I have developed a software which can store doctors prescription digitally. wondering if there would any legal complications on it. Any laws preventing that sort of software/practice in united states.

the user basically would manually re-enter what is in prescription into this app.


Your basic regulatory umbrella for anything that stores, transmits or interacts with any private health information or health IT systems is Health Information Privacy | HHS.gov, as well as state authorities. There are severe penalties at the federal and state level for non-compliance and privacy breaches, and many other agencies - such as the DEA, state health departments, insurance companies - would have to be involved in testing and certification of such a App.

You will simply not be able to distribute the App on Google or iTunes without their approval, and those distributors will not approve a App that has not been strictly vetted for privacy and HIPAA compliance.

In order to distribute such as App - with a TOS that assures personal privacy and shields you from liability (if possible) - you will need to spend hundreds of thousands of dollars on legal representation for compliance. As an example, see ohwilleke's answer to What kind of lawyer should I seek to understand compliance requirements for processing credit cards?

  • thanks a lot for the information.any idea on how long the process takes.
    – user109245
    Oct 31 '18 at 16:09
  • Hard to say; probably months to years. Oct 31 '18 at 16:14

Prescription systems are designed to insure that a prescription can be filled only once. All the stakeholders (state health department, DEA, physicians, pharmacies) must be convinced any system will accomplish that goal. I don't know if there is a formal permit system to authorize the system.

If the system isn't used to fill prescriptions, but just help the patient keep track of them, there are still medical privacy issues. I don't know if there are any government permissions required before the service is offered, but the company running the service is likely to face serious consequences if the security of the system is breached (or if the company is foolish enough to share information with third parties, such as advertisers).

  • thanks a lot for the answer, from a privacy perspective our software is encrypted and aswell designed that only users can view their own prescription and no one else can see that. do you know who to reach out or where to find if this is allowed to do. we are also looking to file a patent around it. thank you!
    – user109245
    Oct 31 '18 at 15:58
  • I don't know any details of what permits might be required or who to ask about permits. Oct 31 '18 at 17:32

Unless this software is running only on the patient's own personal computer, and is not networked anywhere, such a system in the US would need to comply with the requirements of the Health Insurance Portability and Accountability Act (HIPPA). This requires that "protected Health Information" (PHI) be stored protected by encryption or other security methods approved by the federal government, that users of the system be restricted by enforceable contracts not to improperly access or use such information, and a number of other requirements. I work on software designed for hospitals which stores patient information, including Rx and diagnosis info, and we have to take this into account at every stage of design. The penalties for violating the HIPPA rules are sizable, potentially enough to bankrupt even a major corporation (although they usually are not enforced to the theoretical legal limit).

I do not believe that you need an advance license, but you need to review the HIPPA requirements very carefully.

Exactly what precautions such software would need to take would depend on how it is intended to be used, and by whom, and where PHI would be stored. This is a potentially tricky area, and you should consult both legal and software experts in the specific field of HIPPA compliance, before trying to market any such software, or load information about any real people into it. Test data about purely fictional individuals is safe.

If the software is to be used to trnasmit prescriptions for dispensing, there are additional state and federal requirements under the Controlled Substances act and various state laws. These may require a permit in advance, I am not sure.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.