Consumer HealthTech security — HIPAA-adjacent + state biometric + AI diagnostic claims
Consumer HealthTech that is NOT a covered entity under HIPAA still faces state biometric laws (BIPA in IL, BIPA-equivalents in other states) + GDPR-K + EU AI Act (if making diagnostic claims).
Top security risks
BIPA biometric-data violation
Apps capturing facial recognition / fingerprint without explicit informed consent face IL BIPA + emerging state-level equivalents.
EU AI Act high-risk classification (medical)
AI diagnostic / triage claims = Annex III high-risk OR Annex II medical-device, both heavily regulated.
FTC mishealth claims
Diagnostic claims without FDA clearance = FTC enforcement.
Sensitive-data leak via analytics SDKs
Standard analytics SDKs (Segment, Mixpanel) leak health data when not configured to redact.
Regulatory context
BIPA (IL biometric), HIPAA (if covered entity), FDA (medical device), FTC (false claims), GDPR + EU AI Act + EU MDR (EU users).
Checklist
- BIPA-style explicit consent for any biometric capture
- FDA SaMD classification self-assessment
- FTC-cleared marketing claims (no diagnostic without clearance)
- Analytics-SDK PII redaction
- Per-region data residency
- EU AI Act Annex III / Annex II self-classification
Consumer health buyers (the user) signal trust via clear privacy policy + biometric-consent flows + visible data-deletion controls + EU AI Act / FDA classification disclosure.