Saudi Healthcare Data Privacy: PDPL, HIPAA and SHIE Compliance

Saudi healthcare data privacy covers how hospitals, clinics, insurers and vendors collect, use, share and protect patient information under the Personal Data Protection Law (PDPL). Health data counts as sensitive data, so PDPL Article 23 restricts access to the minimum number of employees and the extent necessary for care. The Saudi Data and AI Authority (SDAIA) supervises the law, and the Ministry of Health (MoH) adds health sector requirements. This course shows how to apply those rules in daily workflows.

HIPAA is United States law. It binds a Saudi organisation only through a relationship with a United States covered entity, for example when a Saudi company handles protected health information as a business associate. Otherwise the PDPL governs processing in the Kingdom. Many teams still use HIPAA as a benchmark for safeguards, so the course compares HIPAA and PDPL side by side, then maps both to the Saudi Health Information Exchange policies and National Cybersecurity Authority (NCA) controls.

The PDPL Implementing Regulations (Article 24) require a controller to notify SDAIA within 72 hours of becoming aware of an incident that potentially causes harm, through the National Data Governance Platform. If information is missing, you supply it later with reasons for the delay. Patients receive notice without undue delay when damage to their data or rights may follow. SDAIA opened a consultation in October 2026 on removing the harm threshold, so check the current text.

Published summaries of Implementing Regulations Article 32 require an appointed officer where a controller's core activities consist of processing sensitive data. Care delivery depends on health data, so most hospitals and many clinics fall within that case. SDAIA will set further rules on appointment and duties, and a 2026 consultation draft would revise them. The course explains the officer's tasks, a 90-day start plan and how the role works with the privacy committee.

PDPL Article 29 allows transfers only when listed conditions are met, including adequate protection and minimum data. The revised Personal Data Transfer Regulations of 1 September 2024 recognise adequacy decisions and three safeguards: standard contractual clauses, binding common rules and certificates of accreditation. A risk assessment applies where sensitive data moves on a continuous or widespread basis. Extreme necessity to preserve life or treat disease has its own exception. Confirm current hosting rules before moving data abroad.

PDPL Article 4 gives patients the right to access their data and to obtain a copy in a readable format. The Implementing Regulations set a 30-day response period, with a possible extension of up to 30 days in listed cases. Log the request, verify identity, check limits such as another person's data, release the copy securely and record the decision. The course provides a seven-step process and a request log for medical records privacy teams.

PDPL Article 35 sets imprisonment of up to two years or a fine of up to SAR 3 million, or both, for disclosing sensitive data in breach of the law with intent to harm or for personal benefit. Article 36 allows a warning or a fine of up to SAR 5 million for other violations, doubled for repeats. Strong access control, vendor contracts, training and evidence of PDPL compliance for hospitals reduce risk. Check the official PDPL text for current figures.

The course is Intermediate. It suits professionals who already work with patient records, compliance files, vendors, claims or health systems and want to apply the Saudi Personal Data Protection Law, SDAIA rules and HIPAA concepts in practice. No legal qualification is required. This Saudi healthcare data privacy course uses worked scenarios from hospitals, clinics, insurers and digital health teams, and each module combines short lessons, practical examples and a quiz.

No. The Imtithal Academy Certificate of Completion confirms that you completed the course and passed the final exam with at least 70 percent. It is not a licence, a professional qualification or an accreditation, and neither SDAIA, the MoH nor any other authority issues it. You can add it to your CV, LinkedIn profile or employer training records as evidence of study.

No. The course is education and does not replace advice from a qualified Saudi lawyer. It explains the Personal Data Protection Law, the Implementing Regulations and health sector requirements, and it flags where rules are under consultation. Confirm current requirements on the official SDAIA, MoH and NCA websites, and ask counsel before relying on a legal interpretation, for example the legal basis for treatment-related processing.