.svg)
Healthcare is the vertical where AI MVPs go to die slowly. Not because the models don't work, but because teams discover in month four that the architecture they built can't legally hold the data they need.
We've watched that happen. It's avoidable, and avoiding it is mostly a scoping decision made in week one.
This guide covers what to build, how long it takes, and what HIPAA genuinely requires, with every regulatory claim traced to the rule or guidance it comes from. It also says plainly where the popular advice is wrong, including the widespread belief that you can buy your way to compliance from a vendor.
What Is a Healthcare AI MVP?
A healthcare AI MVP is the smallest version of your product that lets a real clinician, administrator, or patient complete one workflow and tell you whether it's better than what they do now.
The definition is the same as any AI MVP. What changes is the environment around it.
That second constraint reshapes everything downstream. It sets your hosting, your vendor list, your contracts, your logging, your review process, and your timeline. It is not a phase at the end of the build. Teams that treat it as one pay for the build twice.
What Should Version One Actually Include?
One workflow. One user role. One measurable claim you're testing.
Healthcare products attract scope the way nothing else does, because every stakeholder has a legitimate requirement and all of them are real. The discipline is to pick the single decision your product improves and refuse everything that isn't in service of it.
The right-hand column is not a list of things you'll never build. It's a list of things that each add a compliance workstream, an integration dependency, or a regulatory question. Add them when a real user has told you the core workflow is worth having.
Both of our healthcare builds were scoped this way on purpose. Find The Plan compares Medicare plans using plan data and hands off to a licensed advisor rather than making a coverage decision. Warwick Eye Surgeons built an agent around a surgical practice's real intake workflow with the clinical judgment left where it belongs. Neither needed live patient records to prove its point.
How Long Does Healthcare AI MVP Development Take?
Longer than a general MVP, and the difference is almost entirely data class.
The jump from row three to row four is the expensive one. It roughly doubles the calendar, and almost none of the added time produces a feature a user can see.
Does HIPAA Even Apply to Your MVP?
Start here, because a lot of teams assume the answer is yes and build accordingly when it isn't.
HIPAA reaches two kinds of organization. Covered entities are health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically in connection with certain transactions. Business associates are the people who handle protected health information on a covered entity's behalf, which is where most software companies land.
Answer those four honestly before you pick a database. If step one gives you a clean "no PHI", most of the rest of this article becomes optional for now, and you should feel good about that.
We run this exact sequence on every healthcare inquiry, before we talk about models or budgets. It takes about ten minutes and it has changed the shape of more projects than any technical conversation we've had. Twice it ended with us telling a founder they didn't need us yet.
What HIPAA Actually Requires, and What It Doesn't
Here's the part the industry gets wrong, and it's worth being blunt about.
What the Security Rule genuinely requires is a set of administrative, physical, and technical safeguards for electronic PHI. The one that matters most, and the one most commonly skipped, is the risk analysis: an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of the ePHI you hold. Nearly everything else follows from it. Encryption, access control, audit controls, and integrity controls sit in the technical safeguards.
What's changing, and what isn't yet
HHS published a proposed rule on 6 January 2025 that would tighten the Security Rule considerably. Comments closed on 7 March 2025. Among other things it would expressly require encryption of ePHI, define and require multi-factor authentication, and add a technology asset inventory with a map of how ePHI moves through your systems. Compliance would be due 180 days after the effective date, which itself would be 60 days after a final rule publishes.
It is not in force. As of this writing there is no final rule, and the published regulatory timetable has slipped repeatedly. Build toward the proposal anyway, because asset inventories, MFA, and encryption are cheap to design in and painful to retrofit. But do not let a vendor tell you these are already legal requirements, because right now most of them are not.
The Cheapest Compliance Decision You Can Make
Don't touch PHI in version one.
We make more money on the builds that do. We still open with this recommendation on nearly every healthcare scoping call, because the alternative is watching a good product idea get buried under a compliance program before anyone has confirmed the idea works. The cheaper order of operations is to validate the idea before you build it.
Climb one rung at a time, and only when the product forces you. Every rung you delay is weeks you get back and a compliance surface you don't yet have to defend.
