Tschider Charlotte, Compagnucci Marcelo Corrales, Minssen Timo
Beazley Institute for Health Law and Policy, Loyola University Chicago School of Law, 25 E. Pearson Street, Chicago, Il 60611 USA.
Centre for Advanced Studies in Bioscience Innovation Law, University of Copenhagen, Karen Blixens Plads 16, DK-2300 Copenhagen S.
J Law Biosci. 2024 Sep 27;11(2):lsae022. doi: 10.1093/jlb/lsae022. eCollection 2024 Jul-Dec.
In July 2023, the United States and the European Union introduced the Data Privacy Framework (DPF), introducing the third generation of cross-border data transfer agreements constituting adequacy with respect to personal data transfers under the General Data Protection Regulation (GDPR) between the European Union (EU) and the US. This framework may be used in cross-border healthcare and research relationships, which are highly desirable and increasingly essential to innovative health technology development and health services deployment. A reliable model meeting EU adequacy requirements could enhance the transfer of patient and research participant data. While the DPF might present a familiar terrain for US organizations, it also brings unique challenges. A notable concern is the ability of individual EU Member States to establish individual and additional requirements for health data that are more restrictive than GDPR requirements, which are not anticipated by the DPF. This article highlights the DPF's potential impact on the healthcare and research sectors, finding that the DPF may not provide the degree of lawful health data transfer desirable for healthcare entities. We examine the DPF against a background of existing Health Insurance Portability and Accountability Act obligations and other GDPR transfer tools to offer alternatives that can improve the likelihood of reliable, lawful health data transfer between the US and EU.
2023年7月，美国和欧盟推出了数据隐私框架（DPF），引入了第三代跨境数据传输协议，这些协议构成了欧盟与美国之间在《通用数据保护条例》（GDPR）项下个人数据传输方面的充分性认定。该框架可用于跨境医疗保健和研究关系，这对于创新健康技术开发和健康服务部署非常必要且日益重要。一个符合欧盟充分性要求的可靠模式可以促进患者和研究参与者数据的传输。虽然DPF对美国组织来说可能是一个熟悉的领域，但它也带来了独特的挑战。一个值得关注的问题是，欧盟个别成员国可能会对健康数据制定比GDPR要求更严格的单独和额外要求，而DPF并未预料到这一点。本文强调了DPF对医疗保健和研究部门的潜在影响，发现DPF可能无法为医疗保健实体提供理想的合法健康数据传输程度。我们在现有《健康保险流通与责任法案》义务及其他GDPR传输工具的背景下审视DPF，以提供替代方案，提高美国和欧盟之间可靠、合法的健康数据传输的可能性。
