Healthtech SaaS: considerations before you build
Questions to settle before you build health software in the United States: business associates, the Security Rule, breach notice and FDA device software.
General information, not legal or financial advice. Written October 10, 2026 and scoped to United States federal rules: the HIPAA regulations, the Federal Trade Commission and the Food and Drug Administration. Whether a rule reaches your product depends on who your customer is and what the software does, so bring the facts to a lawyer licensed where you operate.
A health product asks three questions that most software never has to answer. Whose health information does it touch? On whose behalf? And does the software itself act like a medical device? The answers decide which federal regimes apply, and they are easier to settle before you design the data model than after. This article walks through the questions, each tied to a primary text, and it does not say how any rule applies to your product.
First question: who is your customer in health-privacy terms?
The HIPAA regulations separate two kinds of party. The definitions in 45 CFR 160.103 list the covered entities: a health plan, a health care clearinghouse, and a health care provider who transmits any health information in electronic form in connection with a transaction the regulations cover. A hospital, a physician practice or an insurer is typically one of these.
A software company is usually not a covered entity. It may be something else the same section defines: a business associate. In the regulation’s words, a business associate is, with respect to a covered entity, a person who creates, receives, maintains, or transmits protected health information for a function or activity. The key phrase for a founder is “with respect to a covered entity”. A product that handles protected health information for a clinic or a plan can put the company in that category. A product that sells to consumers who enter their own data, with no covered entity involved, may not. The facts decide, and the definition has exceptions that this article does not cover.
Write down, before building, who the first three customers are likely to be and whether each is a covered entity. If the honest answer is “I do not know”, that is the first thing to take to counsel.
The business associate contract
If the company is a business associate, the regulations expect a written arrangement. Section 164.504(e) says the contract must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5), as applicable. The first item in paragraph (e)(2) says the contract must establish the permitted and required uses and disclosures of protected health information by the business associate.
For a founder, the consequence is practical. A customer that is a covered entity will usually send its own form of agreement, and the terms in it become product requirements: what data you may use, what you may not, and what you must be able to show. Reading one early, before the product exists, tells you what you will be asked to build. IP, contracts and access diligence for small engineering teams covers how contract terms turn into diligence questions in general.
The Security Rule is built to scale
The Security Rule sits in 45 CFR 164.306. Paragraph (a) says covered entities and business associates must ensure the confidentiality, integrity, and availability of all electronic protected health information. Paragraph (b) is the part small companies read twice: it says covered entities and business associates may use any security measures that allow them to meet the standards the rule sets.
The flexibility is real, and so is the burden it leaves. The rule does not hand a small company a list of products to buy. It leaves the choice of measures to the company, which means the company has to be able to explain its choices. That explanation is a document, best written before a customer asks for it. The security baseline checklist and the year-one security baseline note describe a general baseline for a small team. Neither is a statement about the Security Rule, and a baseline is not a substitute for reading the rule.
Breach notice is a design input
Section 164.404 describes what happens after a breach. It says a covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual, and paragraph (b) says the notice must be given without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. The covered entity is the party named in this section, and this article does not cover what the regulations ask of a business associate.
What matters at the product stage is that a covered entity customer may expect you to detect and report an incident quickly enough for it to meet its own deadline. Logging, access records and an incident procedure are design decisions with a clock attached, which is a reason to make them early. Answering a security and privacy questionnaire shows the questions a health customer is likely to ask about them.
If HIPAA does not apply, another rule may
Not every health product has a covered entity as a customer. A wellness or tracking app sold directly to consumers may sit outside the HIPAA regulations and inside a different one. The FTC’s page on its Health Breach Notification Rule says the rule applies if you are a vendor of personal health records, a PHR related entity, or a third party service provider for either. It adds that you are not a vendor of personal health records if you are covered by HIPAA. The same page says makers of health apps, connected devices, and similar products must comply with the Rule. Whether a given product falls within it is a question for counsel. The page showed July 2024 as its date, with an edit in January 2025, when it was read.
Which regime applies, if either, is a legal question about the facts, and a company that assumes neither does has made a decision that deserves a lawyer’s check.
