Zoom in to read the detail
Last updated: Nov 5, 2026
Overarching Legislation: FD&C Act (1938) what counts as a drug or device · HIPAA (1996) privacy baseline · HITECH (2009) $30B+ to adopt EHRs · ACA (2010) Medicaid expansion, marketplaces, CMMI, ACOs, Sunshine Act · MACRA (2015) quality-based Medicare pay · 21st Century Cures (2016) information blocking, APIs, CDS carve-out, RWE framework. Most of the agencies below sit inside HHS; the rest are the FTC, DEA, Education, the courts and the states.
FTC · data handling rules for consumer apps that fall outside of HIPAA: deceptive claims (UDAP), breach notice (HBNR), COPPA for under-13s
FDA · safety, efficacy, marketing rules. CDRH (devices, including SaMD): is it a device? Intended use and claims decide, not the hardware. General wellness → not regulated (see the 2026 update below). CDS → exempt only if the clinician can check the basis. SaMD → Class I / II / III, cleared via 510(k), De Novo or PMA; Breakthrough Devices speeds review; AI devices need GMLP and a PCCP; connected devices, cybersecurity (524B). CDER / CBER (drugs, biologics): IND → trials → NDA / BLA; a drug packaged with an app is a combination product; DTC drug ads are policed by OPDP. Investigational use of anything needs an IND or IDE plus an IRB. RWD/RWE from devices and apps increasingly count as evidence. TEMPO: use inside CMS's ACCESS Model before clearance.
OCR · HIPAA for covered entities (providers, plans, clearinghouses) and their business associates (BAAs): all BA's (like digital health companies) need to handle data according to HIPAA requirements and are liable for information breaches · ACA Section 1557: no discriminatory algorithms or decision tools
Department of Education · FERPA governs student records, including a lot of school health data, instead of HIPAA
States & AGs · privacy laws (CCPA/CPRA, CMIA, MHMDA); AI laws (CA, CO, IL, NY); Attorneys General investigate and sue
ONC / ASTP · certifies EHRs (CEHRT: USCDI, FHIR APIs), enforces information blocking rules to allow data exchange, runs TEFCA
CMS · Medicare: PFS codes & rates, coverage (NCD/LCD), MA Star Ratings · Medicaid: 1115 waivers, ILOS, MCO rules · CCIIO: ACA plans
Public health & local government · CDC and state agencies run registries (IIS, PDMP) and surveillance; local budgets fund school health
Courts · product liability and malpractice apply with no new law needed (see the Character.AI and OpenAI suits)
OIG / DOJ · AKS ('free' software needs a safe harbor), Stark, FCA · Sunshine Act: payments to doctors go public
Buyer gates · not law, but required to sell: SOC 2 / HITRUST, a signed BAA, EHR integration, an IRB for any pilot with patients
States · licensure & scope of practice (only humans), CPOM → MSO + PC, IMLC · DEA controlled substances Rx · SAMHSA 42 CFR Part 2
CMMI · tests new payment models: ACCESS (tech-enabled chronic care; FDA's TEMPO rides along), ASPIRE & InCK (Medicaid kids), ACOs
EU · GDPR, the MDR and the AI Act apply the moment you have a European user
New in 2026 · FDA's January 6, 2026 guidance. General wellness: a non-invasive wearable can now estimate blood pressure, blood glucose, SpO2 or HRV and stay outside FDA oversight, as long as the claims stay wellness-only (sleep, activity, stress): no disease names, no clinical thresholds, no 'medical grade' claims, no ongoing disease monitoring; a 'consider seeing a clinician' nudge is fine. CDS: software may now propose a single treatment plan rather than a list of options, as long as the clinician reviews, revises and finalizes it and can see the basis; analyzing images or signals is still a device.
Patient & Family
Generates the data: wearables, apps, portal visits. Pays premiums, taxes, copays and sometimes a D2C subscription. About half of US kids are on Medicaid or CHIP.
Generates the data: wearables, apps, portal visits. Pays premiums, taxes, copays and sometimes a D2C subscription. About half of US kids are on Medicaid or CHIP.
Pharma & MedTech
Drug, biologic and device makers. To the DH company, they are a customer, a data provider, or a distribution channel (the app ships with the device/pharma product). Sometimes the Pharma or MedTech company is the DH company.
Drug, biologic and device makers. To the DH company, they are a customer, a data provider, or a distribution channel (the app ships with the device/pharma product). Sometimes the Pharma or MedTech company is the DH company.
Digital Health Company
App, device, SaMD, DTx, SaaS. Or, a pharma or device company's digital arm. Sells D2C, by subscription (SaaS, PMPM), or bills insurance itself, which requires licensed clinicians (MSO + PC). HIPAA applies to DH company through a BAA.
