For HIPAA, Does US Patient Data Have To Stay On US Servers? For an application that stores US patient data, does HIPAA require that US data stays on US servers?
No. This is governed by the HIPAA Security Rule which was a regulation that the HIPAA statute required the Department of Health and Human Services to adopt. The Rule does require someone covered by HIPAA to have a "Business Associate Agreement" (BAA) and a Service Level Agreement (SLA) with any cloud storage provider (which would be the usual way that a U.S. health care provider subject to HIPAA would have a foreign server), but the Rule does not require that a server be physically located in the United States. The lack of this requirement is a good one, because when you are transmitting data (which the Security Rule requires be done in a secure fashion), you can't know which servers the information will end up on in a trip from source to destination. Email and all other Internet content travels through what amounts to a pony express. It goes through a variety in intermediate server nodes which can change during the course of a session, and generally speaking, you never know which intermediate nodes are used. You could be seeing this answer via a server in China, for example, and you would never know it.
The GDPR actually does require you to follow DNT in Article 21: In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using technical specifications. I think this is quite explicit.
As stated by GDPR article 3 you are required to follow it under the following circumstance: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union. You can read the recourse better at What is the legal mechanism by which the GDPR might apply to a business with no presence in the EU?, but in short the US will allow the EU court to press it's rulings due to wanting to keep its trades, treaties and other similar things in place.
There is nothing in the GDPR requiring you to collect individual personally identifiable information. If the website has no need, and the website owner no desire, to collect such information, there is no requirement to do so. The GDPR requires that if such information is collected, that there is a lawful basis, and that it be handled appropriately and stored securely, and deleted when there is no longer a need to retain it, or on a proper request. If no such information is collected in the first place, all the rules about how to handle it do not apply. It is possible that some law of an individual country in the EU might mandate collection of some particular information, but I have not heard of any such requirement.
It doesn’t make you exempt from the GDPR if that’s what you’re asking The hash you produce is linked to one (or a small number) of computers and it therefore serves as an ID number. Because that ID number is linked to the owner of the computer it is personal information and if you are collecting it, you must comply with the requirements of the GDPR - valid legal reason, deletion when no longer required, deletion on request, data security etc.
Yes. It is legal for them to do so. Also, they are often required, by their insurers and lawyers, if not as a matter of law, to maintain them for seven years in most cases, so that the information is available if a lawsuit arises from any of their dealings with you (e.g. if they receive notice of a lawsuit involving a Zipcar you were allegedly using or had under your control at the time of an accident, or if there is a class action lawsuit over alleged breach of contract or consumer laws involving their charges to you). There are virtually no circumstances, with the possible exception of certain credit card account information, when someone has a duty to destroy records maintained about you under U.S. law. In this particular instance, everything on your driver's license is a matter of public record in any case, so your privacy interest is reduced for this reason as well.
Is this limitation enforceable? Sure it is; you agree to a TOS or EULA with the company to use the API, and that's a legally binding contract. If the contract stipulates limits to caching, that's enforceable in civil court by lawsuit (possibly criminal court, which will depend on jurisdiction). What if the end-user is the one caching the data on their end? If your end users might be caching, that's something you may need to outline in your own TOS/EULA to adhere to the API's stipulations. And, the API may not allow you to serve API data to your own users; read it and see. the information provided by the API is not proprietary,... That doesn't matter; you're using their API and service. If you don't like that, you need to write your own API or develop your own queries for the information. I'm designing a web application that will make use of a (non-free) third-party API. If that App is going to be distributed and used by others, talk to a lawyer about the API and have them write a TOS/EULA for your App; you run the risk of significant legal liability with a publicly distributed App that uses someone else's API, paid or free.
In this statement of &quot;Patient Rights &amp; Responsibilities from Nash UNC it is said that: A patient has the right to know the names and the jobs of his or her caregivers. But I do not find any actual law that establishes such a right. Hospitals usually have a policy that doctors and other caregivers must wear name-tags and identify themselves to patients, but that does not necessarily apply to questions after the fact, nor can I be sure that any law mandates such a policy.