HIPAA, PDPB and PECA: data protection rules every Pakistani therapist should know

Patient data is the most sensitive asset in a therapy practice, and three different frameworks can apply to a Pakistani clinic in 2026: HIPAA if you see any US-based client, PDPB when it is enacted locally, and PECA when something goes wrong. Most clinicians default to assuming none of them apply — the honest answer is that at least one of them probably does.

HIPAA — only if you have US-based clients

HIPAA (the US Health Insurance Portability and Accountability Act) applies to a Pakistani practice the moment you accept a client who is physically in the United States, or whose billing/insurance is routed through the US system. It requires: (1) encryption at rest and in transit, (2) role-based access, (3) an audit trail of every record access, (4) a signed Business Associate Agreement (BAA) with every subprocessor who touches that data (hosting, email, video).

PDPB — Pakistan's own data protection framework

The Personal Data Protection Bill (PDPB) has been drafted and iterated through multiple versions. It introduces concepts familiar from GDPR: consent, purpose limitation, data subject rights (access, correction, deletion), and breach notification. Even before it is final, aligning with its principles costs little and protects your practice when it does land.

• Collect only what you need (name, contact, clinical data — not CNIC photocopy unless billing requires it)
• Keep an inventory of where patient data lives (EHR, phone, email, paper)
• Have a simple written privacy notice patients see before intake
• Define a retention period and actually delete after it ends

PECA — the breach and misuse law

The Prevention of Electronic Crimes Act (PECA) 2016 is the active criminal statute for data misuse in Pakistan. It covers unauthorised access, identity theft, and the non-consensual sharing of information. If a staff member leaks a patient's records, PECA — not PDPB — is what the FIA will use.

A 60-minute compliance sprint

• Audit who has access to patient records (and remove ex-staff)
• Switch personal Gmail/WhatsApp attachments to an EHR with encrypted storage
• Draft a one-page privacy notice and attach it to your intake form
• Enable two-factor authentication on every system that holds patient data
• Document a breach-response plan: who you call, in what order, within 72 hours

How BloomTalkx helps

BloomTalkx is built with compliance as a default: AES-256-GCM encryption at rest with per-user keys, full audit logging of record access, role-based access control, and a HIPAA policy pack ready for US-market expansion. You do not have to retrofit security onto a spreadsheet.