What do you do when the deadline is already on the calendar?
Ten situations a healthcare company arrives in, each written as a sequence of actions with the timing attached. Every page opens with what set the clock running and what it costs to do nothing, then gives the order the work runs in and what is finished before the date.
Which situations land on a CEO?
what to do after HIPAA audit findings
How to sort HIPAA audit findings by the clock each one starts, which of them carry a deadline in 45 CFR Part 164 and which do not, and what a closed finding has to leave behind.
A report has arrived naming findings against your handling of electronic protected health information, sent by a customer's assessor, by an internal evaluation or by a regulator, and somebody is now asking you for a date against each line.
healthcare software audit preparation
What an auditor reads before opening your product, which parts of an incomplete record can still be closed before the date, and which parts of it cannot be closed at any price.
A date has been set. A notified body auditor, an FDA investigator, a HITRUST external assessor or a customer's security team is arriving, and nobody has opened the evidence since the last release went out.
how to choose healthcare QA vendor
How to weigh what a healthcare testing supplier tells you, why four proposals can quote different numbers for the same words, and what to do about a question nobody will answer in writing.
Three or four proposals are on your desk. Every one of them says it signs a Business Associate Agreement and works to HIPAA, the wording barely differs between them, and the prices are far enough apart that the gap has to mean something.
EU MDR software market entry testing
The EU obligations attach at placing on the market, not at release. What has to exist before that day, which parts of a US record set carry over, and what sets the calendar.
A European launch date is on the plan with a quarter against it. The assumption underneath it is that the files already assembled for the United States will be relabelled, translated and reused.
how to prepare software for FDA submission testing
Which decisions about a submission file were already made before anyone opened a test tool, which edition of each standard your records answer to, and what is still open in the week you ask.
A submission date is on the board, and the software evidence is being pulled together out of records the team wrote for other reasons.
technical due diligence healthtech startup
What a diligence team opens first in a healthtech data room, what an absent record does to the price, and which questions get answered in the room instead of out of a file.
Access has been granted. An acquirer's technical reviewers, a partner's architecture team or an enterprise customer's security reviewers are inside the repository, the policy set and the test records, and their first list of follow-up questions is being written out of what they did not find.
Which situations land on a founder?
do I need HIPAA compliance testing for my app
How the definitions at 45 CFR 160.103 decide whether HIPAA reaches your product, and what has to happen first once the answer is yes.
A customer's security questionnaire, a hospital pilot contract or an investor's diligence list has asked whether the product is HIPAA compliant, and nobody inside the company can say whether the rule reaches it at all.
is my health app a medical device
Qualification is decided by the intended purpose you publish. The European test: what Article 2(1) of the MDR asks, what Rule 11 adds, what to settle now.
An investor's diligence list, a hospital procurement questionnaire or a distributor's legal team has asked for the product's regulatory status, and nobody on the team has written the answer down.
QA requirements for digital health startup
Which QA obligations start collecting evidence on a date you cannot move, which of them can be added at any time, and what a founder switches on before the first provider contract.
The product works, a first provider contract or a first patient record is close, and nobody has decided what QA has to exist by then. There is no QA function yet, and nothing has been asked of the company so far.
QA readiness for Series A healthtech
Which regulatory questions on a diligence list can still be answered before a round closes, which were settled by a date that has already passed, and what the weeks in between are actually good for.
A term sheet is signed or a lead investor's diligence request has arrived, the round has a date on it, and somebody now has to put a written answer against every regulatory line on the list.
What does validating your product actually involve?
Answer four questions about your markets, your product type and its integrations. You get the standards that reach you, the artefacts each one asks you to produce, and which of them a test supplier delivers.