Compare

FDA PCCP / SaMD vs HIPAA: how they differ, side by side

How FDA PCCP / SaMD and HIPAA differ: what each is, who owes it, when it applies and who enforces it.

FDA PCCP / SaMDNon-binding guidance; an authorized PCCP binds the manufacturer to its terms

HIPAABinding law

Checked21 Oct 2026

01 / Side by side

FDA PCCP / SaMD and HIPAA, side by side

	FDA PCCP / SaMD	HIPAA
What it is	guidance	regulation
Jurisdiction	United States (federal)	United States (federal)
Legal force	Non-binding guidance; an authorized PCCP binds the manufacturer to its terms	Binding law
Status	Published standard	In force
Applies from	4 Dec 2024	14 Apr 2003
Who owes it	Makers of standalone software that meets the device definition (Software as a Medical Device) and contains AI-enabled functions, when filing a 510(k), De Novo or PMA.	Covered entities (health plans, health care clearinghouses and providers that bill electronically) and their business associates, including AI vendors that handle protected health information for them.
Enforcement	FDA. Releasing a modified SaMD outside the authorized PCCP without a required submission can render it adulterated or misbranded, leading to warning letters, recalls or other enforcement.	HHS Office for Civil Rights and state attorneys general. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; knowing violations can bring DOJ criminal charges.

02 / FDA PCCP / SaMD

What FDA PCCP / SaMD requires

Most authorized PCCPs involve machine-learning software, and SaMD is where model retraining is most frequent. The guiding principles ask that plans be focused and bounded, risk-based, evidence-based, transparent and lifecycle-oriented.

01Confirm the software meets the device definition and is not excluded, for example as non-device clinical decision support.
02Include a PCCP in the marketing submission with Description of Modifications, Modification Protocol and Impact Assessment.
03Limit planned modifications to changes that keep the SaMD within its authorized intended use and indications.
04Pre-specify data management, retraining, performance evaluation methods and acceptance criteria for each update.
05Tell users through labeling that the device has a PCCP and describe implemented changes and their performance.
06Keep version control and quality system records; submit a new application for changes outside the plan.

03 / HIPAA

What HIPAA requires

HHS has stated that PHI in AI training data, prediction models and algorithm data held by a regulated entity for covered functions is protected by the HIPAA Rules. Generative AI tools that memorize or reveal training data can cause impermissible disclosures.

01Use or disclose PHI in AI tools only for a permitted purpose, such as treatment, payment or operations, or with patient authorization.
02Sign a business associate agreement before an AI vendor creates, receives, maintains or transmits PHI for you.
03Limit PHI sent to AI tools to the minimum necessary, except for treatment disclosures.
04De-identify data by Safe Harbor or Expert Determination before treating it as outside HIPAA, for example for model training.
05Get authorization or an IRB or privacy board waiver before using PHI for research, including AI research.
06Assess and notify under the Breach Notification Rule if an AI tool exposes unsecured PHI.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES