Healthcare app vs medical app development: which rules apply to your app?
The label on a store listing does not decide whether an app is a healthcare app or a medical app. Two separate questions do: does a feature meet the device definition under FDA policy, and does HIPAA or the FTC Health Breach Notification Rule govern the data it holds. Each answer creates different engineering work.
Which rules does each kind of app trigger?
Quick answer
Healthcare app vs medical app development turns on intended use and data relationships: a feature intended to diagnose, treat or mitigate a condition can be a device software function under FDA policy, while HIPAA applies only when you build for a covered entity or as its business associate. Agnotic Technologies maps every feature to both questions before design starts.
| Criterion | Healthcare app | Medical app |
|---|---|---|
| What decides it | Intended use and claims show no diagnosis, treatment or mitigation of disease | Intended use includes diagnosing, treating, mitigating or preventing a disease or condition |
| Typical features | Booking, reminders, records access, payments, education, general fitness | Dose calculators, analysis that suggests a condition, interpretation of connected meter readings |
| FDA position | Outside the device definition, or a general wellness product | Device software function; some under enforcement discretion, others need premarket review |
| Decision support | Not applicable | Clinician-facing CDS may meet the non-device criteria in section 520(o)(1)(E); patient-facing tools stay under device policies |
| Software lifecycle | Your normal engineering lifecycle and security practice | Design controls, risk management and a documented software lifecycle, commonly IEC 62304 |
| Privacy when you serve a provider or plan | HIPAA as a business associate, with a BAA | Same: HIPAA as a business associate, with a BAA |
| Privacy when you sell direct to consumers | FTC Health Breach Notification Rule if the app is a personal health record, plus state law | Same analysis: FDA status does not change who is a covered entity |
| Changes after launch | Release when ready | Assess each change against the cleared or authorized intended use |
| What to build first | Privacy notice, consent, breach workflow, audit logs | Same, plus requirements traceability, verification evidence and complaint handling |
What they are
What is Healthcare app
A healthcare app supports access, administration or a healthy lifestyle: booking, reminders, records access, payments, education or general fitness tracking. It makes no claim to diagnose, treat, cure, mitigate or prevent a disease, so its functions sit outside the device definition. Privacy rules still apply to its data.
What is Medical app
A medical app contains at least one software function that meets the device definition: it is intended to diagnose, treat, mitigate or prevent a disease or condition, for example by analysing readings from a connected meter to suggest a dose. FDA decides how each function is regulated; some low-risk functions fall under enforcement discretion.
Key differences
Why does intended use decide device status?
FDA looks at what the software is intended to do, and intended use shows up in your labeling, store listing, onboarding screens and marketing. The same code that counts steps is a wellness feature when it encourages activity and can become a device function when it claims to manage a disease. Review copy and claims with the same care as code.
What does the general wellness policy cover?
FDA's general wellness guidance, updated in January 2026, explains that section 3060(a) of the 21st Century Cures Act removed software functions intended for maintaining or encouraging a healthy lifestyle, and unrelated to the diagnosis, cure, mitigation, prevention or treatment of a disease or condition, from the device definition. Fitness, sleep and stress features usually live here as long as the claims stay general.
What is enforcement discretion for app functions?
FDA's Policy for Device Software Functions and Mobile Medical Applications describes device software functions that are the focus of FDA oversight and others that meet the device definition but for which FDA does not intend to enforce requirements. It also lists functions that are not devices at all. The engineering consequence differs: enforcement discretion is not the same as being outside the definition, so keep the evidence that supports your position.
Where does clinical decision support fit?
FDA's clinical decision support guidance, updated in January 2026, clarifies which CDS functions are excluded from the device definition by the non-device CDS criteria in section 520(o)(1)(E) of the FD&C Act, and states that FDA's existing digital health policies continue to apply to software functions that meet the device definition, including those intended for patients or caregivers. A risk score for a clinician and a symptom result for a patient can land on different sides of the line.
When does HIPAA apply to an app, and when does the FTC rule?
HIPAA applies when you are a covered entity or build and run the app for one as its business associate. A consumer app you offer directly is usually outside HIPAA. The FTC Health Breach Notification Rule, 16 CFR Part 318, applies to vendors of personal health records and related entities, and does not apply to HIPAA covered entities or to an entity acting as a business associate. One product can need both analyses if it has a consumer channel and a provider channel.
Can one app hold both kinds of function?
Yes. FDA's policies are written about software functions, so one app can contain functions on both sides of the line. Keep device functions in their own module with their own requirements, tests and release controls, so a change to booking or messaging does not reopen device verification, and a change to the dose logic gets the review it needs.
When to use each
When to use Healthcare app (no device functions)
- The product helps people book, pay, message or see their records.
- Fitness or sleep features encourage a healthy lifestyle and make no disease claim.
- Clinicians use it for scheduling, documentation or communication, not diagnosis.
- You want to ship and iterate without a premarket submission.
When to use Medical app (device software functions)
- The value of the product is a clinical output, such as a dose, a risk level or a suspected condition.
- The app interprets data from a connected medical device to guide treatment.
- You plan to make clinical claims in marketing or labeling.
- Payers or health systems will only adopt the product with FDA clearance or authorization.
How do common app features map to FDA and privacy rules?
These are typical positions for planning, not determinations. FDA decides device status, and your regulatory and privacy advisers confirm the position for your claims.
1. Step tracking with activity goals. Usually general wellness when no disease claim is made. Privacy: FTC rule for a consumer personal health record; HIPAA if built for a provider. Work: privacy notice, consent, breach workflow.
2. Appointment booking and reminders. Not a device function. Privacy: HIPAA when the app serves a provider. Work: BAA, audit logs, minimum necessary data in notifications.
3. Medication reminders that follow a prescribed schedule. Usually low risk, but check the position against FDA's device software functions policy, especially if reminders adapt to readings. Work: confirm the reminder never changes the dose and keep that rule in tests.
4. Symptom checker that suggests a likely condition. Can be a device function, especially for patients. Work: plan for design controls and clinical evaluation before you commit to the claim.
5. Dose calculator that recommends an insulin or drug dose. A device function with real risk. Work: device lifecycle, risk analysis, verification and, likely, premarket review.
6. Reading a connected glucose meter and showing trends. Displaying device data can sit outside the definition, while analysing it to guide treatment moves toward device territory. Work: separate display from interpretation in the architecture.
7. Clinician-facing risk score in a workflow. Check it against the non-device CDS criteria. Work: show the basis for the score so a clinician can review it independently, and record model versions.
Which sources does this comparison rely on?
- FDA guidance: Policy for Device Software Functions and Mobile Medical Applications (fda.gov)
- FDA guidance: General Wellness, Policy for Low Risk Devices, updated January 2026 (fda.gov)
- FDA guidance: Clinical Decision Support Software, updated January 2026 (fda.gov)
- 16 CFR Part 318: Health Breach Notification Rule (eCFR)