Four things set the price: what the app does (features and integrations), who regulates it (HIPAA, FDA, FTC, Canadian law), who builds it (location and seniority set the loaded hourly cost), and what happens after launch (updates, patching, support). The rules add hours in design, security, legal review and testing. Store fees are a rounding error.
To estimate: list the features, estimate hours per feature with a developer, add the compliance hours, multiply by the loaded hourly cost of the team, add a contingency, and budget a yearly amount for maintenance. The sections below give public figures for each step.
Driver 1: What the app does
The feature list is the biggest driver. A patient app with booking, reminders, secure messaging, forms and payment is one scope; add telehealth video, device data, a clinician dashboard, integration with an electronic health record or practice management system, and identity verification, and the hours multiply. Each integration is its own project: the vendor's interface, its security requirements, its testing environment and its certification steps. Write the feature list before asking for any price, mark each feature as launch or later, and ask the developer to estimate hours per feature, because an estimate without hours cannot be checked.
Driver 2: What the hours cost, from public data
The U.S. Bureau of Labor Statistics' Occupational Outlook Handbook puts the median annual wage for software developers at $135,980 and for software quality assurance analysts and testers at $104,300 in May 2025, and projects employment in these occupations to grow 10 percent from 2025 to 2035. Dividing the developer median by 2,080 working hours gives about $65 an hour before benefits, by our arithmetic. The BLS's Employer Costs for Employee Compensation release for June 2026 puts private industry wages at 70.0 percent and benefits at 30.0 percent of employer costs, so a loaded in-house developer hour in the USA is about $93 at the median, again by our arithmetic. In Canada, the Government of Canada's Job Bank puts the median wage for software developers at $48.08 an hour.
A contractor's or provider's hourly rate sits above the wage because it carries the provider's overhead, management, tools and margin, and it falls where the provider's team is located. We build with a delivery team in India and do not publish rates here, because scope decides them. Whatever the rate, the arithmetic is the same: hours multiplied by loaded cost. A 2,000-hour build at $93 an hour and the same build at a lower or higher rate differ by the rate alone, so compare quotes on hours and on who does the work, never on the total.
Driver 3: The rules, and the hours they add
HIPAA, if a regulated entity offers the app. The HHS Office for Civil Rights' tracking bulletin says that for mobile apps offered by HIPAA covered entities and business associates, the information a person types in and the device identifiers the app collects are generally protected health information, and that disclosures to app vendors, tracking vendors or any other third party must comply with the HIPAA Rules. In cost terms: no advertising or analytics SDK may receive that data without a business associate agreement, every hosting, messaging, video and analytics vendor needs a BAA or a different design, encryption and access control are designed in, and a security risk analysis is done and documented. We sign a HIPAA business associate agreement where our development or support work touches PHI; which other vendors sign one and where the data is hosted are decided in your contract and your security review.
The FTC, if no regulated entity offers it. The bulletin notes that health information entered into an app not offered by or on behalf of a regulated entity is not protected by HIPAA and that other law applies. The FTC's April 2024 changes to the Health Breach Notification Rule make it apply to health apps and similar technologies not covered by HIPAA, with notification of individuals, the FTC and sometimes the media after a breach of unsecured health data. That adds a breach response plan and the engineering to detect and scope a breach.
The FDA, if the app diagnoses or treats. The FDA's page on device software functions describes a risk-based approach focused on software functions that meet the definition of a device in section 201(h) of the FD&C Act, and says that for many functions that meet the definition but pose minimal risk it intends to exercise enforcement discretion and will not expect premarket review or registration. Where a function is the focus of FDA oversight, the cost changes in kind: quality system, documentation, clinical evidence and a submission. Decide which side of that line each feature sits on before design, with regulatory counsel.
The app stores. Apple's App Store Review Guidelines say medical apps that could provide inaccurate data or be used for diagnosing or treating patients may be reviewed with greater scrutiny and must disclose the data and methodology behind health accuracy claims, and that health, fitness and medical data may not be used or disclosed to third parties for advertising or marketing and may not be stored in iCloud as personal health information. Those rules shape the architecture and the review timeline.
Canada. The Office of the Privacy Commissioner's PIPEDA in brief sets the federal rules for personal information in commercial activity, with substantially similar laws in Alberta, British Columbia and Quebec, and provincial health privacy laws apply to health information. A Canadian app adds a privacy impact assessment and data residency decisions.
Driver 4: The team
A health app needs a product lead, a designer who has built for patients and clinicians, developers for each platform or a cross-platform team, a backend and integration developer, a QA tester with a security brief, a DevOps specialist for the hosting and the audit trail, and access to a compliance officer and counsel. Seniority and location set the hourly cost; the mix sets the hours. A smaller senior team often costs less in total than a larger junior one on a regulated build, because rework is where health apps lose money.
The fees, which are small
Apple's Developer Program is 99 USD per membership year, with prices varying by region, and Google Play's registration is a one-time US$25 fee. Add hosting, a video or messaging service where used, monitoring, and the vendors' own charges, each under a BAA where PHI is involved. None of these decide the budget; the hours do.
After launch, which is not small
An app is a product with a yearly cost: iOS and Android version updates, security patching, dependency updates, store policy changes, EHR and vendor interface changes, monitoring and incident response, support, and the small improvements users ask for. Budget this from the start as a share of the build cost each year, and write the maintenance scope into the contract, because an unmaintained health app becomes a security and compliance problem within months. Our guide to HIPAA-compliant website design covers the same rules on the web side.
How to get a price you can trust
Five steps:
- Write the feature list and mark launch and later.
- Answer the three regulatory questions in writing with counsel: does a regulated entity offer it, does any function diagnose or treat, and where will the data live.
- Ask each bidder for hours per feature, the compliance hours separately, the named roles and locations, and the yearly maintenance scope.
- Compare bids on hours and on who does the work; a low total with no compliance hours is the expensive one.
- Keep a contingency for integration surprises and store review.
If you want it scoped with you
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. Our mobile app development page explains how we plan, build, test and support apps, and our healthcare app development page covers the web, integration and data work around them. We do not certify compliance and we do not call ourselves HIPAA compliant; we sign a HIPAA business associate agreement where our work touches protected health information, and we quote prices only against a written scope. This guide is general information, not legal advice.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.