Compare

HHS §1557 vs HIPAA: how they differ, side by side

How HHS §1557 and HIPAA differ: what each is, who owes it, when it applies and who enforces it.

HHS §1557Binding law for covered entities

HIPAABinding law

Checked21 Oct 2026

01 / Side by side

HHS §1557 and HIPAA, side by side

	HHS §1557	HIPAA
What it is	regulation	regulation
Jurisdiction	United States (federal)	United States (federal)
Legal force	Binding law for covered entities	Binding law
Status	In force	In force
Applies from	1 May 2025	14 Apr 2003
Who owes it	Covered entities under Section 1557: recipients of HHS federal financial assistance (most hospitals, clinics and health insurers), HHS's own health programs, and ACA Title I entities such as Exchanges.	Covered entities (health plans, health care clearinghouses and providers that bill electronically) and their business associates, including AI vendors that handle protected health information for them.
Enforcement	HHS Office for Civil Rights through complaints and compliance reviews; remedies include corrective action, suspension or termination of federal financial assistance, and referral to the Department of Justice.	HHS Office for Civil Rights and state attorneys general. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; knowing violations can bring DOJ criminal charges.

02 / HHS §1557

What HHS §1557 requires

HHS defined patient care decision support tools broadly so they include AI and machine-learning models, clinical algorithms and risk calculators. It is the first federal civil rights rule aimed directly at bias in clinical algorithms, and it applies to the provider or plan that uses the tool, not the vendor.

01Do not discriminate on race, color, national origin, sex, age or disability through patient care decision support tools.
02Make ongoing reasonable efforts to identify tools whose input variables measure race, color, national origin, sex, age or disability.
03For each identified tool, make reasonable efforts to mitigate the risk of discrimination from its use.
04Cover tools used in clinical decision-making, whether automated (including AI) or non-automated.

03 / HIPAA

What HIPAA requires

HHS has stated that PHI in AI training data, prediction models and algorithm data held by a regulated entity for covered functions is protected by the HIPAA Rules. Generative AI tools that memorize or reveal training data can cause impermissible disclosures.

01Use or disclose PHI in AI tools only for a permitted purpose, such as treatment, payment or operations, or with patient authorization.
02Sign a business associate agreement before an AI vendor creates, receives, maintains or transmits PHI for you.
03Limit PHI sent to AI tools to the minimum necessary, except for treatment disclosures.
04De-identify data by Safe Harbor or Expert Determination before treating it as outside HIPAA, for example for model training.
05Get authorization or an IRB or privacy board waiver before using PHI for research, including AI research.
06Assess and notify under the Breach Notification Rule if an AI tool exposes unsecured PHI.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES