HIPAA and GDPR get invoked constantly in IT and security conversations, often as a kind of catch-all justification — "we need this because of compliance." It's worth being precise about what each actually requires when it comes to endpoint devices, since the two regulations are quite different in scope, origin, and enforcement.
HIPAA: a US healthcare-specific law
The Health Insurance Portability and Accountability Act applies to "covered entities" (healthcare providers, health plans, and healthcare clearinghouses) and their "business associates" — vendors who handle protected health information (PHI) on their behalf. Its Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards for electronic PHI.
For endpoints specifically, that generally translates to: access controls (unique user IDs, automatic logoff), encryption of PHI at rest and in transit where reasonable, audit controls that log access to PHI, and device and media controls covering how devices are disposed of or reused. HIPAA doesn't prescribe exact technical specifications in most cases — it requires a documented risk analysis and reasonable safeguards based on that analysis, which is part of why "HIPAA compliant" software is a somewhat loose claim; compliance is really about the whole organization's practices, not a single tool.
GDPR: a broader EU data protection regulation
The General Data Protection Regulation applies to any organization processing personal data of individuals in the EU, regardless of where the company itself is based. It's much broader than HIPAA in scope — covering any personal data, not just health information — and includes requirements like data minimization, the right to erasure, and breach notification within 72 hours.
For endpoints, GDPR's relevant provisions center on Article 32's requirement for "appropriate technical and organizational measures" — which in practice usually means device encryption, access controls, the ability to remotely wipe lost or stolen devices, and maintaining records of what personal data lives where, including on employee endpoints.
Where the two overlap in practice
- Both expect device encryption as a baseline, not an option.
- Both expect the ability to remotely lock or wipe a lost/stolen device.
- Both expect access logging — knowing who accessed what, and when.
- Neither specifies an exact tool or vendor — both are about demonstrable, reasonable practices.
What this means for endpoint management
Practically, this is why endpoint management platforms matter for compliance-conscious organizations: enforcing encryption, enabling remote wipe, and logging device activity across a fleet of laptops and phones is difficult to do manually at any real scale, and both regulations expect it to actually happen, not just be a written policy.