Digital Health Regulations FAQ: 12 Founder Questions
Four regulators can each claim a piece of a digital health product: the FDA (device classification), the FTC (deceptive claims and data-sharing enforcement), HIPAA (covered entities and business associates only), and state law (telehealth licensure, consumer privacy). Which ones reach you depends on what your product does and who touches the data — not on the fact that it touches "health" at all.
Quick answer: Most consumer health apps are not FDA-regulated devices and are not covered by HIPAA. Almost all of them are still fully subject to FTC enforcement and state privacy law. Assume the FTC and your state apply by default, and confirm FDA and HIPAA status with counsel before you build around an assumption either way.
The rest of this FAQ walks through the twelve questions founders ask most often when they first realize "digital health" isn't one regulatory category — it's four overlapping ones, each with its own trigger.
What Regulations Actually Apply to a Digital Health App?
It depends on three questions: does your software make or influence a clinical decision (FDA), do you handle data on behalf of a doctor, hospital, or insurer (HIPAA), and do you make health-related claims to consumers (FTC)? Most early-stage apps land outside FDA and HIPAA and squarely inside FTC and state consumer-protection law. Map your actual data flows and claims before assuming any single framework governs — how to validate a healthtech startup idea walks through that mapping as a first step, not an afterthought.
Does HIPAA Apply to My Health App?
Only if you're a HIPAA covered entity — a health plan, clearinghouse, or provider that bills electronically — or a business associate handling protected health information on a covered entity's behalf. A direct-to-consumer app with no provider or insurer relationship usually isn't covered, even though it collects sensitive data. That gap between "collects sensitive data" and "HIPAA-covered" is exactly the ground HIPAA for startups covers — being outside HIPAA is not the same as having no legal exposure.
Is My App Considered a Medical Device by the FDA?
The test turns on intended use and function, not on the word "health" appearing in your marketing. Software that diagnoses, treats, or directly informs a clinical decision can qualify as a regulated device; software that tracks, educates, or organizes information generally does not. The line is fact-specific and has shifted before. Walk the FDA device test against your actual feature set, then confirm the conclusion with regulatory counsel before you finalize product scope.
What's the Difference Between FDA and FTC Oversight for Health Apps?
The FDA asks what your software does — is it functioning as a medical device. The FTC asks what you say and what you do with data — are your claims truthful, and is your data handling consistent with your privacy promises, regardless of device status. A product entirely outside FDA's reach is still fully inside the FTC's. Founders who clear the device question sometimes stop there; the FTC question never goes away.
Do State Telehealth Laws Apply If My App Has No Clinicians?
If no licensed clinician delivers care through your platform, telehealth-specific licensure rules typically don't apply — those rules govern the practice of medicine across state lines, not software on its own. The moment you add clinician matching, prescribing, or care delivery, that changes, and it changes state by state, not once nationally. Treat "we're not a telehealth platform" as a claim to re-verify against your roadmap, not a permanent status.
What Is 42 CFR Part 2, and Does It Apply to My Product?
It's a federal confidentiality framework for records connected to substance use disorder treatment, with rules that are generally stricter than general health-privacy law. It applies only to programs meeting its own specific federal-assistance and treatment-related definitions — most general wellness or mental-health apps fall outside it. A product touching addiction treatment, recovery support, or substance-use-adjacent data should confirm applicability with counsel rather than assume it's out of scope by default.
Do Wellness and Fitness Apps Need to Comply With Health Regulations?
Yes — just usually a different set than founders expect. Wellness and fitness apps are rarely FDA devices or HIPAA-covered, but they're squarely subject to FTC rules on substantiated claims and truthful data practices, plus state consumer-privacy law once they collect health-adjacent data. "General wellness" is also a real, narrower FDA category with its own boundaries, so don't assume the label alone exempts you from every regulator that could reach you.
What If I Collect Health Data but I'm Not a HIPAA-Covered Entity?
The data doesn't stop being sensitive because HIPAA doesn't apply to you. The FTC treats health data as a category deserving heightened scrutiny in its own right, and a growing number of states now define "consumer health data" as its own protected category under general privacy statutes, independent of HIPAA status. Being outside HIPAA narrows which rulebook applies — it doesn't remove the obligation to handle the data carefully and disclose accurately what you actually do with it.
Do I Need a Business Associate Agreement (BAA)?
Only if you're creating, receiving, or handling protected health information on behalf of a HIPAA-covered entity — a provider, health plan, or clearinghouse. If you have no such relationship, a BAA isn't the right instrument, and signing one you don't need can create obligations your product isn't built to meet. If a hospital or insurer partner asks you to sign one, treat that as a trigger to bring in counsel, not a form to sign quickly to close a deal.
