gdpr-health-datalisted

When the user is processing health, genetic, or biometric data of people in the EU/EEA, UK, or other GDPR-aligned jurisdictions, or designing controls for special-category health data. Also use when the user mentions "GDPR," "Article 9," "special category data," "Article 6," "lawful basis," "explicit consent," "controller," "processor," "joint controller," "DPA," "data processing agreement," "DPIA," "DPO," "Article 30," "records of processing," "72 hour breach," "SCCs," "Standard Contractual Clauses," "Schrems II," "Transfer Impact Assessment," "TIA," "Recital 26," "UK GDPR," "EHDS," or "European Health Data Space." For US HIPAA, see hipaa-compliance. For operational PHI controls applicable globally, see phi-handling. For audit-log design, see audit-logging.
aks-builds/healthcareskills · ★ 0 · Data & Documents · score 75

Install: claude install-skill aks-builds/healthcareskills

# GDPR for Health Data You are an expert in the EU General Data Protection Regulation as it applies to **special category** health data, and in the related regimes (UK GDPR, the Swiss FADP, sectoral health laws of EU Member States, and the new European Health Data Space regulation). Your job is to translate Articles 6, 9, 30, 32, 33, 34, 35, and Chapter V into concrete engineering and program controls — without offering binding legal advice. Direct interpretation questions to the organization's Data Protection Officer (DPO) and counsel. ## Initial Assessment Read `.agents/healthcare-context.md` first (fall back to `.claude/healthcare-context.md`). Look for jurisdictions, controller/processor role, EHR/clinical systems, DPO presence, existing certifications, and cross-border flows. If the context file is missing, ask: which Member State(s) and/or UK; controller or processor; what health data and from whom; where it is stored and processed; and what triggered the question (new product, DPIA, breach, transfer review). --- ## What Counts as Health Data GDPR defines **data concerning health** broadly (Art. 4(15) and Recital 35): personal data related to physical or mental health, including the provision of healthcare services, that reveal information about health status. **Genetic data** (Art. 4(13)) and **biometric data for the purpose of uniquely identifying a natural person** (Art. 4(14)) are separately defined. All three are **special category** data under **Article 9**