My website collects health information — which privacy rules apply?
The short answer
Stricter ones. Health information is treated as especially sensitive almost everywhere: in the EU and UK it’s a special category of personal data that needs a specific legal basis; in Australia, health service providers are covered by the Privacy Act whatever their size; and in the US, HIPAA applies to healthcare providers, health plans and the businesses that handle health data for them.
Applies in EU · UK · Australia · US
- EU and UK (GDPR Art. 9): processing health data is banned unless an exception applies, such as explicit consent or providing health or social care.
- Australia: the small business exemption doesn’t apply to businesses that provide a health service and hold health information.
- US (HIPAA): covered entities and their business associates need risk analyses, safeguards and signed business associate agreements with vendors that handle health information.
Practical steps
- Keep health details out of ordinary contact forms, emails and notifications.
- Only use providers that will sign the agreements your law requires.
- Encrypt health data and limit who can see it.
SlopDox provides compliance assistance only. This is general information to help you prepare — not legal advice, and no guarantee that a law does or doesn’t apply to you. For decisions, speak to a qualified lawyer.
Words used here
- Sensitive data
- Extra-protected personal data such as health, ethnicity, religion, sexuality or biometrics. Stricter rules and bigger penalties apply.
- HIPAA (United States)
- US law protecting health information handled by healthcare providers, insurers and the companies that serve them.
- Australian Privacy Act
- Australia’s main privacy law, built around 13 Australian Privacy Principles. Health businesses are covered whatever their size.
- Encryption at rest
- Stored data is scrambled so it’s unreadable if a disk or backup is stolen. Most modern providers switch it on by default — check, and record it here.
Still have a question?
Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.