Scenario pricing for healthcare software in 2026: MVP to full program
TL;DR
Scenario pricing for healthcare software in 2026 means asking a vendor to price three defined scopes of one product: an MVP, a regulated MVP and a full program, each with its own assumptions and a single price. A wide range usually hides those scopes inside one number, which is why healthcare buyers send it back.
- Price all three on one system: a companion app, a clinician portal and a backend.
- Intended use draws the line. A portal that displays readings is not a device function; one that raises alerts for clinical intervention is.
- A 510(k) carries a $28,653 FDA user fee from October 1, 2026, outside any vendor's quote.
- In our estimate records, a single-scope range spread a median of about 40% top to bottom. Changing the scope moved prices up to 4x.
Why a wide estimate range gets rejected
A range tells you something is still undecided. The useful question is what.
Part of it is estimating error. Construx's cone of uncertainty puts estimates made at initial concept at up to 4x too high or 4x too low. Once requirements and UI design are complete, the spread between high and low estimates narrows to 1.6x. The cone narrows only as decisions get made.
The rest is scope nobody has chosen. Attract Group's 2026 healthcare planning bands start at $25,000-$60,000 for a focused MVP and end at "$300,000+ for regulated, enterprise, or medical device software," a top with no ceiling.
Buyers push back. An academic research group in our pipeline wrote, "The range you provided for this work was $285,000-$485,000, which is quite large," and tied discovery funding to tighter economics. A nonprofit answered "No" when asked whether high-level ranges were acceptable. A device maker asked for cost and timeline by implementation area so it could decide what its MVP was. That last request is the fix: split the range into named scopes and price each one tight.
What moved the regulated line in 2026
Four dates this year move where the scenarios split, or what each one costs.
- January 6, 2026. FDA's updated general wellness guidance lets some non-invasive sensing products count as wellness, but not ones whose outputs "prompt or guide specific clinical action or medical management." Claim wording alone can move a companion app across the line.
- February 2, 2026. The Quality Management System Regulation took effect, incorporating ISO 13485:2016 by reference. A regulated MVP is built inside a quality system.
- October 1, 2026. Fiscal 2027 user fees took effect: $28,653 per 510(k), or $7,163 for a qualified small business.
- Still pending. The HIPAA Security Rule overhaul proposed on January 6, 2025 has final action pointed to July 2027. Price today's rule as the baseline and the proposed controls as a named option.
How we built this template
- Regulatory facts come from FDA, HHS and FTC documents, quoted where the wording matters.
- The example system is a composite of device-linked monitoring requests in our pipeline, not one client's project.
- Our figures were counted by hand from healthcare estimate and negotiation records. Any group with fewer than three data points is not published.
- Intended use and regulatory status are decisions for you and your regulatory counsel. This is commercial guidance.
One disclosure. Mercury Development sells this work and has built custom software since 1999. Our healthcare process includes an Identify step where we propose several options, so read this as a vendor's method.
The three scenarios at a glance
| MVP | Regulated MVP | Full program | |
|---|---|---|---|
| Question it answers | Will clinicians and patients use it? | Can the device function support an FDA submission? | Can it run as a service at scale? |
| Companion app | Core patient flows and reminders | Adds device control under design controls | Every feature, localization |
| Clinician portal | One role, readings displayed | Adds alerts or prioritized patient lists | Every role, EHR integration |
| Backend | One region, BAA-covered cloud | Adds threat model and SBOM | Multi-region, single sign-on |
| Compliance boundary | HIPAA where PHI is handled for a covered entity | FDA documentation level; IEC 62304 class if declared | Post-market change control |
| Lifecycle | Sprints | Fixed front, sprints, fixed verification | Releases |
| Outside the vendor's price | Cloud and store fees | FDA user fee, regulatory advice | Hosting, support, audits |
| Price shape | Fixed or capped | Three blocks | Per release plus run costs |
The example system: companion app, clinician portal, backend
Use one system for all three scenarios, or the comparison means nothing.
- Companion app for iOS and Android: consent, Bluetooth Low Energy pairing with a home device, readings, reminders.
- Clinician portal on the web: patient list, readings over time, care plan settings that push to the app. One device buyer we quoted needed clinician prescriptions to reach the patient app without re-entry.
- Backend: API and identity, data store, notifications, audit log.
Four roles log in: patient, clinician, clinic administrator, super administrator. The device stays outside the price. Its firmware and protocol documents are inputs, and their status is an assumption every scenario must state.
Why each of these surfaces is priced as its own product is explained in our breakdown of remote patient monitoring architecture.
Scenario 1: the MVP
The MVP answers one question: will a pilot clinic and its patients use this workflow?
In scope: the app's core flows, a portal for one clinician role that displays readings, one cloud region. Out of scope, in writing: EHR integration, clinical alerts, device control claims, single sign-on, a second region. Write the out-list down. The same research group, reviewing our out-of-scope tab, replied that many items on it were "actually features in our current application," and listed the ones it needed back.
Compliance does not wait for scenario 2. If you handle PHI on behalf of a covered entity, HHS's health app scenarios make the developer a business associate, and HHS cloud guidance requires a business associate agreement with the cloud provider even if it stores only encrypted data without the key. Outside HIPAA, the FTC's Health Breach Notification Rule reaches many health apps.
So build the MVP's data model for the next scenario. Acquaint Softtech prices HIPAA overhead at $29,000-$87,000 built in from day one and $67,000-$199,000 retrofitted.
