Clinical trials collect some of the most sensitive personal data in existence: medical diagnoses, genetic information, drug responses, adverse events, and patient identifiers linked to health outcomes. In the United States, this data is protected by HIPAA. In Europe, it falls under GDPR. In multinational trials that enroll patients at both US and EU sites, both regulatory frameworks apply simultaneously, and they do not map neatly onto each other. Ensuring compliance requires careful contract drafting and data management planning at the trial design stage, not after enrollment begins.

At Lopes Law LLC, Anthony Lopes, Esq. reviewed and negotiated clinical trial agreements and confidentiality agreements at Merck’s clinical trials launch department through CRO PRA Pharmaceuticals. Data privacy compliance in clinical trials is an area where we have direct operational experience, not just academic familiarity.

How Do HIPAA and GDPR Apply Differently to Clinical Trials?

HIPAA’s Privacy Rule applies to covered entities (hospitals, clinics, health plans) and their business associates when they handle protected health information (PHI) of US patients. A clinical site that is a hospital or medical practice is typically a covered entity. When that site shares patient data with a CRO or sponsor, HIPAA requires a Business Associate Agreement (BAA).

GDPR applies to the personal data of EU data subjects whenever that data is processed, regardless of where the processing occurs. If a US sponsor processes data from EU patients enrolled at EU sites, GDPR applies to that processing even though the sponsor is physically located in the US. The legal basis for processing sensitive health data under GDPR (Article 9) must be identified: for clinical trials, the most common bases are explicit consent and substantial public interest in the area of public health or scientific research (Article 9(2)(i) and (j)).

Key practical differences: HIPAA uses an “authorization” concept for patient consent to data use, while GDPR requires consent to meet specific standards (freely given, specific, informed, unambiguous). HIPAA breach notification must occur within 60 days of discovery; GDPR requires notification to the supervisory authority within 72 hours. Data subject rights under GDPR (access, rectification, erasure, portability) go further than HIPAA patient rights, though clinical research exceptions limit some rights in the trial context.

The financial consequences of non-compliance differ significantly between the two frameworks. HIPAA civil penalties range from $100 to $50,000 per violation, with annual maximums of $1.5 million per violation category. GDPR fines can reach 20 million euros or 4% of annual worldwide turnover, whichever is higher. For a multinational sponsor running trials across both US and EU sites, a single data breach affecting both populations could trigger separate enforcement actions under both frameworks, each with its own penalty structure. At Lopes Law LLC, we structure clinical trial agreements to address both regulatory regimes independently, ensuring that compliance measures satisfy the more stringent standard at each level.

Data retention timelines add another layer of complexity. HIPAA requires covered entities to retain certain records for at least 6 years from the date of creation or last effective date. GDPR Article 5(1)(e) requires that personal data be kept no longer than necessary for the purposes of processing, but clinical trial regulations (such as ICH E6 GCP) typically require retaining trial data for at least 15 to 25 years after the trial concludes. The Clinical Trial Agreement must reconcile these overlapping retention periods and specify which party is responsible for maintaining the data at each phase.

What Contracts Must Be in Place for Clinical Trial Data Privacy?

For HIPAA compliance, a Business Associate Agreement (BAA) is required between the covered entity clinical site and any business associate that receives PHI: the CRO, the sponsor (if not itself a covered entity), data management vendors, and biostatistical analysis firms. The BAA must specify permitted uses and disclosures, required safeguards, breach notification obligations, and the requirement to flow BAA obligations down to any subcontractors that receive PHI.

For GDPR compliance, Article 28 requires a Data Processing Agreement (DPA) whenever a processor handles personal data on behalf of a controller. The DPA must specify: the subject matter, duration, nature, and purpose of processing; the type of personal data and categories of data subjects; the controller’s obligations and rights; and specific provisions from Article 28(3) including confidentiality, security measures, subprocessor restrictions, and assistance with data subject requests.

For international data transfers, Standard Contractual Clauses (SCCs) are required when EU personal data is transferred to the US (which is not on the EU’s adequacy list unless the receiving entity is certified under the EU-US Data Privacy Framework). The 2021 SCCs have four modules depending on the controller/processor relationship; the correct module must be used. At Lopes Law LLC, we review data flow maps and contract structures for multinational trial sponsors to ensure the correct agreements are in place before data begins flowing.

What Patient Consent Issues Arise in Cross-Border Trials?

Informed consent forms (ICFs) in multinational trials must satisfy both HIPAA authorization requirements and GDPR consent requirements. These are different legal concepts with different elements. A HIPAA authorization must include specific elements under 45 CFR 164.508, including a description of PHI to be used or disclosed, identification of who will use or disclose it, purpose, expiration date, and the patient’s right to revoke. A GDPR consent under Article 7 must be freely given, specific, informed, and unambiguous, with a clear affirmative act.

The right to withdraw consent under GDPR (Article 7(3)) creates a tension in clinical trials: withdrawal of consent should not affect the lawfulness of processing already done before withdrawal, and the ICF must explain that certain data uses (such as safety reporting) may not be reversible even after withdrawal. The ICF must be carefully drafted to explain this limitation accurately while still meeting GDPR’s transparency requirements.

