Five Regimes, and One Practice Under All of Them
Few outpatient specialties sit under as many regulatory regimes at once as dermatology, and dermatology software compliance has to account for all of them from the first architecture decision. Privacy law governs a practice holding an unusually large archive of identifiable images. Laboratory regulation governs a practice that reads its own pathology. Federal quality programs govern participation and payment, state telehealth rules govern asynchronous consultation, and federal product regulation governs what may be claimed for a laser, an injectable or a jar of cream. A single practice can operate under all five simultaneously, and several outcomes are decided by how the custom software development is built rather than by policy alone, including the web application development behind the patient portal and store-and-forward intake. Two of the five regimes change every year and should never be written from memory here. This article is educational and strategic content, not legal advice.
HIPAA and the Clinical Photograph Problem
The ordinary HIPAA obligations apply regardless of specialty, covering safeguards, access control, audit logging, workforce training, business associate agreements, breach notification and patient rights of access. What is particular to dermatology is the image archive, and it creates three specific problems.
The first is capture location. A clinical photograph taken on a provider’s or assistant’s personal phone is protected health information sitting outside the practice’s systems and controls. That is both a privacy exposure and a clinical gap when the image never reaches the record. Capture belongs inside the platform on managed devices, not on personal hardware. Building that capture surface is custom mobile app development work, since the camera is where the record starts.
The second is marketing use. Using a patient’s clinical photograph, including a cosmetic before-and-after, in advertising, on a website or on social media requires a valid authorization for that specific purpose. A treatment consent signed at intake is not that authorization, and this distinction is missed often in this specialty. The authorization should be specific, revocable and recorded against the image itself rather than filed separately.
The third is access. An archive of identifiable images needs role-based access and audit logging, since curiosity about a recognizable patient is a real risk that plain text charts carry less often. De-identifying images is harder than de-identifying text. Verify implementation specifics with counsel.
CLIA Requirements for In-Office Pathology
The Laboratory Is Regulated as a Laboratory
A practice that processes or interprets its own specimens is operating a clinical laboratory and needs federal certification appropriate to the complexity of the testing performed. Dermatopathology sits at the higher complexity levels, bringing personnel qualification requirements for staff who perform and supervise testing, proficiency testing, quality control obligations, documented procedures and periodic inspection. Verify current requirements with the certification authority rather than treating anything here as settled.
What the Software Supports
The platform’s role is specimen accessioning with unique identification, chain of custody through processing, quality control records, result reporting with the required elements, corrected report handling that preserves the original, and personnel competency records. An in-house laboratory’s records get inspected, which makes them a first-class part of the platform, not an afterthought bolted onto scheduling.
The Self-Referral Question
Separate from certification, a practice referring specimens to its own laboratory raises federal physician self-referral and anti-kickback questions, and arrangements involving purchased or outside interpretations carry their own billing rules. This area has drawn specific scrutiny in dermatology. No arrangement should be described as compliant here. The structure is a legal question for healthcare counsel, and the software supports an approved arrangement rather than proposing one.
MIPS Quality Reporting
Practices participating in federal quality payment programs are scored across categories covering quality measures, use of certified health information technology, improvement activities and cost, and the score affects payment.
Requirements change every performance year. Measure sets are revised, scoring is adjusted, and reporting pathways evolve, including specialty-specific pathways being phased in as an alternative to traditional reporting. Writing about the current detail dates quickly, and a platform that encodes this year’s rules needs maintenance every year after.
Measure capture works when it sits inside the clinical workflow and fails when it becomes a retrospective exercise. A measure satisfied by documenting something during the visit gets met consistently; one that requires a coordinator to assemble evidence afterward usually does not.
Certified health information technology requirements attach to part of the scoring, and that constrains what a custom platform can be for a participating practice. That constraint deserves weight in any build discussion, and the current performance year requirements should be verified before anything is finalized.
State Teledermatology Rules
Asynchronous review suits dermatology better than most specialties, and the rules governing it sit at the state level and vary considerably.
Licensure comes first. A provider generally needs a license in the state where the patient is located at the time of the encounter, and a practice reviewing submissions from several states needs multiple licenses rather than one.
Modality rules differ too. Some states treat live interactive and store-and-forward distinctly, and some have specific provisions on whether an asynchronous review can establish a provider-patient relationship or whether an initial in-person visit is required first. Consent requirements vary, with several states requiring specific disclosure and documented patient consent to the modality itself. Prescribing may also be restricted following an asynchronous encounter, particularly for certain drug categories, and reimbursement differs by payer and by state.
For the platform, this means capturing the patient’s location, checking licensure against it, recording consent per state requirement and documenting the encounter as an encounter. Verify per state before offering the service.
Establishing this scope is the first job of pre-build scoping. For what that assessment should establish before development begins, see Why US Dermatology Practice Owners Need a Technology Consultant in 2026.
FDA Limits on Device and Cosmetic Claims
The cosmetic side of dermatology operates under product regulation that practices often underestimate.
Use and promotion are not the same thing. Energy-based devices and injectables are cleared or approved for specific indications. A physician may use a product outside its labeled indication in the practice of medicine, which is a matter of clinical judgment, but promoting that use is different and is restricted under federal rules. A website or treatment menu describing a device as treating something it is not cleared for has crossed from use into promotion.
A cosmetic can also become a drug through its claims. A product marketed with claims to affect the structure or function of the body is regulated as a drug regardless of what the label calls it, and warning letters have gone to practices and product sellers on exactly this point. Practices dispensing private-label skincare should have claims reviewed before publication, and software should never generate those claims.
Federal cosmetics regulation was also substantially modernized, introducing facility registration, product listing, safety substantiation and adverse event reporting obligations. Implementation has been phased, and the current position should be verified before publishing anything about it. Before-and-after images used in advertising are claims requiring substantiation, with state medical board advertising rules applying alongside.
Supervision, Advertising, and Other Obligations
Who may perform which procedures is set by state law and varies substantially, covering supervision and delegation rules for advanced practice providers and rules on who may operate energy-based devices, including whether a physician must be physically present. A practice operating across state lines faces different rules at every site.
Corporate practice of medicine restrictions apply in some states to ownership and to medical spa arrangements. Industry payment transparency obligations apply to reportable relationships with manufacturers, payment card obligations apply across clinical and retail collection, accessibility requirements apply to the patient portal and booking surfaces, and record and image retention obligations are set by state.
Final Thoughts
Practices that keep image capture inside the platform, gate marketing use behind specific authorization, treat the in-house laboratory as a regulated operation, and build quality capture into the clinical workflow address the major compliance surfaces before they become software problems. Cosmetic claims also need review before publication, with the applicable requirements confirmed as they change.
If you are scoping a platform that holds clinical images and supports a cosmetic business, settle the authorization model, laboratory requirements, quality obligations, and claims review before architecture is fixed. Working with a leading software development company can then help carry those requirements into the platform design. Confirm specific legal and regulatory questions with healthcare counsel, the state medical board, and the relevant certification authority.
