Counsel to the companies delivering care through software, devices, and data, from telehealth and virtual care and remote monitoring to health data and AI-enabled clinical tools, on a structure that holds as the product and the rules evolve.
HIPAA reaches a health-technology company only as a covered entity or a business associate. A consumer wellness app that bills no health plan may sit outside it, and inside the FTC's Health Breach Notification Rule and state laws such as Washington's instead. Which regime applies decides who must be told of a breach and how fast: under HIPAA, individuals within 60 days of discovery, with notice to the Secretary and the media once a breach involves 500 or more people. A founder who has heard only of HIPAA has heard half the problem.
The other half is the care model. In corporate-practice states the company cannot employ the physicians, so the platform owns a management company that serves a physician-owned professional entity under a management services agreement, at a fee that in the strictest states cannot be a share of professional revenue. Clinical software is a medical device unless an exemption applies, and the decision-support exemption holds only if the clinician can independently review the basis for the recommendation. We build those structures and bring in FDA and locally admitted counsel where a matter needs them.
Corporate-practice-compliant entities, management services organizations, and the provider and group agreements that let a virtual-care platform deliver care lawfully across states, with room to flex as licensing rules change.
Privacy and security frameworks for platforms that handle health data, covering health-privacy and consumer-data obligations, business-associate and data-processing agreements, consent design, and breach-response posture.
Mapping where a product sits relative to medical-device regulation and structuring the terms around AI-enabled clinical software, in coordination with FDA and life-sciences regulatory counsel on the classification and clearance pathway.
Provider, vendor, and payor contracts, value-based and risk-sharing arrangements, and licensing and integration deals, drafted with the fraud-and-abuse and anti-kickback frameworks that shape what they can say.
Venture and growth rounds, strategic investment, and joint ventures for digital-health ventures, running the corporate process and the regulatory review together so diligence does not stall the raise.
Acquisitions, sales, and combinations of digital-health businesses, where the diligence turns on regulatory and data posture as much as financials, structured so the value survives the close.
Licensure follows the patient's location, not the doctor's, so a national telehealth service needs clinicians licensed in every state it serves. The Interstate Medical Licensure Compact speeds applications in member states but issues no multistate license, so the roster has to show, visit by visit, who was licensed where.
A vendor handling protected health information for a covered entity is a business associate, directly liable under HIPAA. The agreement it signs with a hospital commits it to the Security Rule, including a risk analysis, and that analysis is what the Office for Civil Rights asks to see.
The Cures Act keeps software outside device regulation: administrative tools, general wellness products and decision support a clinician can check for themselves. Analyze an image or a signal, or recommend a treatment without showing the basis, and the product is a device needing clearance. The intended-use statement decides the side.
The FDA authorizes AI-enabled devices mostly through the 510(k) route, and a sponsor may now file a predetermined change control plan so a model can be retrained without a new submission. States legislate around the edges: California requires that a licensed physician, not an algorithm, make a medical-necessity denial.
The Anti-Kickback Statute is a criminal statute; its safe harbors protect only arrangements meeting every element, so physician payments are set at fair market value and fixed in advance, never per referral. Medicare's telehealth flexibilities are extended in short increments; a model built on them carries a calendar.
A buyer or investor asks for the license roster, the BAA inventory and the Security Rule risk analysis before the financial model, and prices a gap in any of them as a liability with a regulator attached. Build the file as the company grows, not for the data room.
Before code ships, the delivery model gets built around corporate-practice-of-medicine rules: the friendly-PC and MSO structure, provider employment and supervision terms, and a state-by-state licensing map that decides where the platform can lawfully see its first patient.
As the product takes shape, the consent architecture, business-associate and data-processing agreements, and breach-response posture are built into the data flows, because the pixel-tracking or de-identification choice made in month six is what diligence interrogates in year four.
When the software starts informing clinical decisions, we map where it sits against medical-device regulation and the forming rules on clinical AI. We structure claims, oversight, and contract terms around that line and bring in FDA regulatory consultants where a clearance pathway opens.
Payor and value-based contracts are drafted inside the fraud-and-abuse and anti-kickback frameworks, so when the growth round or acquisition arrives, the buyer's regulatory diligence finds the same structure the company was actually built on and the close clears without repricing.
In digital health, the structure you launch with is the diligence you'll answer for.
Digital health is the use of software, connected devices, and data to deliver, coordinate, or improve care, in telehealth and virtual visits, remote patient monitoring, clinical decision tools, and AI-enabled platforms. Legal counsel for it spans the whole stack, from the corporate structure that lets a venture practice or contract for care to the licensing and privacy regimes it operates under, the commercial agreements with providers and payors, and the financing and exit work that funds growth. We advise on the business and regulatory architecture and coordinate with registered or locally admitted counsel where a matter requires it.
Yes. We advise telehealth and virtual-care platforms on the structures and agreements that let them deliver care lawfully across states: corporate-practice-of-medicine compliant entities, management services arrangements, provider and group contracts, and multi-state licensing posture. The clinical and licensing rules vary by state and change often, so we build the structure with room to flex and coordinate with locally admitted counsel where a particular jurisdiction requires it.
We start by establishing which regime the data actually sits in, because the answer is often not HIPAA. Data a platform receives from a covered entity or handles as its business associate is protected health information, with the Privacy and Security Rules and a 60-day breach clock attached. Data a consumer types into an app with no payer or provider behind it is governed instead by the FTC's Health Breach Notification Rule, by state consumer-health privacy laws such as Washington's and by the general state privacy statutes, several of which treat health data as sensitive and require opt-in consent. De-identified data leaves HIPAA only through the Safe Harbor method, which strips eighteen listed identifiers, or an expert determination, and a tracking pixel on an authenticated page can undo the analysis. We map the data flows, paper the business associate and processing agreements and build the consent design to hold as the product changes, with specialist privacy counsel where a matter needs one.
Some digital-health software is regulated as a medical device, and AI-enabled clinical tools raise questions about claims, oversight, and liability that are still taking shape. We help companies map where a product sits relative to that regulatory line and structure the commercial and contractual terms around it, and we coordinate with FDA and life-sciences regulatory counsel on the device-classification and clearance pathway where the work calls for registered counsel.
Yes, and two features make these deals different from an ordinary software transaction. The professional entity that employs the clinicians is owned by a licensed physician, not by the company, so a sale transfers the management company and relies on a succession agreement to move the professional entity's ownership to a physician the buyer designates; if that agreement was never signed, the buyer is acquiring a platform with no clinicians attached. And the diligence request list leads with the license roster, the business associate agreement inventory and the Security Rule risk analysis, each of which a buyer prices as a liability if it is missing. We run the corporate process and the regulatory review on one timetable, draft the representations around the real compliance posture and bring in the firm's funds, securities and tax lawyers where the deal reaches across practices.
Yes, on the contractual and structural side. We advise on payor and provider agreements, value-based and risk-sharing arrangements, and the corporate structures that determine how a digital-health company is paid, alongside the fraud-and-abuse and anti-kickback frameworks that shape what those arrangements can look like. For coding, coverage determinations, and the finer points of program rules, we coordinate with reimbursement consultants where a matter requires it.
Corporate, capital, and regulatory counsel for biotech and pharmaceutical ventures, from financing and collaborations to the diligence that has to clear before a deal closes.
Explore →Deal structure and commercial strategy for device, diagnostics, and medtech companies, where an intellectual-property estate and a regulatory pathway sit at the center of value.
Explore →Regulatory posture across product and clinical oversight, advertising and claims, and the federal and state frameworks that govern healthcare and life-sciences businesses.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.