# Healthcare AI Privacy — Standards and References

## Primary Legal Sources

### HIPAA
- **45 CFR Part 164** — Privacy, Security, and Breach Notification Rules apply to all AI processing of PHI
- **45 CFR §164.506** — TPO basis for clinical AI development and deployment
- **45 CFR §164.512(i)** — Research exception for AI model development with IRB waiver
- **45 CFR §164.514** — De-identification for AI training data

### EU AI Act
- **Regulation (EU) 2024/1689** — Artificial Intelligence Act (entered into force August 1, 2024)
- **AI Act Annex III** — High-risk AI systems classification (medical devices, in vitro diagnostics)
- **AI Act Art. 9** — Risk management for high-risk AI systems
- **AI Act Art. 10** — Data and data governance for high-risk AI systems
- **AI Act Art. 13** — Transparency and provision of information to deployers
- **AI Act Art. 14** — Human oversight requirements
- **AI Act Art. 15** — Accuracy, robustness, and cybersecurity

### FDA
- **21st Century Cures Act §3060(a)** — Clinical Decision Support exemption criteria
- **FDA Framework for AI/ML-Based SaMD** (April 2019) — total product lifecycle regulatory approach
- **FDA Good Machine Learning Practice (GMLP)** — 10 guiding principles (October 2021, joint with Health Canada and MHRA)
- **FDA AI/ML-Based SaMD Action Plan** (January 2021) — regulatory framework roadmap

### FTC
- **FTC Act §5** — unfair or deceptive practices in AI health applications
- **FTC Health Breach Notification Rule** (16 CFR Part 318, updated 2023) — applies to non-HIPAA health AI apps

### ONC
- **HTI-1 Final Rule** (88 FR 62592) — decision support intervention transparency, AI source attribute disclosure
- **45 CFR Part 170** — Health IT Certification criteria including AI transparency

## Industry Standards
- **Model Cards for Model Reporting** — Mitchell et al., 2019 — framework for AI model documentation
- **NIST AI Risk Management Framework (AI RMF 1.0)** — January 2023
- **WHO Guidance on Ethics and Governance of AI for Health** — June 2021
- **Coalition for Health AI (CHAI)** — Blueprint for trustworthy AI in healthcare