Are AI and Machine Learning Health Features Regulated Differently?
The underlying question doesn't change — does the feature function as a medical device, and are your claims about it accurate — but AI-driven clinical decision support tends to draw closer regulatory attention than a static content feature. Framing matters here: a model that assists a clinician's judgment sits differently than one that outputs a diagnosis directly to a consumer. Document your intended use precisely, and revisit that documentation every time the feature's actual behavior changes.
Do State Privacy Laws Like CCPA Apply Even When HIPAA Doesn't?
Often, yes. Several states now regulate "consumer health data" as its own protected category, separate from and broader than HIPAA, with obligations that can include consent, deletion rights, and restrictions on sale or sharing — regardless of whether you're a HIPAA-covered entity. These laws vary state by state and are still evolving, so treat "we're HIPAA-exempt" as answering only one part of the compliance picture, not the whole thing.
When Should I Bring In Healthcare Regulatory Counsel?
Before you finalize your data-sharing architecture, before you describe your product's clinical value in marketing copy, and before you sign any agreement that references HIPAA, a BAA, or FDA clearance — not after those decisions are already built into your product. Early counsel input is cheaper than a later rebuild. If you're still validating whether the idea is worth building at all, pair that regulatory scoping with the complete guide to startup idea validation so legal risk and market risk get assessed together from the start.
Quick-Reference: Product Type vs. Applicable Regulations
The table below maps common digital health product types against the four regulatory lenses covered above. Treat it as a starting orientation for scoping a conversation with counsel, not as a legal determination for your specific product.
| Product Type | FDA (Device Rules) | FTC (Claims & Data) | HIPAA | State Privacy / Telehealth Law |
|---|---|---|---|---|
| General wellness / fitness tracker | Usually out of scope | Applies | Usually not covered | Applies (consumer health-data provisions) |
| Symptom checker / triage tool | Possible, fact-specific | Applies | Depends on data relationships | Applies |
| Telehealth video + scheduling platform | Usually out of scope (platform only) | Applies | Likely, as a business associate | Applies (telehealth licensure rules) |
| AI clinical decision support | Likely, fact-specific | Applies | Depends on whether the customer is a provider or a consumer | Applies |
| EHR / patient-portal integration | Usually out of scope | Applies | Likely, as a business associate | Applies |
| Direct-to-consumer mental health app | Usually out of scope | Applies | Usually not covered directly | Applies (heightened in several states) |
Read this as a pattern, not a verdict: the same product category can land in a different cell depending on exactly who your customer is and where the data actually flows. Confirm your own row with counsel before treating any cell here as settled.
Key Takeaways
- No single regulator covers "digital health." FDA, FTC, HIPAA, and state law each apply on their own separate triggers, and most products face more than one at once.
- HIPAA is narrower than founders assume. It applies only to covered entities and their business associates — a consumer-facing app with no provider or insurer relationship is usually outside it, but that doesn't remove other obligations.
- The FTC applies almost regardless of everything else. Deceptive-claims and data-practice rules reach nearly every consumer health product, FDA and HIPAA status aside.
- FDA device status turns on function, not framing. The word "health" in your marketing copy doesn't trigger FDA jurisdiction; diagnosing or directly informing a clinical decision does.
- State law is the fastest-moving layer. Consumer health-data categories and telehealth licensure rules vary by state and change more often than federal frameworks do.
- Map data flows and claims before you build, not after — a compliance review is cheapest before your architecture and marketing copy are already locked in.
- None of this substitutes for counsel. Use this FAQ to know which questions to ask a healthcare regulatory attorney, not as a final answer for your specific product.
Frequently Asked Questions
Is it legal to build a health app without a lawyer first?
Yes — nothing requires legal review before you write code. But the regulatory questions above, like device status, HIPAA applicability, and data-sharing claims, get more expensive to fix the later you address them. Most founders bring in counsel once the product direction is validated and before committing to a data architecture or a funding round, not before writing a single line of code.
How much does healthcare regulatory legal review typically cost?
It varies widely by scope, complexity, and firm, and depends heavily on whether you need a single-question opinion or a full compliance program. There's no reliable industry-standard figure to quote here. Ask several healthcare-focused attorneys for a scoped estimate against your specific product and data flows rather than budgeting off a number you saw quoted somewhere else.
Can a startup self-certify that it's not FDA-regulated?
There's no formal self-certification process — the FDA doesn't issue a "not a device" letter on request. Founders typically document their own intended-use analysis against FDA's published guidance and keep it on file, and some request an informal pre-submission conversation with the agency for genuinely ambiguous cases. Either way, that analysis should be reviewed by counsel familiar with FDA software guidance before you rely on it.