Disclaimer: Frameworks and orientation only. Not legal, regulatory, clinical, or compliance advice. Healthtech businesses need licensed counsel (HIPAA, FDA, fraud-and-abuse), clinical advisors, and qualified RA/QM specialists. Use this skill to organize strategy; engage specialists for binding decisions.

• Keywords
• Quick Start
• Core Workflows
• Tools
• Reference Guides
• Templates
• Best Practices

1. Write a 1-paragraph description of what your product does and what data it touches
2. Run

   python scripts/phi_scope_checker.py description.txt

3. Use the output to scope HIPAA exposure and identify whether you're a Business Associate, Covered Entity, neither, or both

1. Read

   references/gtm_patterns.md

2. Identify your buyer: payor, provider, employer, individual, pharma, government
3. Each GTM has a different sales motion, contract length, and economics — pick before committing engineering

1. Run PHI scope checker on your product description
2. Identify: do you handle PHI on behalf of a Covered Entity (you're a BA), are you a CE yourself, or are you handling consumer-generated health data outside HIPAA?
3. Map BAA requirements: with which Covered Entities you operate as BA, with which subcontractors you operate as BA-of-BA
4. Engage HIPAA-specialist counsel to review scope before launch
5. Operationalize: BA-grade hosting, encryption, access controls, audit logs, breach notification process

1. Read

   references/fda_samd_basics.md

2. Apply IMDRF risk categorization framework: severity of healthcare situation × significance of information
3. Determine FDA class (I, II, III) or unregulated wellness category
4. If regulated: pair with

   ra-qm-team/fda-compliance/

   and

   ra-qm-team/iec-62304-compliance/

   for the implementation work
5. If unregulated wellness: document why, and avoid claims that would cross into regulated territory

1. Read

   references/gtm_patterns.md

2. Map your product's value proposition to each buyer's purchase criteria
3. Recognize the constraints: payor 24-36 month sales cycles, provider IT integration, employer benefits-cycle timing
4. Pick one primary motion to start; expand later
5. Build the team that matches the motion — payor sales is different from provider sales is different from D2C

• references/hipaa_basics.md

  — HIPAA scope, Covered Entity vs Business Associate, BAA requirements, common pitfalls

• references/fda_samd_basics.md

  — Software as Medical Device classification, IMDRF framework, US vs EU

• references/gtm_patterns.md

  — Payor, provider, employer, individual, pharma, government — sales cycles, contract structures, decision criteria

• references/value_based_care_primer.md

  — Fee-for-service vs VBC, capitation, shared savings, ACOs, common models

• assets/hipaa_scope_template.md

  — Document template for capturing HIPAA scope decisions and BAA inventory

• Engage HIPAA counsel before architecture decisions. Same point as fintech: regulatory shapes infrastructure.
• Don't claim HIPAA compliance — be HIPAA compliant. Marketing claims attract regulator attention; the actual program protects the company.
• Don't conflate HIPAA and FDA. They cover different things. HIPAA = data; FDA = device.
• PHI vs consumer health data. Apple Health data, fitness tracker data, and consumer wellness data are not always PHI. The status depends on context (Covered Entity relationship), not the data type alone.
• Plan for state laws. California (CMIA), Washington (My Health My Data), and others extend beyond HIPAA. Texas, NY have their own.
• EHR integrations are slow. Epic, Cerner, athenahealth integrations take months and require partnership programs. Plan accordingly.

• ra-qm-team/

  for medical-device-grade compliance work (ISO 13485, MDR, FDA, IEC 62304)

• legal/

  for BAA / DPA templates and contract review

• engineering/cs-security-engineer

  — healthtech security goes beyond standard SaaS

• business-growth/pricing-strategy

  — healthtech pricing has unusual constraints (PMPM, capitation, fee-for-service)

• c-level-advisor/cs-fundraising-advisor

  — healthtech investor expectations differ from generic SaaS