Health Data Compliance Specification

Required legal health_data_compliance_spec

Agent Prompt Snippet

Confirm a health data compliance spec exists documenting regulatory requirements, consent flows, and data handling restrictions for health information.

Purpose

A health data compliance specification documents the regulatory requirements, consent flows, and data handling restrictions for accessing user health information.

This is a Required document — every project of this type should have one. Without it, the team risks misalignment, rework, or undetected issues that compound over time.

What Makes It Good vs Bad

A strong version of this document:

Uses clear, specific language — avoids ambiguity in obligations and rights
Covers all relevant jurisdictions and regulatory frameworks
Includes practical compliance checklists, not just policy statements
Reviewed by legal counsel and updated when regulations change
Accessible to non-lawyers — includes plain-language summaries

Warning signs of a weak version:

Copy-pasted from another project without adapting to this context
Missing jurisdiction-specific requirements (GDPR, CCPA, HIPAA)
No process for tracking regulatory changes that affect the project
Overly broad or vague terms that provide no real guidance
Written once at project start and never revisited

Common Mistakes

Using template legal documents without adapting them to the project’s specifics
Not tracking changes in relevant regulations after initial compliance review
Assuming open-source licenses are interchangeable without compatibility analysis
Separating legal compliance from the engineering workflow

How to Use This Document

Engage legal counsel early — retrofitting compliance is far more expensive than designing for it. Create a compliance matrix mapping each requirement to specific technical controls. Use plain-language summaries alongside formal legal text so engineers can act on requirements without a law degree.

For AI agents: Reference legal documents when making decisions that affect user data, licensing, or regulatory compliance. Flag any changes that might introduce new legal obligations or compliance risks.

Starter Template

SpecBase includes a ready-to-use template for this document: kb/templates/mobile_app/health_data_compliance_spec.md.tmpl. Use the SpecBase CLI or MCP integration to generate it pre-filled for your project.

# Generate stubs via CLI
specbase init <archetype> --features <features> --dir ./docs