Legal questions for the clinician console

Five questions we can't answer ourselves. The option marked as now is how the platform works today. Skip any you can't answer, and use the notes box if none of the options fit.

Answers save in this browser as you go. When you're done, press Submit answers at the bottom. “What we found” under each question is our own research, not a legal conclusion.

The platform in brief

A phone app for stroke survivors to do movement, speech and mood tests at home, and a web console where their clinicians see the results.
Patients are known only by a random token (GRT-XXXX-XXXX). No name, email or date of birth is ever collected.
Stored per patient: test results with the date of each test, raw phone-sensor recordings, questionnaire scores (PHQ-9, GAD-7), and the phone's push-notification token.
Clinics run in one of two modes. Research: the data is collected for a study. Deployed: the clinic uses it for patient care, and platform staff see only counts.

Your name Your role

1. Do Deployed clinics need a business associate agreement?

Our reading is yes. The token alone doesn't make the data de-identified, because every result carries its test date and the push token is a device identifier.

A BAA with each Deployed clinic is: Needed Not needed (say why)

What we found

HHS says a developer hired by a provider, whose app the provider tells patients to use, is a business associate ^[1].
Safe Harbor requires removing every date element except the year, plus device identifiers ^[2]. Dates of service are the most common reason data fails it ^[3].
Outside HIPAA, the FTC Health Breach Notification Rule has covered health apps since July 2024 ^[4].

2. How can Research clinics keep the test dates?

The dates are the data: a decline is only visible as a change over time. We would hash the push token either way.

Until this is answered, the research export gives every date as days since the patient enrolled, never a calendar date.

The route should be: A limited data set under a data use agreement Expert determination Something else (say what)

What we found

A limited data set may keep dates, but only for research, public health or operations, under a data use agreement. It still excludes device identifiers, and the recipient may not contact the patients ^[2].
Expert determination can keep dates if a qualified expert finds the re-identification risk very small ^[3].

3. What must be in place before we collect self-harm answers?

Item 9 of the PHQ-9 asks about thoughts of self-harm. As now: a “yes” shows the patient the 988 crisis line, and no clinician is told. The medical team wants a physician to follow up the same day, treated like a critical lab result, and all nine answers stored. Nobody watches the console at night or over a weekend.

Can we ask item 9 at all? Yes, once each clinic names a same-day responder and the patient is told the answer isn't watched live Not yet: use the PHQ-8, which drops item 9, until that process exists Yes, as now as now

Does the same answer hold for Research clinics? Yes No (say how it differs)

What we found

Standard practice for a positive item 9 is a structured risk assessment before the encounter ends ^[5]. An app has no encounter to end.
Item 9 alone flags many people who turn out not to be at risk (positive predictive value 28.6%) ^[6].
The PHQ-8 is the PHQ-9 without item 9 and is used where follow-up can't be guaranteed ^[7].

4. Can the console suggest medications?

The medical team asked for this. A clinician would record the patient's medications (drug class, start date, duration), and the console would suggest guideline-based next steps, e.g. “aspirin plus clopidogrel for 90 days”. As now: it never suggests a drug.

Suggestions based only on what the clinician entered: Are fine, as long as each one shows its basis and the clinician decides Need a formal regulatory review first Shouldn't be built as now

Suggestions that also use the phone's test results: Are fine on the same terms Would make the console a medical device Not sure

What we found

FDA's January 2026 guidance relaxed the rules for software that recommends treatment to a clinician who can review the basis. Software that analyses signals from a sensor stays a device ^[8]. Our test results come from phone sensors.

5. Sending a report to the patient's outside doctor

E.g. their primary care doctor at another organisation. The medical team's plan: with the patient's permission, the clinician downloads the report and gives it to the patient, who sends it on. As now: there is no way to share outside the clinic.

Is that the right route? Yes, through the patient The clinic may send it straight to the doctor Either is fine

Does the patient's permission need to be recorded? Yes, in writing A note in the record is enough No

What we found

HIPAA lets a provider share information with another provider for treatment without the patient's authorization ^[9].

6. When a patient withdraws, what may we keep?

Built: a withdrawal is recorded with who entered it and when. Collection stops (the phone is signed out). Every row already collected is kept, and the research export marks the patient "withdrawn". Geo's replies and the app's streak log are kept but unlinked from the patient's token.

Data collected before withdrawal should be: Kept and marked, as built Kept, but unlinked from the token everywhere Deleted if the patient asks Something else (say what)

What we found

HHS research guidance lets investigators keep and analyze data collected before a subject withdraws, if that fits what the consent said ^[10].
Under HIPAA, revoking an authorization doesn't reach information already obtained under it ^[11].

7. Is a clinic manager's "Agree" enough to let GHW back in?

Built: in a Deployed clinic, GHW sees counts and the roster only. GHW can switch a clinic to Deployed on its own. Going back to Research needs one of the clinic's own managers to press Agree, and that is recorded in the audit log.

Switching a Deployed clinic back to Research needs: The manager's Agree, as built A signed change to the clinic's agreement as well Something else (say what)

What we found

A business associate agreement has to set out what the business associate may use the data for ^[12]. If question 1's answer is yes, a button changes our access, not the agreement.

Anything else?

Sources

HHS OCR, Health App Use Scenarios & HIPAA (Feb 2016): PDF.
45 CFR 164.514(b)(2), (c) and (e): Cornell LII.
Expert determination and dates of service: J. D. Cook; HHS guidance on de-identification.
FTC Health Breach Notification Rule, 2024 final rule: Covington, MoFo.
Positive item 9 → structured risk assessment: Care New England, Ann Fam Med 2021.
Item 9 vs eC-SSRS (PPV 28.6%): PubMed 29477096.
Kroenke et al. 2009, the PHQ-8 as a measure of current depression, J Affect Disord 114:163–173: PubMed 18752852.
FDA revised CDS guidance (Jan 2026): Covington summary, FDA guidance PDF.
45 CFR 164.506(c), treatment disclosures: HHS fact sheet.
HHS OHRP, Guidance on Withdrawal of Subjects from Research: Data Retention and Other Related Issues (2010): HHS.
45 CFR 164.508(b)(5), revoking an authorization: Cornell LII.
45 CFR 164.504(e), business associate contracts: Cornell LII.