HIPAA and the General Data Protection Regulation (GDPR) apply to different types of personal information. Each has different scope and requirements.
HIPAA applies specifically to Protected Health Information (PHI), which is defined as any individually identifiable health information that is created, received, used, or disclosed by a covered entity or its business associates in the course of providing healthcare services, payment for healthcare services, or healthcare operations. PHI requires these covered entities to implement safeguards to protect the confidentiality, integrity, and availability of PHI, and to ensure that only authorized individuals have access to it.
The General Data Protection Regulation (GDPR) applies to personal data of EU citizens, as well as to controllers and processors in the European Union (EU) who handle it. Personal data is any information related to an identified or identifiable natural person. Although GDPR does not set out specific data protection requirements, like HIPAA, it does require organizations to take appropriate technical and organizational measures to protect individual's rights and freedoms in relation to the processing of their personal data.