Scenario 2: the regulated MVP
Scenario 2 exists when your intended use includes a device software function. In this system, that usually means two features.
FDA's device software policy focuses on software that connects to a medical device to control it or analyze its data, which covers a companion app that drives the device. The same guidance lists software solely intended to transfer, store, convert formats and display device data as not a device, but excludes functions that generate alarms or alerts or prioritize patient-related information on multi-patient displays for active monitoring. Display readings and you are in scenario 1. Raise alerts and you are in scenario 2.
Keep the device function small. FDA's multiple function guidance says other functions are not reviewed simply because they share a product with a device function, and that the device function should, to the extent possible, be separated in design and implementation.
Then price the evidence. The premarket software guidance sets a Basic or Enhanced documentation level; Enhanced adds a software design specification plus unit and integration test protocols and reports. If you declare conformity to IEC 62304, the software also gets a safety class A, B or C, from no injury possible to death or serious injury possible. That declaration is a choice: FDA calls conformance to recognized standards voluntary unless a standard is incorporated into regulation, and its software guidance also accepts a summary of your development practices. Either way, the estimate should name the route. FDA's cybersecurity guidance recommends a threat model and states that for cyber devices an SBOM is required.
Outside the vendor's price sit the $28,653 user fee and the review. The MDUFA goal is a decision on 95% of 510(k) submissions within 90 FDA Days.
The documentation and testing lines behind this scenario are listed in our breakdown of IEC 62304 compliance cost.
Scenario 3: the full program
The full program is what runs after the pilot or the clearance: every role and integration, and years of releases.
Typical additions are EHR integration, administrator reporting, single sign-on and localization, plus content updates without an app store release. Data location can matter more than features: one device buyer in our pipeline required separate US and European data storage for GDPR, which reshapes the backend. After launch, every update to a device function passes through change control.
Price it per release and ask for run costs. Healthcare buyers in our records asked for clear assumptions behind ongoing costs as well as build costs. A full program lives for years: we have extended a medical billing system since 2006, now in its fourth major release.
The assumptions register behind each price
A price without its assumptions cannot be checked. GAO's cost estimating guide sets the bar: a sound estimate "documents all cost-influencing ground rules and assumptions," and its major assumptions "are varied to determine how sensitive it is to changes."
Ask for these in every scenario:
- Roles, with a screen inventory per role.
- Platforms and minimum OS versions.
- Device and SDK status, with dates for anything missing.
- Each integration by name, with the sandbox owner.
- Intended use, documentation level and any IEC 62304 class assumed.
- Hosting region, BAA coverage and expected data volume.
- Environments, from development to production.
- Your approval turnaround and the test devices you supply.
- Everything excluded.
Then the sensitivity line: the three assumptions that move the price most, and the price if each proves false. One buyer wrote, "I am hoping that the cost estimate doesn't change based on the discussion points below." A register says in advance which points would change it.
How hours turn into a rate and where contingency belongs is covered in our guide to software project estimation.
Request wording you can paste into an RFP
- "Price three scenarios of the system in Attachment A: MVP, regulated MVP and full program."
- "For each, give one price, a timeline, the team, and in-scope and out-of-scope lists for the app, the portal and the backend."
- "Attach an assumptions register. Name the three assumptions that move the price most and the price if each proves false."
- "List costs outside your price, such as regulatory fees, consultants, clinical evidence and hosting."
- "State which scenario 1 deliverables carry into scenario 2 unchanged."
- "Quote run costs for the first 12 months after launch."
The fifth line does the most work. A vendor who answers "none" is quoting an MVP you will throw away.
If the buyer is grant funded and must issue a fixed price RFP for healthcare software, pair this wording with our two-phase template.
What our healthcare estimate records show
Counted by hand from our healthcare estimate and negotiation records, aggregated, with no client named.
- Where we priced one scope as a range, the top sat a median of about 40% above the bottom. The widest single-scope range ran about 70%.
- Where we priced one buyer at more than one scope level, the largest scope came to 1.25x to 4x the smallest, with a median of about 1.8x.
- For device-linked monitoring programs pairing a patient app with clinician or admin web access, negotiation price points ran from $75,000 to $440,000, median $165,000. The top was a program specified to FDA and IEC 62304 requirements.
- Removing one e-commerce integration took about $92,000 out of a companion app estimate.
Scope moved price more than estimating error did. When a quote spreads 2x or wider, ask which scope sits at each end.
Where scenario pricing falls short
Three limits, from our side of the table. Scenarios cost a vendor more estimating time, so expect a slower quote or a paid discovery phase first.
Scenario 2 is not the vendor's call. Intended use is a regulatory decision you own, and a vendor can only price the assumption you hand it.
Nor do scenarios remove device risk. A radio protocol that misbehaves on the bench moves all three prices at once. What they buy is a price you can check line by line, and phases you can fund one at a time. We built MatchedFlicker, which its case page describes as a 510(k) FDA-cleared application, for Windows desktop first. A later phase moved it to a multi-user web application with HIPAA-compliant online access in 3 months.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The estimate and negotiation records behind this article's pricing figures sit in the operations he oversees.
Send us your scope and get three priced scenarios back
Send your brief, the roles that will log in and whatever you have on intended use and the device. We will come back with the system split into an MVP, a regulated MVP and a full program, each with its own scope lists and the assumptions that would move its price.