--- name: healthtech-advisor description: > Strategic advisory for digital health founders on HIPAA scope, FDA SaMD classification, EHR integration, and payor/provider GTM. Use when scoping a healthtech idea, classifying PHI, or mentioning HIPAA, FDA SaMD, EHR, or telehealth. license: MIT + Commons Clause metadata: version: 1.0.0 author: borghei category: vertical-advisors domain: healthtech updated: 2026-05-04 python-tools: phi_scope_checker.py tech-stack: healthtech, digital-health --- # Healthtech Advisor Strategic frameworks for digital health and healthtech founders, operators, and product leaders. **Complements** (does not replace) the RA/QM compliance domain. RA/QM covers regulatory and quality management for medical devices; this skill covers business-side strategy for health software companies. > **Disclaimer:** Frameworks and orientation only. Not legal, regulatory, clinical, or compliance advice. Healthtech businesses need licensed counsel (HIPAA, FDA, fraud-and-abuse), clinical advisors, and qualified RA/QM specialists. Use this skill to organize strategy; engage specialists for binding decisions. --- ## Table of Contents - [Keywords](#keywords) - [Quick Start](#quick-start) - [Core Workflows](#core-workflows) - [Tools](#tools) - [Reference Guides](#reference-guides) - [Templates](#templates) - [Best Practices](#best-practices) --- ## Keywords healthtech, digital health, HIPAA, PHI, BAA, business associate, covered entity, FDA SaMD, software as medical device, EHR, EMR, FHIR, HL7, telehealth, digital therapeutics, DTx, payor, provider, value-based care, fee-for-service, RPM, remote patient monitoring --- ## Quick Start ### 10-Minute Scope Check 1. Write a 1-paragraph description of what your product does and what data it touches 2. Run `python scripts/phi_scope_checker.py description.txt` 3. Use the output to scope HIPAA exposure and identify whether you're a Business Associate, Covered Entity, neither, or both ### Pick a GTM 1. Read `references/gtm_patterns.md` 2. Identify your buyer: payor, provider, employer, individual, pharma, government 3. Each GTM has a different sales motion, contract length, and economics — pick before committing engineering --- ## Core Workflows ### Workflow 1: HIPAA Scope and BAA Strategy **Goal:** Determine whether HIPAA applies, in what capacity (Covered Entity, Business Associate, neither), and what BAAs you need with whom. **Steps:** 1. Run PHI scope checker on your product description 2. Identify: do you handle PHI on behalf of a Covered Entity (you're a BA), are you a CE yourself, or are you handling consumer-generated health data outside HIPAA? 3. Map BAA requirements: with which Covered Entities you operate as BA, with which subcontractors you operate as BA-of-BA 4. Engage HIPAA-specialist counsel to review scope before launch 5. Operationalize: BA-grade hosting, encryption, access controls, audit logs, breach notification process **Time Estimate:** 4-8 weeks for first scope and BAA template. ### Workflow 2: FDA SaMD Classification **Goal:** Determine whether your software is regulated as a medical device by the FDA, and at which classification. **Steps:** 1. Read `references/fda_samd_basics.md` 2. Apply IMDRF risk categorization framework: severity of healthcare situation × significance of information 3. Determine FDA class (I, II, III) or unregulated wellness category 4. If regulated: pair with `ra-qm-team/fda-compliance/` and `ra-qm-team/iec-62304-compliance/` for the implementation work 5. If unregulated wellness: document why, and avoid claims that would cross into regulated territory **Time Estimate:** 4-12 weeks for classification, then RA/QM-driven submission timelines. ### Workflow 3: GTM Selection **Goal:** Pick the buyer segment and sales motion that matches your product. **Steps:** 1. Read `references/gtm_patterns.md` 2. Map your product's value proposition to each buyer's purchase criteria 3. Recognize the constraints: payor 24-36 month sales cycles, provider IT integration, employer benefits-cycle timing 4. Pick **one** primary motion to start; expand later 5. Build the team that matches the motion — payor sales is different from provider sales is different from D2C **Time Estimate:** 4-8 weeks for GTM strategy decision. --- ## Tools ### phi_scope_checker.py Scans a product description for indicators of PHI handling and HIPAA scope. Identifies whether you're likely a Covered Entity, Business Associate, both, or operating outside HIPAA (consumer wellness data). ```bash python scripts/phi_scope_checker.py description.txt python scripts/phi_scope_checker.py description.txt --json ``` --- ## Reference Guides - **`references/hipaa_basics.md`** — HIPAA scope, Covered Entity vs Business Associate, BAA requirements, common pitfalls - **`references/fda_samd_basics.md`** — Software as Medical Device classification, IMDRF framework, US vs EU - **`references/gtm_patterns.md`** — Payor, provider, employer, individual, pharma, government — sales cycles, contract structures, decision criteria - **`references/value_based_care_primer.md`** — Fee-for-service vs VBC, capitation, shared savings, ACOs, common models --- ## Templates - **`assets/hipaa_scope_template.md`** — Document template for capturing HIPAA scope decisions and BAA inventory --- ## Best Practices - **Engage HIPAA counsel before architecture decisions.** Same point as fintech: regulatory shapes infrastructure. - **Don't claim HIPAA compliance — be HIPAA compliant.** Marketing claims attract regulator attention; the actual program protects the company. - **Don't conflate HIPAA and FDA.** They cover different things. HIPAA = data; FDA = device. - **PHI vs consumer health data.** Apple Health data, fitness tracker data, and consumer wellness data are not always PHI. The status depends on context (Covered Entity relationship), not the data type alone. - **Plan for state laws.** California (CMIA), Washington (My Health My Data), and others extend beyond HIPAA. Texas, NY have their own. - **EHR integrations are slow.** Epic, Cerner, athenahealth integrations take months and require partnership programs. Plan accordingly. --- ## Integration Points - **`ra-qm-team/`** for medical-device-grade compliance work (ISO 13485, MDR, FDA, IEC 62304) - **`legal/`** for BAA / DPA templates and contract review - **`engineering/cs-security-engineer`** — healthtech security goes beyond standard SaaS - **`business-growth/pricing-strategy`** — healthtech pricing has unusual constraints (PMPM, capitation, fee-for-service) - **`c-level-advisor/cs-fundraising-advisor`** — healthtech investor expectations differ from generic SaaS