Postgraduate Diploma in GDPR/HIPAA and Impact Assessments
Online 800-hour Postgraduate Diploma in GDPR/HIPAA and Impact Assessments. 8 modules covering Regulation (EU) 2016/679 (GDPR), HIPAA (45 CFR Parts 160 and 164) and Gestiona EIPD (AEPD). Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Identify the GDPR obligations regarding health data.
Apply the privacy and security rules of HIPAA.
Draft the record of processing activities of a healthcare organisation.
Carry out a complete data protection impact assessment.
Define technical and organisational security measures proportionate to the risk.
Manage and notify security breaches within the legal deadlines.
Integrate complementary security and ethics assessments into the DPIA.
Who it's for
- Healthcare data protection officer who wants to specialise in GDPR/HIPAA and Impact Assessments.
- Privacy and HIPAA consultant who wants to specialise in GDPR/HIPAA and Impact Assessments.
- Regulatory compliance analyst who wants to specialise in GDPR/HIPAA and Impact Assessments.
- Information security manager who wants to specialise in GDPR/HIPAA and Impact Assessments.
- Data protection auditor who wants to specialise in GDPR/HIPAA and Impact Assessments.
- Privacy manager in clinical trials who wants to specialise in GDPR/HIPAA and Impact Assessments.
- Engineering or science graduates seeking to enter hospitals and healthcare services.
What you'll work with
- Regulation (EU) 2016/679 (GDPR)
- HIPAA (45 CFR Parts 160 and 164)
- Organic Law 3/2018 (LOPDGDD)
- ISO/IEC 29134 (privacy impact assessment)
- ISO/IEC 27701 (privacy information management)
- ISO/IEC 27001
- HITECH Act
- Royal Decree 311/2022 (Esquema Nacional de Seguridad)
8 modules · 800 h
1.1Health data as a special category1.2Genetic, biometric and wearable data1.3Processing principles under Article 5 GDPR1.4Legal bases and exceptions under Article 91.5Pseudonymisation versus anonymisation1.6Roles: controller, processor and joint controllers1.7Data subject rights in the healthcare field1.8International transfers and standard contractual clauses1.9Supervisory authorities and sanctions regime1.10Case study: data inventory of a health app
2.1Covered entities and business associates2.2Protected health information (PHI)2.3Privacy Rule: permitted uses and disclosures2.4Security Rule: administrative, physical and technical safeguards2.5Breach Notification Rule and deadlines2.6De-identification: Safe Harbor and expert determination2.7Business Associate Agreements2.8HITECH Act and OCR penalties2.9Comparison between HIPAA and GDPR2.10Workshop: drafting a Business Associate Agreement
3.1Record of processing activities3.2Data flow mapping3.3Inventory of systems and suppliers3.4Information classification3.5Data minimisation and storage limitation3.6Privacy by design and by default3.7Necessity and proportionality analysis3.8Legal bases in health research3.9Documentation of accountability3.10Practical exercise: processing records for a digital clinic
4.1When it is mandatory: Article 35 GDPR4.2AEPD lists and EDPB criteria4.3AEPD methodology for DPIAs4.4Systematic description of the processing4.5Threat identification and risk scenarios4.6Calculation of likelihood and impact4.7Mitigation measures and residual risk4.8Prior consultation with the supervisory authority4.9Tools: CNIL PIA and templates4.10Case study: DPIA for a remote monitoring platform
5.1HIPAA-based security risk analysis5.2Spanish National Security Framework in healthcare5.3ISO/IEC 27001 and ISO/IEC 277015.4Encryption at rest and in transit5.5Access control and identity management5.6Audit logs and monitoring5.7Cloud security and shared responsibility5.8Security of connected medical devices5.9Business continuity and backups5.10Laboratory: review of controls in a cloud architecture
6.1Detection and classification of data breaches6.2Notification to the authority within 72 hours6.3Communication to data subjects6.4HIPAA notification to patients, HHS and the media6.5Forensic investigation and containment6.6Ransomware in healthcare environments6.7Breach register and lessons learned6.8AEPD's Comunica-Brecha RGPD tool6.9Drills and tabletop exercises6.10Practical exercise: breach simulation in a hospital
7.1Transfer impact assessment (TIA)7.2Impact assessment on fundamental rights for AI7.3Supplier assessment and due diligence7.4Internal compliance audits7.5Clinical research: DPIA and ethics committees7.6Secondary use of health data7.7Integrated compliance programmes7.8Privacy maturity indicators7.9Managing data subject requests at scale7.10Case study: TIA for a US supplier
8.1Selection of processing and scope8.2Mapping of flows and actors8.3Necessity and proportionality analysis8.4Risk identification and assessment8.5Parallel HIPAA compliance analysis8.6Risk treatment plan8.7Breach response plan8.8DPO opinion and approval8.9Report and presentation8.10Final review with the tutor
How you'll learn
100 % online training on the SEIUM campus, with downloadable material, recorded classes and an assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it possible to combine the programme with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Gestiona EIPD (AEPD), PILAR (CCN), OneTrust, advanced Excel, in free, academic or evaluation versions. Practical work is based on real procedures for drafting records of processing activities, impact assessments on clinical cases and breach notification simulations. Assessment is continuous per module plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Identify the GDPR obligations regarding health data.
Apply the privacy and security rules of HIPAA.
Draft the record of processing activities of a healthcare organisation.
Carry out a complete data protection impact assessment.
Define technical and organisational security measures proportionate to the risk.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. A university degree is not required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme comprises 800 hours in total, spread over 6 to 8 months. That is an average of 10 to 15 hours per week, compatible with full-time work.
You work with Gestiona EIPD (AEPD), PILAR (CCN), OneTrust and advanced Excel. Free, academic or evaluation versions are used, and the tutor indicates the open-source alternative where one exists.
A SEIUM Institute diploma upon passing the continuous assessment and the integrative final project. It is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area are credited towards the advanced programme. Consult the recognition policy when you enrol.
Related programmes
Postgraduate Diploma in TRIPOD/HFACS Methodologies and Evidence
The Postgraduate Diploma in TRIPOD/HFACS Methodologies and Evidence focuses on the study of risk analysis and human factors in the investigation of incidents and accidents. It…
Postgraduate Diploma in Secure Acquisition of ECG/PPG/EEG/EMG
Online Postgraduate Diploma of 800 h in Secure Acquisition of ECG/PPG/EEG/EMG. 8 modules with IEC 60601-1 (medical electrical equipment safety), IEC 60601-1-2 (electromagnetic compatibility) and LTspice.…
Postgraduate Diploma in Risk Assessment and Operational Controls
Online 800-hour Postgraduate Diploma in Risk Assessment and Operational Controls. 8 modules covering ISO 31000 (risk management), IEC 31010 (risk assessment techniques) and advanced Excel. Assigned…
More in Health, Biomechanics, Wearables & Operational Safety
All Health, Biomechanics, Wearables & Operational Safety programmes → · How to apply · Fees & financing · Scholarships