Side-by-side breakdown
| Dimension | HIPAA | FDA cybersecurity |
|---|---|---|
| Regulator | HHS Office for Civil Rights (OCR). | FDA Center for Devices and Radiological Health (CDRH). |
| Scope | Protected Health Information held by covered entities and business associates. | The medical device, its software, and its postmarket lifecycle. |
| Who must comply | Health plans, providers, clearinghouses, and their business associates. | Manufacturers of cyber devices submitted for FDA clearance/approval. |
| Trigger | Handling PHI in any form. | Submission of a cyber device under §524B. |
| Cybersecurity asks | Administrative, physical, and technical safeguards (HIPAA Security Rule). | SPDF, SBOM, threat model, pen test, postmarket plan. |
| Manufacturer status | Usually a business associate when the device touches PHI on the hospital's behalf. | Always the regulated party for the device itself. |
When to use which
Sign a Business Associate Agreement with every provider whose patients' PHI your device or cloud backend touches. Without a BAA, the provider cannot legally share PHI with you.
Reuse evidence across both programs - encryption, access control, audit logging, and incident response all map to both HIPAA Security Rule controls and FDA SPDF expectations.