Does HIPAA or GDPR actually apply to our property management company?

For Property Management Companies

For most standard residential or commercial property management companies, no, not directly, and you should be skeptical of anyone claiming otherwise. HIPAA governs protected health information handled by covered entities, healthcare providers, insurers, and their business associates, not landlords or property managers. The exception is if your portfolio includes senior living communities, assisted living facilities, or supportive housing where health-related accommodations (a tenant's mobility equipment, a caregiver's access schedule, medication delivery coordination) are routinely discussed as part of managing the property, in which case HIPAA-adjacent handling of that information becomes genuinely relevant, and that is the scenario where Voksha's Enterprise-tier HIPAA compliance features actually apply. GDPR governs personal data of individuals in the European Union, so it is relevant to a US property management company mainly if you manage properties owned by European investors or funds where their personal and financial data as owners is processed by your systems, not typically because of your tenants, who are usually US or Canada based. What does apply to essentially every property management company, regardless of size, is Fair Housing Act compliance on the leasing side, FCRA compliance on the screening side, and state-level landlord-tenant law governing security deposits, notice periods, and habitability standards. If a vendor or consultant tells you HIPAA applies to your typical multifamily or single-family rental portfolio, ask specifically what protected health information your business handles as a covered entity or business associate, because for most portfolios the honest answer is none.