Healthcare Software Development

Today the Security Rule requires administrative, physical, and technical safeguards: unique user identification, automatic logoff, encryption, and audit controls over every touch of ePHI, with documentation retained six years and breach notification within 60 days. If you process PHI on behalf of a provider or payer you are a business associate, directly liable, and you need a signed BAA with every covered entity and every subprocessor in your stack.

The proposed update removes the "addressable" escape hatch and makes the specifications mandatory. The HHS fact sheet lists multi-factor authentication, encryption at rest and in transit, a technology asset inventory and network map reviewed at least every 12 months, vulnerability assessments every six months, annual penetration testing, annual compliance audits, and 72 hour restoration procedures. The comment period closed on 7 March 2025 and the final rule has slipped: the OMB agenda now shows a July 2027 target for final action. Our advice is to build to the proposal now, because every item on that list is cheaper as a design decision than as a remediation project.

Regulation (EU) 2025/327, the European Health Data Space, entered into force on 26 March 2025. Implementing acts are due by March 2027. From March 2029, patient summaries, ePrescriptions, and eDispensations must be exchangeable across member states and the secondary use regime applies to most data categories. Medical images, laboratory results, discharge reports, and the remaining secondary use categories follow in March 2031.

If you hold health data above the SME threshold you are a data holder, and that is an engineering obligation, not a policy one. It means a FHIR facade carrying EEHRxF profiles over your existing system of record, a dataset metadata catalogue a Health Data Access Body can evaluate, a pseudonymization service that runs per permit under a permit-scoped key, an append-only audit ledger retained ten years, and opt-out handling checked at cohort build time. EHDS is federated: there is no central EU database, which means the work lands on you.

The FDA grades Software as a Medical Device by risk: general wellness and plain data display at the low end, clinical decision support requiring 510(k) notification in the middle, autonomous diagnostic or treatment decisions requiring premarket approval at the top. Most remote monitoring platforms with any interpretive layer land in the middle tier. In the EU, software that diagnoses, prevents, monitors, predicts, or treats is a medical device under the MDR, with clinical evaluation, conformity assessment, post-market surveillance, and CE marking.

The AI Act adds a third layer rather than replacing either. Article 6 classifies an AI system as high-risk when it is a safety component of a product covered by the Annex I harmonisation legislation, which includes the medical device rules, and that product requires third-party conformity assessment. Practical consequence: the same model behind a wellness feature and behind a clinical alert are two different regulatory objects. We map that boundary in discovery and, where the business case allows, design the first release to stay on the cheaper side of it.

In the EU, health data is a special category. Article 9 prohibits processing it outright unless a specific exception applies: explicit consent, provision of health or social care under a professional bound by secrecy, public interest in public health, or scientific research under Article 89 safeguards. Legitimate interest is not on that list, which quietly invalidates a lot of analytics architecture imported from other verticals.

Around that sit the operational obligations: a Data Protection Impact Assessment is mandatory for large-scale health data processing, breaches go to the supervisory authority within 72 hours rather than the 60 days HIPAA allows, erasure rights have to be reconciled with medical record retention law, and transfers out of the EU need a lawful mechanism. If you serve both markets, design to the stricter rule per obligation instead of picking one regime. Building for HIPAA first and adding GDPR later is the most common and most expensive sequencing mistake in this sector.