As of 9 November 2026

In healthcare, a regulator, a payer and a set of operating rules stand between demand and revenue. A healthtech startup that tests demand without testing those rules can collect strong evidence for a product it is not allowed to sell, bill for or run as designed. That is why “what regulatory approvals does a healthtech startup need?” is a question for the search for product-market fit, not for after it.

Product-market fit (PMF) is the point at which a product satisfies a market with enough real buyers to pull it out of the company. In most industries, the buyer and the user are the market. In healthcare, three more parties have a say: the authority that decides whether the product may be sold for the use you describe, the payer that decides whether anyone is reimbursed for it, and the rules that govern how care is delivered and data is handled.

Any one of them can turn a promising pilot into a product with no business. The demand was real; the permission, the payment or the operating model was not.

This article is for founders of seed-stage healthtech companies, in any market, who are testing demand for a product that touches diagnosis, treatment, prescribing, billing or patient data. It is a bonus piece in A|P’s series on the foundation of product-market fit, and it expands the second prerequisite check on A|P’s page on product-market fit for healthtech ventures. It describes how regulation shapes a business. It is not legal advice.

What is regulatory-market fit?

Regulatory-market fit is the condition in which a product can be legally sold, paid for and operated in its target market, as designed, within the company’s runway. It is not the same as compliance. Compliance is how a company meets the rules. Regulatory-market fit is whether the business still works once it does.

The difference matters because a product can be fully compliant and still fail. A company can win authorization for a use no payer reimburses. It can meet every data rule at a cost its price cannot carry. It can build its operations around a rule that expires. Each of those companies did the compliance work. None of them had regulatory-market fit.

That is why A|P treats it as one of two prerequisite checks for PMF, alongside founder-market fit. Both come before the four sequential checks: defining the problem, validating it, building traction and measuring fit. A “no” on either prerequisite changes what the rest of the work is for.

Why is product-market fit without regulatory-market fit risky in healthcare?

It is risky because the signals founders use to judge PMF arrive before the rules weigh in. Users sign up, clinicians use or prescribe, and pilots run long before a regulator rules on the product’s claims, a payer agrees to pay, or the operating model is tested against the law. The demand is real. The business may not be.

Three signals mislead most often:

1. Users who sign up. Enthusiasm says nothing about whether the product’s claims are permitted. Change a claim to stay inside the rules, and you may change what users were enthusiastic about.
2. Clinicians who use or prescribe. A prescription is demand from the clinician. Revenue depends on someone paying for what was prescribed.
3. Pilots that run. A pilot often runs under conditions a full contract will not allow, such as free use, limited data or a temporary permission.

Regulation also sets how fast a product may change. A regulated product cannot iterate every week the way consumer software does, because a significant change can require a new review. That slows the build-measure-learn loop that PMF work depends on, so it belongs in the plan from the start.

And the rules move. Payment policies, data rules and temporary permissions change, sometimes within a single funding round. A startup that finds fit under one set of rules can lose it under the next.

What regulatory approvals does a healthtech startup need? A five-question check

The approvals a healthtech startup needs depend on what the product claims, how it reaches the market, who pays, how it operates and how stable those rules are. Five questions cover them in any market. Answer each one in writing before you build, and treat every answer you are unsure of as an assumption to test.

1. Status: is the product regulated as a medical product, and do your claims decide that? In most markets, what a product claims to do, not how it works, decides whether a regulator treats it as a medical device. The same software can be a wellness tool or a regulated device depending on the words on the website.
2. Path: what does market entry cost in time and money? If the product is regulated, the route to authorization has fees, evidence requirements and review times. Those belong in the runway plan, not the compliance budget.
3. Payment: does authorization lead to anyone paying? Permission to sell is not a promise of payment. Payers make their own decisions, on their own evidence, on their own timeline.
4. Operation: which rules govern how you deliver care and handle data? Data protection, professional licensing, prescribing rules, who may own a medical practice and, increasingly, rules on AI all shape how the business runs.
5. Stability: will these rules hold for your runway? A business model that works only under a temporary rule needs a plan for the day the rule ends.

