Compare

HIPAA vs FDA PCCP / SaMD: how they differ, side by side

How HIPAA and FDA PCCP / SaMD differ: what each is, who owes it, when it applies and who enforces it.

HIPAABinding law

FDA PCCP / SaMDNon-binding guidance; an authorized PCCP binds the manufacturer to its terms

Checked21 Oct 2026

01 / Side by side

HIPAA and FDA PCCP / SaMD, side by side

	HIPAA	FDA PCCP / SaMD
What it is	regulation	guidance
Jurisdiction	United States (federal)	United States (federal)
Legal force	Binding law	Non-binding guidance; an authorized PCCP binds the manufacturer to its terms
Status	In force	Published standard
Applies from	14 Apr 2003	4 Dec 2024
Who owes it	Covered entities (health plans, health care clearinghouses and providers that bill electronically) and their business associates, including AI vendors that handle protected health information for them.	Makers of standalone software that meets the device definition (Software as a Medical Device) and contains AI-enabled functions, when filing a 510(k), De Novo or PMA.
Enforcement	HHS Office for Civil Rights and state attorneys general. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; knowing violations can bring DOJ criminal charges.	FDA. Releasing a modified SaMD outside the authorized PCCP without a required submission can render it adulterated or misbranded, leading to warning letters, recalls or other enforcement.

02 / HIPAA

What HIPAA requires

HHS has stated that PHI in AI training data, prediction models and algorithm data held by a regulated entity for covered functions is protected by the HIPAA Rules. Generative AI tools that memorize or reveal training data can cause impermissible disclosures.

01Use or disclose PHI in AI tools only for a permitted purpose, such as treatment, payment or operations, or with patient authorization.
02Sign a business associate agreement before an AI vendor creates, receives, maintains or transmits PHI for you.
03Limit PHI sent to AI tools to the minimum necessary, except for treatment disclosures.
04De-identify data by Safe Harbor or Expert Determination before treating it as outside HIPAA, for example for model training.
05Get authorization or an IRB or privacy board waiver before using PHI for research, including AI research.
06Assess and notify under the Breach Notification Rule if an AI tool exposes unsecured PHI.

03 / FDA PCCP / SaMD

What FDA PCCP / SaMD requires

Most authorized PCCPs involve machine-learning software, and SaMD is where model retraining is most frequent. The guiding principles ask that plans be focused and bounded, risk-based, evidence-based, transparent and lifecycle-oriented.

01Confirm the software meets the device definition and is not excluded, for example as non-device clinical decision support.
02Include a PCCP in the marketing submission with Description of Modifications, Modification Protocol and Impact Assessment.
03Limit planned modifications to changes that keep the SaMD within its authorized intended use and indications.
04Pre-specify data management, retraining, performance evaluation methods and acceptance criteria for each update.
05Tell users through labeling that the device has a PCCP and describe implemented changes and their performance.
06Keep version control and quality system records; submit a new application for changes outside the plan.

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES