Digital Health & SaMD Risk Assessment
Diligence for Software as a Medical Device, AI-enabled clinical software and remote patient monitoring: SaMD classification, predetermined change control, CPT reimbursement and interoperability. An automated Quick Screen within 24 hours; full reports in 48, reviewed by a physician and a biomedical engineer.
The Problem
Software ships often; clinical validation may happen once. AI models can drift. Reimbursement codes depend on who does what for the patient. Cybersecurity documentation can gate a submission. Diligence that treats SaMD like ordinary software can miss these.
Software marketed as a "wellness app" or as non-device clinical decision support may still meet the definition of a device. FDA's general wellness and clinical decision support guidances draw those lines, and a misread can surface as an FDA letter after close.
Training cohort not representative, subgroup performance undocumented, no predetermined change control plan, no postmarket performance monitoring. FDA's December 2024 final guidance on predetermined change control plans describes what a planned-update pathway needs.
Since October 1, 2023, FDA can refuse to accept a premarket submission for a cyber device that lacks the section 524B information, including a software bill of materials and a plan for postmarket vulnerabilities.
Revenue models built on 99453/99454/99457 without reading the fine print: time requirements, auto-capture exclusions, and setup-code one-shot limits. The margin can be thinner than the pitch shows.
FHIR R4, HL7v2 compatibility, Epic Showroom and Oracle Health (Cerner) marketplace status, SMART on FHIR. IDN procurement can stall on integration even when clinical value is clear.
Pilot sites aren't representative cohorts. RCT-free evidence still has FDA pathways, but payers and IDNs often ask for comparative-effectiveness data. Check whether the evidence package has it.
IMDRF SaMD Categories
The IMDRF framework sorts SaMD into four categories by what the software's output does (treat or diagnose, drive clinical management, or inform it) and how serious the condition is. The categories are not FDA device classes: FDA still assigns a class and a premarket pathway, and a full report reads both.
Informs clinical management of serious or non-serious conditions, or drives management of non-serious conditions. Risk sits in claim creep: marketing that moves the software into a higher category.
Treats or diagnoses non-serious conditions, drives management of serious conditions, or informs management of critical conditions. Clinical validation, cybersecurity and usability testing carry weight.
Treats or diagnoses serious conditions, or drives management of critical conditions. Clinical evidence depth, AI/ML validation and change-control planning carry more weight.
Treats or diagnoses critical conditions. Expect the deepest clinical evidence and ongoing performance monitoring; the FDA pathway still depends on the device's classification.
What a Digital Health Report Examines
Full reports read the same 20-category framework on every company and summarize it in a composite Vantage Index. For SaMD and digital health, these are the areas that get the closest read. Some inputs, like financials, come from the company or the buyer.
| Domain | What we're looking at |
|---|---|
| AI/ML Validation & Monitoring | Training/validation cohort representativeness, subgroup performance, locked vs adaptive, predetermined change control plan (PCCP), drift detection, post-market performance monitoring |
| Regulatory Pathway & SaMD Class | SaMD classification rigor, intended-use statement precision, non-device clinical decision support status, 510(k)/De Novo/PMA fit, labeling-to-feature alignment |
| Cybersecurity & Postmarket | 524B readiness, SBOM completeness, threat modeling, vulnerability disclosure, postmarket patching cadence, HIPAA + state privacy compliance |
| Clinical Evidence & Adoption | Validation cohort vs training cohort, RCT/pragmatic-trial evidence, usability testing, KOL adoption, clinician-workflow integration |
| Reimbursement & Coding | CPT codes (RPM/RTM/99453-99458), CMS reimbursement trend, payer PDT policy, pay-for-performance models, employer direct contracting |
| Interoperability & Integration | FHIR R4 readiness, Epic Showroom / Oracle Health marketplace status, SMART on FHIR, HL7v2 fallbacks, single-sign-on, data-export compliance |
| Commercial & Market Access | Channel strategy (provider / payer / employer / D2C), IDN contracts, health-system security-review timeline, ROI evidence |
| Financial & Operational | Burn, LTV/CAC, enterprise contract duration, infrastructure cost per user — provided by the company or buyer |
Pricing Ladder
Start with an automated Quick Screen, delivered within 24 hours of a complete intake. Move to a full report when the deal moves: 48-hour turnaround, reviewed by Arvind Ravinutala, MD, and Aswini Ravinutala, BME.
Running diligence across a fund or portfolio? See Vantage Licenses →
Want continuous monitoring post-close? Surveillance from $1,500/mo →
Digital Health Intelligence Library
Articles on SaMD, AI/ML and RPM risks in diligence. Written by Arvind and Aswini.
What FDA authorization shows, how often AI devices report clinical testing, and the data, workflow and reimbursement questions to ask.
Read → AI/MLMulti-site performance, training-data bias, change control plans and reimbursement: how to read an AI-enabled software device's validation record.
Read → CybersecuritySBOM, threat model, postmarket update plan. What FDA refuses to accept, and how to assess whether a SaMD target is ready.
Read → RPMNew 2–15-day device supply and 10-minute management codes, CMS's automatic-upload and day-count requirements, and RTM's parallel codes, read as engineering inputs.
Read → ClassificationWellness app, decision support or device? How to read software for regulatory status after FDA's January 2026 guidance, and what a misclassification can mean for a deal.
Read → IntegrationOne-off EHR and claims integrations, FHIR implementation differences, information blocking and CMS API rules, and how to spot the debt in diligence.
Read →Buy a Quick Screen and give us the target and a data-room link (or just the intended-use statement and the 510(k) number if cleared) on the intake form. The Quick Screen arrives within 24 hours of a complete intake. Prefer to talk first? Book a free 20-minute call.