De-identification presents another cross-border complication. HIPAA has two de-identification standards: Safe Harbor (removing 18 specific identifiers) and Expert Determination. Data that meets HIPAA’s Safe Harbor standard may still constitute personal data under GDPR if it is reasonably linkable to an individual using additional information available to the processor. EU standards for anonymization are more demanding than HIPAA’s Safe Harbor, and sponsors must analyze EU site data under both frameworks.

How Should Sponsors Manage Data Security in Multinational Trials?

Both HIPAA and GDPR require appropriate technical and organizational security measures for clinical data. HIPAA’s Security Rule (45 CFR Part 164, Subpart C) requires covered entities and business associates to implement administrative, physical, and technical safeguards. GDPR Article 32 requires measures appropriate to the risk, which typically includes encryption, pseudonymization, access controls, and documented security procedures.

In practice, this means: clinical data systems (EDC, CTMS, IRT/RTSM) must have role-based access controls limiting data access to authorized personnel; data transmitted between sites, CROs, and sponsors must be encrypted; audit logs must record who accessed what data and when; and breach detection and response procedures must be documented and tested. The CRO service agreement and clinical trial agreement must allocate security responsibilities clearly between the parties.

Encryption standards in clinical trials should meet or exceed AES-256 for data at rest and TLS 1.2 or higher for data in transit. GDPR Article 32 does not prescribe specific encryption standards, but EU data protection authorities have treated strong encryption as a baseline expectation for health data. From a contract drafting perspective, the Clinical Trial Agreement should specify minimum encryption requirements rather than relying on vague language like “appropriate security measures.” Specifying the standard in the contract gives both parties a clear, enforceable benchmark.

Pseudonymization is an important tool for reducing risk in multinational clinical trials. Under GDPR, pseudonymized data is still personal data (because it can be re-identified using the key), but pseudonymization reduces the severity of a data breach because the exposed data cannot be linked to individuals without the pseudonymization key. The CTRA should allocate responsibility for maintaining the pseudonymization key and specify who has access to it. At Lopes Law LLC, we recommend that sponsors hold the pseudonymization key separately from the CRO’s data management systems, so that a breach at the CRO does not expose both the data and the re-identification key simultaneously.

Vendor management is a frequently overlooked security issue. Clinical trials involve numerous subcontractors: central laboratories, imaging vendors, interactive response technology (IRT) providers, electronic patient-reported outcomes (ePRO) platforms, and biostatistics firms. Each vendor that handles patient data must be covered by a BAA (for US data) or a DPA (for EU data). The sponsor’s data flow map should identify every vendor that touches patient data and confirm that the appropriate agreements are in place before data begins flowing. At Lopes Law LLC, we review data flow maps and vendor agreements as part of our clinical trial contract review process.

What Happens When a Clinical Trial Has a Data Breach?

Under HIPAA, a breach of unsecured PHI must be reported to affected individuals, to the HHS Office for Civil Rights, and (for breaches affecting more than 500 individuals in a state) to prominent local media. The covered entity has 60 days from discovery to notify. Under GDPR, a personal data breach that poses a risk to individuals must be reported to the competent supervisory authority within 72 hours of becoming aware of it, and to affected individuals if the breach is likely to result in a high risk to their rights and freedoms.

The 72-hour GDPR deadline creates a challenging operational timeline. Clinical trial sponsors must have breach detection and response plans in place before enrollment begins. The CTRA and BAA/DPA must clearly allocate breach notification responsibilities between the site, the CRO, and the sponsor so that the relevant party can act within the required timeframe.

Consider a scenario where a clinical site’s electronic health record system is breached and trial subject data is exposed. The site is a HIPAA covered entity with a 60-day notification timeline. But the same breach also involves EU patients enrolled at affiliated EU sites, and those patients’ data is subject to GDPR’s 72-hour timeline. If the site notifies the sponsor on day 3, the sponsor may already be out of time for GDPR reporting. The CTRA must require immediate breach notification from the site to the sponsor regardless of the HIPAA timeline.

At Lopes Law LLC, we advise sponsors to include a contract provision requiring sites to notify the sponsor within 24 hours of discovering any potential data breach, independent of the applicable regulatory reporting timeline. This ensures the sponsor has adequate time to assess and fulfill its own reporting obligations.

For multinational sponsors managing trials across 5 or more countries, the cost of non-compliance can quickly exceed the cost of proper contract drafting. A single GDPR enforcement action resulting in a fine of 500,000 euros or more dwarfs the legal fees required to implement compliant BAAs, DPAs, and SCCs across all trial sites at the outset.

Reach out, we are friendly. Call now for a free consultation at (267) 777-9117.

This article is for informational purposes only and does not constitute legal advice. Consult a licensed attorney before making any legal decisions.

Related reading: Pharmaceutical NDAs | Clinical Trial Agreements | GDPR and US Business Contracts