healthcare

name	healthcare
description	Use when identifying healthcare regulations that apply to software handling health data or functioning as a medical device. Covers HIPAA, HITECH, FDA SaMD regulation, EU MDR, HITRUST, and health data privacy across jurisdictions. USE FOR: HIPAA, HITECH, PHI, FDA SaMD, EU MDR, HITRUST, health data privacy, medical device software, BAA, ePHI, clinical decision support, telehealth regulation, health app compliance DO NOT USE FOR: general data privacy (use privacy-data-protection), security controls implementation (use security skills), clinical validation methodology (consult regulatory affairs specialists)
license	MIT
metadata	{"displayName":"Healthcare Regulation","author":"Tyler-R-Kendrick"}
compatibility	claude, copilot, cursor
references	[{"title":"U.S. Department of Health & Human Services — HIPAA","url":"https://www.hhs.gov/hipaa/index.html"},{"title":"FDA Digital Health Center of Excellence","url":"https://www.fda.gov/medical-devices/digital-health-center-excellence"},{"title":"EU Medical Devices Regulation (MDR) (EUR-Lex)","url":"https://eur-lex.europa.eu/eli/reg/2017/745/oj"}]

Healthcare Regulation

Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.

Additional Warning: Healthcare regulatory violations carry severe penalties including criminal prosecution. HIPAA criminal penalties can include fines up to $250,000 and imprisonment up to 10 years for offenses committed with intent to sell or use PHI for personal gain. FDA enforcement for unauthorized medical devices can include injunctions, seizures, and criminal prosecution. Do not rely on this skill as a substitute for qualified healthcare regulatory counsel.

Overview

Healthcare software faces a dual regulatory burden — health data privacy laws AND medical device regulations if the software provides clinical decision support or diagnosis. The penalty landscape is severe, with regulators empowered to impose criminal sanctions, civil monetary penalties, and injunctive relief. Even unintentional violations can result in multi-million-dollar settlements, mandatory corrective action plans, and years of monitoring. Understanding both dimensions of healthcare regulation is essential before building any software that touches health data or clinical workflows.

Health Data Privacy Laws

Law	Jurisdiction	Scope	Protected Data	Penalties
HIPAA Privacy Rule	US	Covered entities + business associates	PHI (Protected Health Information)	Up to $1.5M/year per violation category
HIPAA Security Rule	US	Covered entities + business associates handling ePHI	ePHI (electronic Protected Health Information)	Up to $1.5M/year per violation category
HITECH Act	US	Expands HIPAA to business associates + breach notification	PHI	Increased penalties + state Attorney General enforcement
UK GDPR + NHS Code of Practice	UK	Health data processors	Special category data	Up to £17.5M or 4% global revenue