One baseline to think about is SOC-II compliance. You'll also need training for your organization and certain designated people that are responsible for securit

One baseline to think about is SOC-II compliance. You'll also need training for your organization and certain designated people that are responsible for security. You'll want a third party to audit your architecture / pentest your systems. Finally, a lot of pressure will be from whoever you may be working with (hospitals, clinics, data brokers, etc) with respect to proving your security. They'll put you through their own IT and securitya audits. In terms of FDA clearance, you'll want to look into the 510(k) fast track, and look for similar systems to yours. I've worked at an algorithm oriented HIPAA complaint startup and don't know a ton, but would be happy to discuss my experience with you. email hn at funk.dog