There's a caveat worth stating clearly. Safe harbour de-identification is stricter than people expect, the eighteen categories include a catch-all for any other unique identifying number or code, and free-text clinical notes are notoriously hard to de-identify because identifiers hide inside prose. If your data is unstructured, budget real time for this or use synthetic data instead.
Which AI Vendors Will Sign a BAA?
If you do reach rung four, your model provider becomes a business associate. Not all of them will sign, and the ones that do attach conditions that change your architecture.
Read the exclusion lists carefully, because they are where products break. Anthropic's BAA, for example, does not cover the Batch API, the Files API, code execution, computer use, web fetch, or data flowing through third-party connectors. Those are ordinary features you might reach for without thinking. If your PHI pipeline touches an excluded surface, you have a gap that no amount of good intent closes.
The same logic applies to every other service in your stack. Your error tracker, your analytics, your logging platform, your email provider, your customer support tool. Each one that can see PHI needs a BAA, and most default configurations leak more than teams expect.
When Does Your AI Feature Become a Regulated Medical Device?
The second regulatory axis, and the one that gets skipped entirely in most agency guides.
Software that supports clinical decisions can fall under FDA device regulation. There's a statutory carve-out at section 520(o)(1)(E) of the Federal Food, Drug and Cosmetic Act, and the FDA's Clinical Decision Support Software guidance explains how the agency reads it. That guidance was revised in January 2026 and supersedes the 2022 version, so check the current document rather than the commentary written about the old one. Software is excluded from the device definition only if it meets all four criteria.
Two of these decide most AI products.
The third criterion says recommendations to a healthcare professional. A patient-facing tool that recommends a course of action isn't inside this carve-out at all, which surprises consumer health founders regularly. The 2026 revision didn't change that.
The fourth is the one AI fails. A model that returns a confident recommendation with no visible reasoning gives a clinician nothing to independently review. Show the retrieved evidence, cite the source, expose the inputs that drove the output. That's not a nice-to-have interface decision. It's load-bearing for staying outside device regulation, and it happens to make the product better.
The 2026 revision did loosen one thing worth knowing. The earlier guidance leaned against tools that offer a single recommendation rather than a list of options. The current version allows for a single output where that's clinically appropriate, which removes an awkward design constraint a lot of products were working around. It also stayed notably quiet on AI specifically, so don't expect it to answer your model-shaped questions directly.
This is a summary, not legal advice, and the boundary genuinely is contested. If your product is anywhere near this line, pay a regulatory specialist for an hour before you pay engineers for a month.
What Does a Healthcare AI MVP Cost?
Cost tracks the ladder more closely than it tracks the feature list.
These are Amplence planning ranges, consistent with the build bands in our breakdown of what an AI MVP actually costs. They exclude the ongoing run cost of models, retrieval, and hosting, which is a separate ledger.
Notice that the software in rows one and four can be nearly identical. The difference is the apparatus around it. That's why we treat the ladder as a budget tool first and a privacy one second: it's the only lever that moves a healthcare quote by a factor of three without changing a single screen your users will see.
If you're comparing proposals, ask each agency which rung they've priced. We've seen founders hold two quotes that differ by $60,000 and assume one team is padding, when the real difference is that one priced a synthetic-data concept and the other priced a product that handles live records. Both can be honest. Neither is comparable until you fix the rung.
Which Path Fits Your Product?
A founder testing a healthcare idea
Rung one. Build the workflow on synthetic data, put it in front of ten clinicians or ten patients, and find out whether the thing you imagined is the thing they need. Four to eight weeks. If nobody wants it, you've spent a fraction of what the compliant version would have cost to discover the same thing.
A clinic or practice automating admin work
Rung one or two, then a careful step up. Intake, triage, documentation, and follow-up are the highest-value targets and most of them can be proven without live records. Our AI automation work in healthcare starts here for a reason.
A funded startup with a clinical claim
Rung four eventually, but not first. Get the regulatory read early, design for the FDA criteria from day one, and build the evidence-showing interface before you need it. Budget 12 to 24 weeks and treat compliance as a parallel workstream with its own owner.
A digital health product selling to health systems
You will be a business associate, and your buyers' security reviews will be harder than the regulation. Plan for the questionnaire, not just the rule. Every safeguard you can evidence shortens a sales cycle.
