Inflahormony / Builder Resource
Healthtech Developer Regulatory Cheat Sheet
U.S. first pass. Define each software function before committing the build.
Start with 5 facts
- Intended use and claims — what does the software actually do, and what will you say it does?
- Who uses the output — a clinician, the patient, an operations team?
- Data sources and recipients — where does data come from, and where does it go?
- Who controls the app — the covered entity, an independent developer, the patient?
- States and markets served — state consumer-health-data laws vary.
01. FDA: product function
Does it diagnose, predict, triage, or recommend care? Assess each function and its intended use against FDA's clinical decision support guidance. Whether it counts as CDS, wellness software, or a regulated device — and what oversight applies — depends on the details.
02. FTC: app-wide screening
Run your product description through the FTC's mobile health app interactive tool for potential FTC Act, Health Breach Notification Rule, HIPAA, FD&C Act, and information-blocking issues. It's a screening aid, not a clearance.
03. HIPAA: relationship and role
Map whether you act for a covered entity as a business associate. A patient-directed transfer to an independent app can have a different status. Document PHI flows, contracts, access, and security regardless of which side of that line you're on.
04. Consumer health privacy
If HIPAA doesn't apply, FTC privacy and security duties still may. Check the Health Breach Notification Rule, your consent and sharing practices, and applicable state consumer health data laws.
05. EHR and clinical AI
For EHR integrations, check whether your role triggers information-blocking duties. If you're building certified health IT, examine HTI-1 decision-support transparency and related certification criteria.
06. Evidence and marketing
Keep product claims tied to the exact evidence and intended use. Test accuracy, safety, bias, human review, and real-world workflow fit before claiming clinical benefit.
Before the next sprint
Record the function, a data-flow diagram, intended claims, tool results, an owner, open questions, and a counsel/regulatory review decision.
Educational checklist. Not a legal determination. Reviewed September 2026. This page is a starting point for your own team's review, not a substitute for qualified regulatory counsel.
Get the PDF
We'll email you the full one-page cheat sheet as a PDF, formatted for your team's next sprint-planning session.