The questions are ordered, but they are not independent. A change of claim alters the status, which alters the path, which alters the evidence a payer will see, which alters the price. That is why the answers belong in the same document as the problem statement and the business model.

The US as a case: how the five questions play out

The US shows all five questions clearly because each one has a different owner. The FDA decides status and path, Medicare and private insurers decide payment, federal and state agencies govern operation, and Congress and regulators decide how long temporary rules last. A product can satisfy one owner and fail with the next.

Status: when does a healthtech product need FDA clearance?

A healthtech product needs FDA clearance or approval when its intended use makes it a medical device and no exemption for certain software applies. Intended use is read from the company’s claims, labelling and marketing, so the same code can be software as a medical device under one description and outside FDA oversight under another.

The line moves. On 6 January 2026, FDA published revised guidances on clinical decision support software and general wellness products. The wellness guidance widened the room for non-invasive wearables that report measures such as blood pressure, as long as they are promoted for wellness. A wearable company whose claims fit that framing may no longer need clearance. One that promises to detect a condition still does.

Path: what does the US regulatory pathway cost?

For most new devices, the US healthtech regulatory pathway runs through a 510(k), which shows equivalence to a device already on the market, or a De Novo request for a new type of low-to-moderate-risk device. FDA’s FY2027 user fee, in force since 1 October 2026, is $28,653 for a 510(k) and $191,020 for a De Novo; qualifying small businesses pay about a quarter of that.

Time matters more than fees. Decisions on 510(k)s averaged about 156 days in the first half of 2026, and De Novo decisions about 341 days. For a seed-stage company with 18 months of runway, a De Novo can consume most of it. FDA’s Pre-Submission program, which gives written feedback on a planned submission, carries no user fee.

Payment: does FDA clearance mean someone will pay?

No. Pear Therapeutics received the first FDA authorization for a prescription digital therapeutic, reSET, in 2017, and clinicians prescribed its products. By October 2022, only about ten states, a few Blue Cross Blue Shield plans and SelectHealth covered any of them. Pear filed for Chapter 11 in April 2023, and its remaining assets sold at auction for about $6 million.

Akili followed a similar path. Its game-based ADHD treatment for children, EndeavorRx, was authorized through De Novo in 2020, and the company went public at a valuation near $1 billion. In 2023 the prescription product brought in $523,000. Akili was sold in 2024 for about $34 million.

Medicare’s payment rules arrived later. CMS created HCPCS billing codes for FDA-cleared digital mental health treatment devices, G0552 to G0554, in its 2025 physician fee schedule, and extended them to ADHD devices only from 2026. The payment rule followed the authorizations by years. For both companies, it came too late.

Operation: which rules govern how the business runs?

Data rules depend on who you are, not only on what data you hold. HIPAA, the US law that protects patients’ health information, applies to hospitals, clinics, health plans and the vendors that serve them. Apps outside HIPAA fall under the FTC’s Health Breach Notification Rule, amended in 2024 to cover health apps explicitly.

The FTC enforces the rule alongside its broader consumer-protection powers. GoodRx paid a $1.5 million civil penalty under the rule, and BetterHelp paid $7.8 million to settle FTC charges that it shared users’ health data for advertising.

Ownership rules vary by state. Many states bar companies not owned by physicians from controlling medical practice, a doctrine called the corporate practice of medicine. Telehealth companies usually work within it through a management company that contracts with a physician-owned practice. Oregon’s SB 951, signed in June 2025, restricts that model more tightly than any other state.

AI adds a newer layer. Illinois barred AI from providing therapy in August 2025. California requires a notice when generative AI writes patient communications, and Texas requires practitioners to disclose AI use in care. A product that is legal in one state can need a different design in the next.

