission:</p>
<blockquote>
<p>Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject's consent [...]  the controller shall [...] take into account, inter alia: [...]</p>
<p>(e) the existence of appropriate safeguards, which may include encryption or <a href="https://en.wikipedia.org/wiki/Pseudonymization" rel="nofollow noreferrer">pseudonymisation</a>.</p>
</blockquote>
<p>Article 32 (1) on security of data processing:</p>
<blockquote>
<p>[...] the controller and the processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:</p>
<p>(a) the pseudonymisation and encryption of personal data; [...]</p>
</blockquote>
<p>Article 34 requires that in the event of a data breach, those affected are notified except when:</p>
<blockquote>
<p>[...] the controller has implemented appropriate technical and organisational protection measures, [...] in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption; [...]</p>
</blockquote>
<p>Note that all this is generic to <em>all</em> personal data, though again, health data is given additional safeguards in the GDPR in Article 9.</p>
<p>And then there are the penalties that everyone is worried about. Depending on the type of violation, there may be under Article 83 (4) &quot;fines up to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.&quot; Encryption is a way of ensuring that should a data breach occur, these fines are avoided or at the very least significantly lessened.</p>
