Build safely
The joy of building is unconditional; the obstacles are conditional. The lane is set by what your software touches, not by what it is. The long version, including the EU in-house exemption, is in The 3am Nurse Test.
Unlike the rest of the guides, this page is a live feed, not a one-time check: refreshed automatically alongside Pulse (last update 2026-09-14).
Green: build freely. No real patient data, no live clinical decisions. Prototyping even a clinical app on synthetic or sandboxed data is green, and so are production tools that never touch patient data (admin, rotas, comms, education).
Amber: compliance basics apply. Real patient data or a live clinical workflow: data protection, access controls and audit trails become part of the build.
Red: device territory. Influencing real diagnosis or treatment in production. In the EU, the in-house exemption can be the escape hatch for tools built and used within one institution.
- The AI sandbox trap for vibe-coded health apps
A compliance walkthrough explains why prototyping platforms such as Lovable, Bubble and Replit have no BAA on standard tiers, so putting real patient data into an AI-built prototype is a breach before launch
2026-09-14 · youtube - What physicians should know before building or recommending apps
Medical Economics guidance notes that when a physician works directly with a developer to create an app for a specific patient population the need for HIPAA compliance is greater, pointing to HHS guidance as the…
2026-09-14 · medicaleconomics.com - Christian Pean, MD, on the FDA's proposal to give generative AI a "residency"
The watchlisted surgeon analyses CDRH's new discussion paper proposing a competency-based regulatory path for generative AI medical devices (structured knowledge assessment, supervised practice with widening…
2026-09-11 · substack - "Vibe coding and the illusion of competence": laboratory medicine specialists warn against trusting AI-generated code for clinical deployment
A paper in Clinical Chemistry and Laboratory Medicine by De Bruyne, Rommes, Fiers, Volders and Maes warns that AI-generated code for laboratory workflows appears functional but harbours subtle errors that make it…
2026-09-07 · doi.org - PDA publishes 15-part AI guidance with professional-in-the-loop model
the UK Pharmacists' Defence Association issued comprehensive guidance on 24 August establishing that pharmacists retain active oversight, professional judgement and accountability for AI-influenced decisions, covering…
2026-09-02 · the-pda.org - NHS watchdog warns AI scribes get drug names and diagnoses wrong
The Guardian reported that an NHS watchdog has warned that AI scribes used by doctors are getting names of drugs and diagnoses wrong, raising patient safety concerns directly relevant to clinician-builders deploying AI…
2026-08-31 · theguardian.com