App, device, SaMD, DTx, SaaS. Or, a pharma or device company's digital arm. Sells D2C, by subscription (SaaS, PMPM), or bills insurance itself, which requires licensed clinicians (MSO + PC). HIPAA applies to DH company through a BAA.
Providers: Clinicians & Health Systems
Generally, only licensed humans can deliver care. The EHR records it in SNOMED CT, LOINC, RxNorm; bills it in ICD-10-CM + CPT/HCPCS. Share records via HIE, TEFCA/QHINs; report to IIS, PDMP.
Generally, only licensed humans can deliver care. The EHR records it in SNOMED CT, LOINC, RxNorm; bills it in ICD-10-CM + CPT/HCPCS. Share records via HIE, TEFCA/QHINs; report to IIS, PDMP.
Health Insurance
Medicare (Parts A, B, C = MA, D). Medicaid & CHIP, mostly via MCOs (EPSDT guarantees kids' benefits). Commercial & employer plans (ESI, self-insured via a TPA), PBMs. Funded by premiums and taxes; CMS sets the fee schedule.
Medicare (Parts A, B, C = MA, D). Medicaid & CHIP, mostly via MCOs (EPSDT guarantees kids' benefits). Commercial & employer plans (ESI, self-insured via a TPA), PBMs. Funded by premiums and taxes; CMS sets the fee schedule.
Schools, CBOs & Public Agencies
The other sector, especially for kids: school-based health (bills Medicaid), CBOs, local programs, public health. School records: covered under FERPA, not HIPAA. Pays for prevention whose savings aren't seen in the health sector.
The other sector, especially for kids: school-based health (bills Medicaid), CBOs, local programs, public health. School records: covered under FERPA, not HIPAA. Pays for prevention whose savings aren't seen in the health sector.
Value-based care depends on quality metrics: HEDIS (NCQA) · Star Ratings (MA) · Child & Adult Core Sets (Medicaid/CHIP) · MIPS/QPP & Promoting Interoperability · eCQMs · CAHPS · HCC risk adjustment · SDOH/HRSN screening
Digital health on one page
An overview of the legislation, finances, and data flow in digital health.
Rules & regulators
Data
Money
Distribution
Ad hoc data sharing
RULES
DATA
STAKEHOLDERS
MONEY
QUALITY
Distribution: the app ships with the
drug or device as a digital companion
drug or device as a digital companion
Device data streams (CGMs, inhalers,
implants) and clinical trial data
implants) and clinical trial data
FHIR · SMART on FHIR · CDS Hooks
HL7 v2 · C-CDA · USCDI
HL7 v2 · C-CDA · USCDI
Claims: X12 837 in, 835 remittance back
Prior auth · quality reporting (eCQMs)
Prior auth · quality reporting (eCQMs)
Patient-generated data: wearables, apps, RPM/RTM streams
HIPAA and Consumer Protection laws apply to data handling
HIPAA and Consumer Protection laws apply to data handling
Ad hoc data sharing: screenings, referrals, attendance,
program outcomes (data use agreements, FERPA consent)
program outcomes (data use agreements, FERPA consent)
Visits and the patient portal: notes and results released after they're signed/finalized
Patient-access FHIR API: the EHR must hand the record to any app the patient picks (e.g., Apple Health)
Patient-access FHIR API: the EHR must hand the record to any app the patient picks (e.g., Apple Health)
Patient Access API (FHIR): the plan must hand claims
and clinical data to whatever app the member picks
and clinical data to whatever app the member picks
Buys companion apps, patient support
programs, RWE and clinical trial recruitment
programs, RWE and clinical trial recruitment
Capitated revenue: subscription (SaaS,
PMPM) paid by the health system
PMPM) paid by the health system
Fee-for-service: per CPT/HCPCS code, DRGs
VBC: capitation (PMPM), ACO shared savings
VBC: capitation (PMPM), ACO shared savings
Medicaid pays school-based
health centers (SBHCs)
and EPSDT services
health centers (SBHCs)
and EPSDT services
Direct to consumer (D2C): subscriptions,
app stores, HSA/FSA dollars
app stores, HSA/FSA dollars
Capitated revenue from plans & employers (PMPM / PEPM), or billable to insurance:
the company bills the payer itself for eligible supplies or health services
the company bills the payer itself for eligible supplies or health services
Other payers: grants & contracts from schools, CBOs, public agencies
The wrong-pocket problem: who pays isn't who saves
The wrong-pocket problem: who pays isn't who saves
Premiums (plus the taxes that fund Medicare and Medicaid);
cost sharing (copays, deductibles) when care is used
cost sharing (copays, deductibles) when care is used
Questions, comments, or feedback? Email aydinz@stanford.edu. Many thanks to Meghana Nerurkar for inspiring the creation of this diagram.
Learn more about our Biodesign for Digital Health course here.
Learn more about our Biodesign for Digital Health course here.