United States

The most permissive regime for clinician tools, and it just got more so, but that does not help a patient-facing use case. The January 2026 CDS final guidance, which supersedes the 2022 version, broadens the non-device clinical decision support exemption: it removed the automatic time-critical equals device rule and now allows single-recommendation tools under enforcement discretion. But the guidance remains focused exclusively on tools that support a healthcare professional. It is silent on consumer-facing chatbots, symptom checkers, and patient decision support, and the earlier enforcement-discretion proposals for consumer tools were never reinstated.

If we act as a business associate to a clinic that is a covered entity, HIPAA applies to protected health information and a Business Associate Agreement is required, including with any subprocessor that touches that data, such as a model API. Outside HIPAA, state privacy laws fill the gap: California's CCPA and CPRA, Maryland's MODPA, and Washington's My Health My Data Act, which treats consumer health data broadly.