Does FDA regulate all medical chatbots?

No. FDA’s guidance describes software functions that are not devices and those that are. Which side a chatbot falls on depends on what it is intended to do. Get regulatory advice for your specific product.

Are health apps covered by HIPAA?

Only when they are run by or for a HIPAA covered entity. The FTC notes many health apps are not covered by HIPAA and may be subject to its Health Breach Notification Rule.

Medical chatbots

A chatbot that books appointments and one that suggests what a symptom might mean are very different products in the eyes of regulators. The closer software gets to diagnosis or treatment, the more rules apply.

Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on October 22, 2026.

FDA and clinical decision support

FDA’s clinical decision support software guidance (opens in a new tab) explains which software functions are excluded from the definition of a medical device under section 520(o)(1)(E) of the Federal Food, Drug, and Cosmetic Act (“Non-Device CDS”). FDA notes that its existing digital health policies continue to apply to software functions that meet the device definition, including those intended for use by patients or caregivers. A chatbot that tells patients what condition they may have, or what to do about it, is in the territory this guidance covers.

Design lines worth holding

Route emergencies out immediatelyChest pain, trouble breathing, or thoughts of self-harm should get 911 or 988 instructions, not a conversation.
Do not diagnose or recommend treatmentUnless the product has been assessed against FDA’s rules.
Say it is automatedPatients should know when they are not talking to a person.
Hand off to staffGive a clear path to a human for anything clinical.

HIPAA or FTC?

A chatbot run by or for a clinic handling patient information falls under HIPAA. Many consumer health apps are not covered by HIPAA at all; the FTC explains that its Health Breach Notification Rule (opens in a new tab) can apply to those apps and connected devices instead.

Common questions

Does FDA regulate all medical chatbots?: No. FDA’s guidance describes software functions that are not devices and those that are. Which side a chatbot falls on depends on what it is intended to do. Get regulatory advice for your specific product.
Are health apps covered by HIPAA?: Only when they are run by or for a HIPAA covered entity. The FTC notes many health apps are not covered by HIPAA and may be subject to its Health Breach Notification Rule.

Sources

Clinical Decision Support Software (guidance) (opens in a new tab) — U.S. Food and Drug Administration
Complying with FTC’s Health Breach Notification Rule (opens in a new tab) — Federal Trade Commission

Questions about this domain

Questions about clinicchat.ai or something explained here. There is no product, community, or demo to request, and we do not promise a response timeline. Do not send patient information through this form.

Get in touch

Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on October 22, 2026.

Every rule described here is linked to the agency that publishes it. If one has changed, tell us.