Stability: what happens when the rule is temporary?

Remote prescribing of controlled substances has run on temporary rules since 2020. The DEA has extended its telemedicine flexibilities four times, most recently through 31 December 2026, and sent a permanent rule to the White House for review in August 2026. Medicare’s broader telehealth flexibilities lapsed on 1 October 2025 and again on 31 January 2026 before Congress extended them through 31 December 2027.

Cerebral and Done grew fast on those temporary rules, prescribing ADHD stimulants after online visits. Cerebral agreed in 2024 to pay more than $3.6 million to resolve a federal investigation of its prescribing practices. Done’s founder and its clinical president were arrested and charged in June 2024. The temporary rule allowed remote prescribing. It did not change what counted as legitimate prescribing.

How do you test regulatory-market fit alongside product-market fit?

Test regulatory-market fit the way you test the rest of the PMF hypothesis: write it down, find the riskiest assumption and test that first, as cheaply as you can. Most regulatory questions can be answered with documents and conversations long before a product exists, and the answers change what you build.

1. Write the regulatory hypothesis next to the foundation. Answer the five questions in prose, beside the problem statement and the business model.
2. Write the intended-use statement before the feature list. The claims decide the status, so draft them first. In the US, check them against FDA’s clinical decision support and wellness guidances.
3. Ask the regulator early. In the US, use a free Pre-Submission, or a 513(g) request ($8,596 in FY2027) for FDA’s view on classification.
4. Check payment with the people who bill. Ask your target buyer’s billing team which code they would use and what it pays. How that budget turns into a sales motion is covered on A|P’s page on go-to-market strategy for healthtech ventures.
5. Map the operating rules by jurisdiction. List where you will launch and the data, licensing, ownership and AI rules in each place.
6. Budget the path into runway. Include fees, evidence, review time and the time it takes a payer to cover the product.

A regulatory lawyer or adviser is worth paying for once the answers matter. The point of the check is to arrive with the right questions, before the product has answered them for you.

The limits of the argument

Regulatory-market fit is not a reason to wait. Much healthtech software, including scheduling, billing and workforce tools, is not a regulated medical product and needs no authorization at all. Its founders still face data and operating rules, but not a regulator’s permission to sell. Weighting regulation too heavily can slow learning as much as ignoring it.

Rules also move in founders’ favour. The 2026 US guidances widened the room for wellness and decision-support products, and a regulatory status won early can become a barrier to competitors who come later. The argument here is narrower: answer the five questions before demand convinces you the business works.

The decision in front of you is whether your evidence of demand is evidence for a business that is allowed to exist, or only for a product people like.

Part of A|P’s series on the foundation of product-market fit.

Frequently asked questions

What regulatory approvals does a healthtech startup need?

A healthtech startup needs regulatory authorization only if its claims make it a regulated medical product, but every healthtech startup must meet payment, data and operating rules. Five questions decide which apply: whether the claims make it a regulated medical product, what authorization costs, whether anyone will pay, which rules govern its operation, and whether those rules will hold. A product with no medical claims may need no authorization but still faces data and operating rules.

When does a healthtech product need FDA clearance?

A healthtech product needs FDA clearance when its intended use, shown in its claims and marketing, makes it a medical device and no software exemption applies. Some clinical decision support that lets a clinician independently review the basis of a recommendation, and low-risk products promoted only for general wellness, can fall outside FDA’s device oversight.

Is regulatory clearance enough to get paid?

No. Clearance allows a product to be sold; payers decide separately whether to pay for it. In the US, Pear Therapeutics held FDA authorization for its products but won coverage from only a few payers before it filed for bankruptcy in 2023.

Do health apps outside HIPAA have data rules in the US?

Yes. Apps outside HIPAA are covered by the FTC’s Health Breach Notification Rule, amended in 2024, and by the FTC’s general consumer-protection powers. GoodRx and BetterHelp both paid to settle FTC actions over how they handled health data.