# Beyond the US Glossary

> 15 terms from the Health Tech book's Beyond the US part, each defined in a line and linked to the chapter that explains it.

- **Article 9 (GDPR):** the GDPR article prohibiting processing of health, genetic and biometric data unless an exception such as health care under 9(2)(h) applies ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#gdpr-and-health-data)).
- **C5 attestation:** the German BSI cloud security attestation that statutory health insurance actors need for cloud processing of health data, Type 2 from July 1, 2025 ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#national-regimes-germany-and-france)).
- **Caldicott Principles:** the National Data Guardian's eight principles for using confidential information in UK health and care ([Canada & the UK](https://www.syntaqx.com/books/health-tech/canada-and-uk#uk-data-protection-and-confidentiality)).
- **DiGA:** a German digital health application listed by BfArM and reimbursed by statutory health insurance ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#national-regimes-germany-and-france)).
- **DSPT (Data Security and Protection Toolkit):** the self-assessment every organisation with access to NHS patient data and systems must complete ([Canada & the UK](https://www.syntaqx.com/books/health-tech/canada-and-uk#uk-supplier-assurance)).
- **EHDS (European Health Data Space):** the EU regulation in force since March 26, 2025 giving patients rights over electronic health data, regulating EHR systems and governing secondary use, applying in waves to 2035 ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#the-european-health-data-space)).
- **EUDAMED:** the EU medical device database, four of whose modules became mandatory on May 28, 2026 ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#mdr-and-ivdr-for-software)).
- **HDS (hébergeur de données de santé):** the French certification required to host personal health data for others ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#national-regimes-germany-and-france)).
- **Health data access body:** an EHDS authority that issues permits for secondary use of health data in secure processing environments ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#the-european-health-data-space)).
- **MDR (Medical Device Regulation):** Regulation (EU) 2017/745, which decides when software is a medical device and what conformity it needs ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#mdr-and-ivdr-for-software)).
- **MyHealth@EU:** the EU cross-border infrastructure exchanging Patient Summaries and ePrescriptions between member states ([The EU](https://www.syntaqx.com/books/health-tech/eu-health-data#how-the-platforms-do-it)).
- **NHS login:** the NHS's OpenID Connect identity service for patient-facing apps, with P0, P5 and P9 verification levels ([Canada & the UK](https://www.syntaqx.com/books/health-tech/canada-and-uk#uk-how-the-nhs-is-organised)).
- **OHIP (Ontario Health Insurance Plan):** Ontario's public health insurance plan, billed by fee code from the Schedule of Benefits ([Canada & the UK](https://www.syntaqx.com/books/health-tech/canada-and-uk#canada-provincial-plans)).
- **PHIPA:** Ontario's Personal Health Information Protection Act, governing health information custodians and their agents, deemed substantially similar to PIPEDA ([Canada & the UK](https://www.syntaqx.com/books/health-tech/canada-and-uk#canada-privacy-law)).
- **PIPEDA:** Canada's federal private-sector privacy law for personal information in commercial activities ([Canada & the UK](https://www.syntaqx.com/books/health-tech/canada-and-uk#canada-privacy-law)).

---

Canonical URL: https://www.syntaqx.com/books/health-tech/glossary/beyond-the-us