Compare
HIPAA vs HHS §1557: how they differ, side by side
How HIPAA and HHS §1557 differ: what each is, who owes it, when it applies and who enforces it.
01 / Side by side
HIPAA and HHS §1557, side by side
| HIPAA | HHS §1557 | |
|---|---|---|
| What it is | regulation | regulation |
| Jurisdiction | United States (federal) | United States (federal) |
| Legal force | Binding law | Binding law for covered entities |
| Status | In force | In force |
| Applies from | 14 Apr 2003 | 1 May 2025 |
| Who owes it | Covered entities (health plans, health care clearinghouses and providers that bill electronically) and their business associates, including AI vendors that handle protected health information for them. | Covered entities under Section 1557: recipients of HHS federal financial assistance (most hospitals, clinics and health insurers), HHS's own health programs, and ACA Title I entities such as Exchanges. |
| Enforcement | HHS Office for Civil Rights and state attorneys general. Civil penalties adjusted for inflation range from $145 to $2,190,294 per violation, with an annual cap of $2,190,294 per identical provision; knowing violations can bring DOJ criminal charges. | HHS Office for Civil Rights through complaints and compliance reviews; remedies include corrective action, suspension or termination of federal financial assistance, and referral to the Department of Justice. |
02 / HIPAA
What HIPAA requires
HHS has stated that PHI in AI training data, prediction models and algorithm data held by a regulated entity for covered functions is protected by the HIPAA Rules. Generative AI tools that memorize or reveal training data can cause impermissible disclosures.
- 01Use or disclose PHI in AI tools only for a permitted purpose, such as treatment, payment or operations, or with patient authorization.
- 02Sign a business associate agreement before an AI vendor creates, receives, maintains or transmits PHI for you.
- 03Limit PHI sent to AI tools to the minimum necessary, except for treatment disclosures.
- 04De-identify data by Safe Harbor or Expert Determination before treating it as outside HIPAA, for example for model training.
- 05Get authorization or an IRB or privacy board waiver before using PHI for research, including AI research.
- 06Assess and notify under the Breach Notification Rule if an AI tool exposes unsecured PHI.
03 / HHS §1557
What HHS §1557 requires
HHS defined patient care decision support tools broadly so they include AI and machine-learning models, clinical algorithms and risk calculators. It is the first federal civil rights rule aimed directly at bias in clinical algorithms, and it applies to the provider or plan that uses the tool, not the vendor.
- 01Do not discriminate on race, color, national origin, sex, age or disability through patient care decision support tools.
- 02Make ongoing reasonable efforts to identify tools whose input variables measure race, color, national origin, sex, age or disability.
- 03For each identified tool, make reasonable efforts to mitigate the risk of discrimination from its use.
- 04Cover tools used in clinical decision-making, whether automated (including AI) or non-automated.
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Federal Register (HHS)
RELATED
Related: HIPAA: the full guide · HHS §1557: the full guide · HHS §1557 vs HIPAA · All comparisons