GDPR & HIPAA Compliance in Backend Systems

1. GDPR vs HIPAA: A Quick Comparison

2. Foundational Principles for Compliant Backends

A compliant backend must embed these principles into its architecture: Data Minimization – collect only necessary fields. Purpose Limitation – use data only for declared purposes. Storage Limitation – enforce retention policies. Integrity & Confidentiality – encryption, access logs. Accountability – demonstrate compliance through documentation and logs.

3. Encryption Strategies

Both regulations require strong encryption. For data at rest, use AES-256 for databases and file storage. For data in transit, enforce TLS 1.3. Additionally, consider field‑level encryption for sensitive fields (e.g., SSN, medical records) so that database administrators cannot read plaintext.

const crypto = require('crypto');

const algorithm = 'aes-256-gcm';
const secretKey = process.env.ENCRYPTION_KEY; // 32 bytes

function encrypt(text) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv(algorithm, secretKey, iv);
  let encrypted = cipher.update(text, 'utf8', 'hex');
  encrypted += cipher.final('hex');
  const authTag = cipher.getAuthTag();
  return { encrypted, iv: iv.toString('hex'), authTag: authTag.toString('hex') };
}

function decrypt(encrypted, ivHex, authTagHex) {
  const iv = Buffer.from(ivHex, 'hex');
  const authTag = Buffer.from(authTagHex, 'hex');
  const decipher = crypto.createDecipheriv(algorithm, secretKey, iv);
  decipher.setAuthTag(authTag);
  let decrypted = decipher.update(encrypted, 'hex', 'utf8');
  decrypted += decipher.final('utf8');
  return decrypted;
}

4. Role‑Based Access Control (RBAC) & MFA

Backend systems must implement least‑privilege access. Use RBAC to assign roles (admin, clinician, auditor, data subject). Enforce multi‑factor authentication (MFA) for any account accessing PHI or personal data. Log every access attempt.

enum Role {
  PATIENT = 'patient',
  DOCTOR = 'doctor',
  ADMIN = 'admin',
  AUDITOR = 'auditor'
}

const rolePermissions = {
  [Role.PATIENT]: ['read:self'],
  [Role.DOCTOR]: ['read:patients', 'write:prescriptions'],
  [Role.ADMIN]: ['*'],
  [Role.AUDITOR]: ['read:logs']
};

function authorize(requiredPermission: string) {
  return (req, res, next) => {
    const user = req.user; // set by auth middleware
    if (!user) return res.status(401).send();
    const permissions = rolePermissions[user.role];
    if (permissions.includes('*') || permissions.includes(requiredPermission)) {
      next();
    } else {
      // Log unauthorized access attempt
      createAuditLog({ userId: user.id, action: 'unauthorized_access', resource: req.path });
      res.status(403).send('Forbidden');
    }
  };
}

5. Audit Logging: Who Did What, When

HIPAA explicitly requires audit logs for all access to PHI (creation, reading, updating, deletion). GDPR requires logs for high‑risk processing. Logs must be tamper‑evident, immutable, and retained for a defined period (e.g., 6 years for HIPAA). Use a write‑once storage (e.g., AWS S3 Object Lock, append‑only database table) and sign log entries.

model AuditLog {
  id         String   @id @default(cuid())
  userId     String?  // who performed action
  action     String   // e.g., 'READ_PHI', 'UPDATE_PATIENT'
  resource   String   // e.g., 'PatientRecord/123'
  ipAddress  String?
  userAgent  String?
  details    Json?    // additional context
  createdAt  DateTime @default(now())
  signature  String?  // HMAC signature for tamper detection

  @@index([createdAt])
  @@index([userId])
}

const crypto = require('crypto');
const hmacSecret = process.env.AUDIT_HMAC_SECRET;

async function logAuditEvent({ userId, action, resource, details }) {
  const entry = { userId, action, resource, details, timestamp: new Date().toISOString(), ip: req.ip };
  const signature = crypto.createHmac('sha256', hmacSecret).update(JSON.stringify(entry)).digest('hex');
  await prisma.auditLog.create({ data: { ...entry, signature } });
}

6. Data Minimization and Anonymization

GDPR encourages pseudonymization and anonymization. For analytics or secondary purposes, remove direct identifiers. For testing environments, use synthetic data or tokenization.

const crypto = require('crypto');

function pseudonymize(email) {
  const salt = process.env.PSEUDO_SALT;
  return crypto.createHash('sha256').update(email + salt).digest('hex');
}
// Store the hash instead of the email in analytics tables.

7. Right to Erasure & Automated Retention

GDPR grants individuals the right to have their data deleted (“right to be forgotten”). Backend systems must support secure deletion (cascading to related records, but not destroying audit logs). Implement a retention policy that automatically deletes or anonymizes data after a defined period.

-- Add a deletedAt column
ALTER TABLE users ADD COLUMN deletedAt TIMESTAMP;

-- Scheduled job (cron) to hard delete records older than 30 days
DELETE FROM users WHERE deletedAt IS NOT NULL AND deletedAt < NOW() - INTERVAL '30 days';

8. Breach Detection & Notification

Both regulations require notification to authorities and affected individuals within strict timelines. Build automated alerts for suspicious patterns: multiple failed logins, access from unusual IPs, bulk data export. Use security information and event management (SIEM) to correlate logs.

// Middleware that counts records accessed per user in 5 minutes
const accessCounts = new Map();

app.use('/api/patients', (req, res, next) => {
  const userId = req.user.id;
  const now = Date.now();
  const windowStart = now - 5 * 60 * 1000;
  const userAccesses = accessCounts.get(userId) || [];
  const recent = userAccesses.filter(t => t > windowStart);
  if (recent.length > 100) {
    // Potential breach – trigger alert and block
    sendAlert(`User ${userId} accessed ${recent.length} records in 5 min`);
    return res.status(429).send('Rate limit exceeded');
  }
  recent.push(now);
  accessCounts.set(userId, recent);
  next();
});

9. DSAR: Responding to Data Subject Requests

Under GDPR, individuals can request a copy of their data (DSAR). Backend systems must provide an efficient way to export all personal data in a machine‑readable format (JSON, CSV) within 30 days. Design a data export service that collects data from all related tables.

app.get('/api/dsar/export', authorize('read:self'), async (req, res) => {
  const userId = req.user.id;
  const user = await prisma.user.findUnique({ where: { id: userId }, include: { posts: true, orders: true } });
  const exportData = {
    profile: { name: user.name, email: user.email, createdAt: user.createdAt },
    posts: user.posts,
    orders: user.orders
  };
  res.setHeader('Content-Disposition', 'attachment; filename="personal-data.json"');
  res.json(exportData);
});

10. SDLC for Compliance

Embed compliance into your development process:

• Threat modeling – identify privacy risks (e.g., data leakage through logs).
• Static analysis – scan for hardcoded secrets, SQL injection.
• Dynamic scanning – OWASP ZAP for vulnerabilities.
• Dependency scanning – Snyk to find known vulnerabilities in libraries.
• Penetration testing – annual third‑party audit.

11. Vendor & Third‑Party Compliance

If you use cloud providers (AWS, Azure, GCP) or subprocessors (analytics, support tools), you must have Business Associate Agreements (HIPAA) or Data Processing Agreements (GDPR). Validate that they offer HIPAA‑eligible services or GDPR compliance features (e.g., data residency, deletion capabilities).

12. Database Design Patterns

Separate identifiable data from sensitive clinical/transactional data using tokenization or reference tables. Example: store patient name, SSN in a “pii” table with a token, and refer to that token in clinical records. This limits exposure.

CREATE TABLE pii_tokens (
  token UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  ssn VARCHAR(11),
  full_name VARCHAR(200),
  created_at TIMESTAMP
);

CREATE TABLE clinical_records (
  id SERIAL PRIMARY KEY,
  patient_token UUID REFERENCES pii_tokens(token),
  diagnosis TEXT,
  treatment TEXT
);

13. Monitoring & Alerting for Compliance

Implement real‑time monitoring for:

• Failed login attempts (brute force)
• Access to sensitive data outside business hours
• Export of large volumes of data
• Changes to audit log configuration

14. Backend Compliance Checklist

15. Consequences of Non‑Compliance

Fines are substantial and increasing. In 2025, Meta was fined €1.2B for GDPR violations. Healthcare providers have paid millions for HIPAA breaches (e.g., $16M for a ransomware attack affecting 2.5M patients). Beyond fines, loss of customer trust and business licenses can be fatal. Implementing the controls above is not optional; it's a business necessity.