version: "1.0.0" name: healthcare-compliance description: Playbook for healthcare product compliance — FDA SaMD classification, IEC 62304 software lifecycle, ISO 14971 risk, IRB (clinical research), 21 CFR Part 11 (regulated records), HIPAA overlay. when_to_use: | Use when an initiative involves clinical decision-support, diagnosis, treatment recommendation, monitoring, clinical trial software, or regulated health-data processing. Primarily for healthcare-pm-reviewer, ai-product-strategist (SaMD class drives architecture), ai-safety-pm. allowed-tools: Read, Write, WebSearch, WebFetch

Healthcare compliance — product-side playbook

Healthcare-compliance is wider than HIPAA. FDA regulates software that makes clinical claims (SaMD). IEC 62304 governs medical-software lifecycle. ISO 14971 covers risk management. 21 CFR Part 11 governs electronic records in regulated environments. IRB governs human research. PMs in healthcare need this map.

1. SaMD (Software as Medical Device) — the FDA frame

Per IMDRF, SaMD is classified by:

1. Significance of information (treat/diagnose vs inform vs drive

decision support).

1. Healthcare situation (critical, serious, non-serious).

PM rule of thumb: if your product makes a clinical CLAIM (diagnose, treat, monitor a specific condition), SaMD scope likely applies. Wellness / general-fitness usually escapes — but the UI text matters.

2. FDA pathway (if SaMD)

• 510(k): substantial equivalence to an existing device. Most common

path. 3-9 months typical.

• De Novo: novel device with no predicate; lower risk. 12+ months.
• PMA (Premarket Approval): high-risk Class III/IV. Multi-year,

expensive, clinical trials.

• Exempt: certain Class I devices.

Predetermined Change Control Plan (PCCP) is the modern path for AI SaMD — lets you update models within a pre-cleared envelope without new clearance.

3. IEC 62304 — medical software lifecycle

Mandatory for SaMD class B+ in most jurisdictions.

Required:

• Software development plan
• Requirements analysis
• Architectural design
• Detailed design (where applicable)
• Unit implementation + verification
• Software integration + testing
• Software system testing
• Software release
• Problem resolution
• Maintenance plan
• Configuration management
• Risk management (per ISO 14971)

PM implication: this isn't a checklist; it's a development discipline. Building "fast and ship" doesn't survive IEC 62304 review.

4. ISO 14971 — risk management

Required for any medical device. Process:

1. Identify hazards.
2. Estimate risk (severity × probability).
3. Evaluate acceptability.
4. Control measures.
5. Residual risk evaluation.
6. Risk-benefit analysis.
7. Production + post-production information (post-market surveillance).

Maintained throughout product life — not a one-time exercise.

5. 21 CFR Part 11 — electronic records (FDA regulated)

Applies to electronic records used in FDA-regulated workflows:

• Validation of systems used for regulated records.
• Audit trail: secure, computer-generated, time-stamped, immutable.
• Electronic signatures: equivalent to handwritten.
• Access controls: unique IDs, password complexity, authority checks.

Common context: clinical trials, pharma manufacturing, lab data (GLP/GMP), regulated submissions.

6. IRB (Institutional Review Board) — for human research

Required if your product involves:

• Research on humans (data collection or interaction).
• Even retrospective database research can require IRB.

PM implication: any user study that crosses into "research" needs IRB review. Quick UX tests typically don't; structured comparative studies often do.

7. ICH-GCP E6(R3) — clinical trials

Good Clinical Practice standard. Required for clinical trial software:

• Informed consent (versioned, traceable).
• AE/SAE reporting (24-hour window for serious).
• Audit trail per 21 CFR Part 11.
• Data integrity (ALCOA+).
• Source data verification.

8. EU regulatory frame

• MDR (Medical Device Regulation 2017/745): EU's SaMD frame; in force.
• IVDR (In Vitro Diagnostic Regulation): for diagnostics.
• EU AI Act: high-risk AI (including medical AI) has overlay

obligations starting 2026.

9. HIPAA overlay

HIPAA is separate from FDA. They run in parallel:

• FDA cares about safety + efficacy of device.
• HIPAA cares about privacy + security of PHI.

You typically need BOTH for clinical software handling PHI.

10. SaMD-PM decision tree

Does the product touch PHI?
  YES → HIPAA applies (use hipaa-bundle skill)
  NO → HIPAA does not apply
 
Does the product make a clinical claim (diagnose/treat/monitor)?
  NO → Wellness path. Be careful with UI text; review claims.
  YES → SaMD scope likely. Continue:
 
    What's the significance + situation? (Class I-IV per IMDRF table)
    What's the FDA pathway? (510(k), De Novo, PMA, exempt)
    IEC 62304 + ISO 14971 apply.
    PCCP for AI model updates.
    Engage regulatory consultant early.

11. When great-pm agents consume this skill

12. References

• IMDRF SaMD: imdrf.org
• FDA Digital Health: fda.gov/medical-devices/digital-health-center-excellence
• IEC 62304: iec.ch
• ISO 14971: iso.org
• 21 CFR Part 11: fda.gov/regulatory-information/search-fda-guidance-documents
• EU MDR: ec.europa.eu/health/md_sector

13. The honesty filter

If a healthcare AI strategy says "we don't need FDA" without quoting the exact UI text and arguing it doesn't claim clinical use, it probably does need FDA. Get a regulatory opinion early; don't ship-then-fix.