Regulatory Compliance for Digital Health

Digital health regulation operates across at least four overlapping jurisdictions that founders routinely treat as a single problem. Federal agencies — primarily the FDA, the FTC, and CMS — set baseline requirements for software safety, advertising claims, and reimbursement eligibility. State medical boards regulate who can practice medicine and where. State insurance commissioners regulate what must be covered and how. Professional licensing bodies determine which services can be delivered by which clinical credential. A company that achieves FDA clearance and then ignores state medical practice law has solved one problem and ignored three others.

The FDA's authority over digital health products derives from its device authority under the Federal Food, Drug, and Cosmetic Act. In 2016, the 21st Century Cures Act and subsequent guidance clarified that software functions intended to treat, diagnose, or prevent disease meet the definition of a medical device — while software for administrative workflows, general wellness, or clinical decision support that a clinician uses as one input among many generally does not. The critical variable is clinical intended use: the same algorithm that suggests a health tip is a wellness product, but the same algorithm that identifies atrial fibrillation from a waveform is a Class II medical device subject to 510(k) clearance.

FDA device classification determines the regulatory pathway. Class I devices — low risk, like bandages and tongue depressors — require only general controls. Class II devices — moderate risk, like most Software as a Medical Device — typically require 510(k) premarket notification, where you demonstrate substantial equivalence to a legally marketed predicate device. Class III devices — high risk, like implantable cardiac monitors — require premarket approval, which involves full clinical trials. Most digital health software, if it requires FDA clearance at all, lands in Class II. The 510(k) pathway typically takes six to twelve months and requires documented evidence of safety and effectiveness relative to the predicate.

Software as a Medical Device — abbreviated SaMD — is the FDA's category for software that performs a medical purpose without being part of a hardware device. Regulatory requirements for SaMD scale with the severity of the condition being managed and the degree to which the software's output directly drives clinical decisions. An app that monitors blood glucose trends and alerts the care team is SaMD. An app that reports calorie intake has no medical intended use and is not SaMD. The FDA's Software as a Medical Device guidance document and the International Medical Device Regulators Forum framework are the primary reference documents for making this determination.

State medical practice law creates the most operationally complex regulatory layer for telemedicine companies. The dominant rule is that a physician-patient relationship is established in the state where the patient is located at the time of service, which means a clinician licensed only in California cannot legally treat a patient sitting in New York. Companies that operate across multiple states must either employ clinicians licensed in each state or operate through a physician staffing model that manages licensure geographically. Interstate licensure compacts — the Interstate Medical Licensure Compact for physicians and similar compacts for nurses and psychologists — have partially eased this burden by enabling streamlined multi-state licensure, but coverage is still incomplete.

The FTC's role in digital health is narrower but frequently underestimated. The FTC Act prohibits unfair or deceptive acts in commerce, which means health product claims that cannot be substantiated by competent and reliable scientific evidence are actionable. Companies that claim their app reduces anxiety, improves sleep, or manages chronic conditions without adequate clinical evidence are exposed to FTC enforcement independent of FDA jurisdiction. The FTC has taken enforcement action against numerous digital health companies in the past decade, and its standard for substantiation — two randomized controlled trials for efficacy claims — is higher than most early-stage startups appreciate.

Corporate practice of medicine — often abbreviated CPOM — is a doctrine in most states that prohibits a corporation from employing physicians or controlling medical decision-making. This creates a structural problem for digital health companies that want to employ clinicians directly: they cannot, in most states, own a medical practice. The common workaround is a management services organization structure, in which the technology company provides administrative, operational, and technology services to a separately owned professional corporation that holds the clinical entity and employs the physicians. Building this structure correctly from the start is dramatically cheaper than restructuring it after a state enforcement inquiry.