united-states software health
Can i create a software which can store doctor prescription?
<p>I have developed a software which can store doctors prescription digitally. wondering if there would any legal complications on it. Any laws preventing that sort of software/practice in united states. </p>

<p>the user basically would manually re-enter what is in prescription into this app.</p>

<p>Your basic regulatory umbrella for anything that stores, transmits or interacts with any private health information or health IT systems is <a href="https://www.hhs.gov/hipaa/index.html" rel="nofollow noreferrer">Health Information Privacy | HHS.gov</a>, as well as state authorities. There are severe penalties at the federal and state level for non-compliance and privacy breaches, and many other agencies - such as the DEA, state health departments, insurance companies - would have to be involved in testing and certification of such a App.</p>

<p>You will simply not be able to distribute the App on Google or iTunes without their approval, and those distributors will not approve a App that has not been strictly vetted for privacy and HIPAA compliance.</p>

<p>In order to distribute such as App - with a TOS that assures personal privacy and shields you from liability (if possible) - you will need to spend hundreds of thousands of dollars on legal representation for compliance. As an example, see ohwilleke's answer to <a href="https://law.stackexchange.com/questions/22126/what-kind-of-lawyer-should-i-seek-to-understand-compliance-requirements-for-proc/22128#22128">What kind of lawyer should I seek to understand compliance requirements for processing credit cards?</a></p>

<p>Prescription systems are designed to insure that a prescription can be filled only once. All the stakeholders (state health department, DEA, physicians, pharmacies) must be convinced any system will accomplish that goal. I don't know if there is a formal permit system to authorize the system.</p>

<p>If the system isn't used to fill prescriptions, but just help the patient keep track of them, there are still medical privacy issues. I don't know if there are any government permissions required before the service is offered, but the company running the service is likely to face serious consequences if the security of the system is breached (or if the company is foolish enough to share information with third parties, such as advertisers).</p>

<p>Unless this software is running <strong>only</strong> on the patient's own personal computer, and is not networked anywhere, such a system in the US would need to comply with the requirements of the <a href="https://en.wikipedia.org/wiki/Health_Insurance_Portability_and_Accountability_Act" rel="nofollow noreferrer">Health Insurance Portability and Accountability Act</a>  (HIPAA). This requires that &quot;protected Health Information&quot; (PHI) be stored protected by encryption or other security methods approved by the federal government, that users of the system be restricted by enforceable contracts not to improperly access or use such information, and a number of other requirements. I work on software designed for hospitals which stores patient information, including Rx and diagnosis info, and we have to take this into account at every stage of design. The penalties for violating the HIPAA rules are sizable, potentially enough to bankrupt even a major corporation (although they usually are not enforced to the theoretical legal limit).</p>
<p>I do not believe that you need an advance license, but you need to review the HIPAA requirements very carefully.</p>
<p>Exactly what precautions such software would need to take would depend on how it is intended to be used, and by whom, and where PHI would be stored. This is a potentially tricky area, and you should consult both legal and software experts in the specific field of HIPAA compliance, <strong>before</strong> trying to market any such software, or load information about any real people into it. Test data about purely fictional individuals is safe.</p>
<p>If the software is to be used to trnasmit prescriptions for dispensing, there are additional state and federal requirements under the Controlled Substances act and various state laws. These may require a permit in advance, I am not sure.</p>
