healthcare-compliance git:20260920.2cbc56dA

Immutable. This exact content is served forever at /api/v1/blob/23c820a35cff5434.

---
name: healthcare-compliance
description: "Playbook for healthcare product compliance — FDA SaMD classification, IEC 62304 software lifecycle, ISO 14971 risk, IRB (clinical research), 21 CFR Part 11 (regulated records), HIPAA overlay."
---

## Codex host binding

- Treat references to Claude slash workflows as the equivalently named Codex skill.
- Before delegating to any specialist, read the `great-pm-runtime` skill and the selected packaged role file.
- Treat "invoke", "assign", "delegate", "spawn", and source Agent-tool instructions as a required Codex `spawn_agent` call with that role and a bounded assignment.
- For the spawn tool's `task_name` or `agent_name` identifier, replace canonical role-name hyphens with underscores (`query-refiner-pm` → `query_refiner_pm`). Keep canonical names unchanged in prompts, filenames, verdict logs, and user-facing output; this is an internal identifier mapping, not a role rename.
- Store every returned agent identifier. Never call a wait tool until a spawn has returned an identifier, and wait only on identifiers returned by successful spawns.
- If `spawn_agent` is unavailable or a spawn fails, report BLOCKED; do not impersonate the specialist or wait on an empty agent set.
- Resolve bundled paths from the installed GreatPM plugin root.
- Ignore Claude-only model aliases, colors, turn limits, and tool allowlists.
- Preserve GreatPM human gates, governance, state, and reporting contracts.


# Healthcare compliance — product-side playbook

Healthcare-compliance is wider than HIPAA. FDA regulates software that
makes clinical claims (SaMD). IEC 62304 governs medical-software
lifecycle. ISO 14971 covers risk management. 21 CFR Part 11 governs
electronic records in regulated environments. IRB governs human research.
PMs in healthcare need this map.

## 1. SaMD (Software as Medical Device) — the FDA frame

Per IMDRF, SaMD is classified by:
1. **Significance of information** (treat/diagnose vs inform vs drive
   decision support).
2. **Healthcare situation** (critical, serious, non-serious).

| Category | Significance | Situation | Examples |
|---|---|---|---|
| Class I | Inform | Non-serious | Wellness app; calorie counter |
| Class II (a) | Drive decision-support | Serious | Symptom-checker; risk-score app |
| Class II (b) | Drive decision-support | Critical | ICU dashboard with alarms |
| Class III | Treat/diagnose | Serious | Glucose monitoring with closed-loop |
| Class IV | Treat/diagnose | Critical | Closed-loop insulin delivery |

**PM rule of thumb**: if your product makes a clinical CLAIM (diagnose,
treat, monitor a specific condition), SaMD scope likely applies.
Wellness / general-fitness usually escapes — but the UI text matters.

## 2. FDA pathway (if SaMD)

- **510(k)**: substantial equivalence to an existing device. Most common
  path. 3-9 months typical.
- **De Novo**: novel device with no predicate; lower risk. 12+ months.
- **PMA (Premarket Approval)**: high-risk Class III/IV. Multi-year,
  expensive, clinical trials.
- **Exempt**: certain Class I devices.

**Predetermined Change Control Plan (PCCP)** is the modern path for AI
SaMD — lets you update models within a pre-cleared envelope without new
clearance.

## 3. IEC 62304 — medical software lifecycle

Mandatory for SaMD class B+ in most jurisdictions.

Required:
- Software development plan
- Requirements analysis
- Architectural design
- Detailed design (where applicable)
- Unit implementation + verification
- Software integration + testing
- Software system testing
- Software release
- Problem resolution
- Maintenance plan
- Configuration management
- Risk management (per ISO 14971)

**PM implication**: this isn't a checklist; it's a development discipline.
Building "fast and ship" doesn't survive IEC 62304 review.

## 4. ISO 14971 — risk management

Required for any medical device. Process:
1. Identify hazards.
2. Estimate risk (severity × probability).
3. Evaluate acceptability.
4. Control measures.
5. Residual risk evaluation.
6. Risk-benefit analysis.
7. Production + post-production information (post-market surveillance).

**Maintained throughout product life** — not a one-time exercise.

## 5. 21 CFR Part 11 — electronic records (FDA regulated)

Applies to electronic records used in FDA-regulated workflows:
- **Validation** of systems used for regulated records.
- **Audit trail**: secure, computer-generated, time-stamped, immutable.
- **Electronic signatures**: equivalent to handwritten.
- **Access controls**: unique IDs, password complexity, authority checks.

**Common context**: clinical trials, pharma manufacturing, lab data
(GLP/GMP), regulated submissions.

## 6. IRB (Institutional Review Board) — for human research

Required if your product involves:
- Research on humans (data collection or interaction).
- Even retrospective database research can require IRB.

**PM implication**: any user study that crosses into "research" needs
IRB review. Quick UX tests typically don't; structured comparative
studies often do.

## 7. ICH-GCP E6(R3) — clinical trials

Good Clinical Practice standard. Required for clinical trial software:
- Informed consent (versioned, traceable).
- AE/SAE reporting (24-hour window for serious).
- Audit trail per 21 CFR Part 11.
- Data integrity (ALCOA+).
- Source data verification.

## 8. EU regulatory frame

- **MDR (Medical Device Regulation 2017/745)**: EU's SaMD frame; in force.
- **IVDR (In Vitro Diagnostic Regulation)**: for diagnostics.
- **EU AI Act**: high-risk AI (including medical AI) has overlay
  obligations starting 2026.

## 9. HIPAA overlay

HIPAA is separate from FDA. They run in parallel:
- FDA cares about safety + efficacy of device.
- HIPAA cares about privacy + security of PHI.

You typically need BOTH for clinical software handling PHI.

## 10. SaMD-PM decision tree

```
Does the product touch PHI?
  YES → HIPAA applies (use hipaa-bundle skill)
  NO → HIPAA does not apply

Does the product make a clinical claim (diagnose/treat/monitor)?
  NO → Wellness path. Be careful with UI text; review claims.
  YES → SaMD scope likely. Continue:

    What's the significance + situation? (Class I-IV per IMDRF table)
    What's the FDA pathway? (510(k), De Novo, PMA, exempt)
    IEC 62304 + ISO 14971 apply.
    PCCP for AI model updates.
    Engage regulatory consultant early.
```

## 11. When great-pm agents consume this skill

| Agent | What it pulls from here |
|---|---|
| healthcare-pm-reviewer | SaMD classification triage; FDA pathway |
| ai-product-strategist | SaMD class → architectural constraints + timeline |
| ai-safety-pm | ISO 14971 risk management framing |
| spec-writer | Audit-trail spec (Part 11); consent UX (IRB) |
| ai-experimentation-pm | PCCP for AI model changes within FDA envelope |

## 12. References

- IMDRF SaMD: imdrf.org
- FDA Digital Health: fda.gov/medical-devices/digital-health-center-excellence
- IEC 62304: iec.ch
- ISO 14971: iso.org
- 21 CFR Part 11: fda.gov/regulatory-information/search-fda-guidance-documents
- EU MDR: ec.europa.eu/health/md_sector

## 13. The honesty filter

If a healthcare AI strategy says "we don't need FDA" without quoting the
exact UI text and arguing it doesn't claim clinical use, it probably does
need FDA. Get a regulatory opinion early; don't ship-then-fix.