Is the software a medical device?
A separate question is whether the software is itself a regulated device. The FDA’s page on device software functions says mobile medical apps are medical devices that are mobile apps and that incorporate device software functionality, and that they meet the definition of a device in section 201(h) of the Food, Drug and Cosmetic Act. It also says the agency takes a risk-based approach that focuses on the subset of software functions that meet the definition of device. For many software functions that meet the definition but pose minimal risk, the page says the FDA will exercise enforcement discretion and will not expect manufacturers to submit premarket review.
Whether a feature meets the definition is a question about what the feature does and what it is for. A feature described as “helps clinicians decide” is a different statement from one described as “stores notes”, so ask counsel how your own descriptions of each feature bear on the question. Writing down what each feature is for is a product decision that counsel will want to see. If AI sits inside the feature, AI features and customer data: what to decide first covers the data decisions that come with it.
Questions to put to counsel before you build
None of these is advice. They follow from the pages above.
- Is each likely customer a covered entity, and would the company be a business associate of it?
- What would a business associate contract require the product to do, or refuse to do, with health data?
- Which security measures fit the company’s size and systems, and where is that written down?
- How fast must the company be able to detect and report an incident, given a customer’s own deadline?
- If no covered entity is involved, does the FTC’s Health Breach Notification Rule apply?
- Does any feature meet the statutory definition of a device, and how does the product describe its intended use?
- Which answer changes if the product adds a customer type, a data field or an AI feature?
What this article cannot tell you
This article does not tell you whether you are a business associate, whether a rule applies, or whether your software is a device. It covers six pages read on October 10, 2026: four sections of 45 CFR as published by the Legal Information Institute, the FTC’s Health Breach Notification Rule page and the FDA’s device software page. It does not cover state health-privacy laws, patient consent, data use for research or product improvement, telehealth rules, prescribing, reimbursement, interoperability rules, or any country outside the United States. It does not describe penalties. These rules are amended and reinterpreted, so confirm anything you rely on against the current official text with a lawyer licensed where you operate.
In the data
These figures describe U.S. businesses in general, not WE’s results. Each one names its source.
Show the data as a table
| Firm age | Establishment exit rate, 2023, Health care and social assistance |
|---|---|
| Age 1 | 17.4% |
| Age 2 | 12.9% |
| Age 3 | 10.9% |
| Age 4 | 9.1% |
| Age 5 | 8.8% |
| Age 6 to 10 | 7.7% |
| Age 11 to 15 | 6.7% |
| Age 16 to 20 | 6.3% |
| Age 21 to 25 | 6.1% |
| Age 26 and older | 8.0% |
For comparison, across all sectors the rate was 25.7% at age 1 and 7.1% at 26 and older. Smaller sectors have fewer firms per class, so their rates move more from class to class.
Source: U.S. Census Bureau, Business Dynamics Statistics, sector by firm age , 2023
Retrieved 2026-10-16. Rates are the published establishment exit rates (exits in 2023 over the average count of establishments in 2022 and 2023), rounded to one decimal.
Sources
- 45 CFR 160.103: Definitions, Legal Information Institute, Cornell Law School (Electronic Code of Federal Regulations text) . Accessed October 10, 2026.
- 45 CFR 164.504: Uses and disclosures: Organizational requirements, Legal Information Institute, Cornell Law School (Electronic Code of Federal Regulations text) . Accessed October 10, 2026.
- 45 CFR 164.306: Security standards: General rules, Legal Information Institute, Cornell Law School (Electronic Code of Federal Regulations text) . Accessed October 10, 2026.
- 45 CFR 164.404: Notification to individuals, Legal Information Institute, Cornell Law School (Electronic Code of Federal Regulations text) . Accessed October 10, 2026.
- Complying with FTC's Health Breach Notification Rule, Federal Trade Commission . Accessed October 10, 2026.
- Device Software Functions Including Mobile Medical Applications, U.S. Food and Drug Administration . Accessed October 10, 2026.
Spotted an error? Read how we handle corrections in our editorial policy.