What a Health Risk Assessment Tool actually does
Conducts conversational wellness self-assessment replacing static questionnaires, generates lifestyle risk explanations with calibrated uncertainty language, and produces aggregate population-health dashboards for employer/insurer customers.
A wellness health risk assessment (HRA) platform replaces static paper or web questionnaires (Framingham score, PHQ-2, ASCVD risk questions) with a conversational AI intake grounded in peer-reviewed clinical guidelines via RAG. Claude Opus 4.7 routes through AWS Bedrock under a BAA, structured output enforces 'consider,' 'may suggest,' and 'discuss with your doctor' framing throughout. Every response goes through a safety classifier before delivery.
The compliance line in 2026 is narrow but clear: a tool that surfaces risk-awareness and suggests a doctor conversation is a consumer wellness app. A tool that outputs 'your cardiovascular risk score is X and you should start medication Y' is likely a Class II FDA medical device requiring 510(k) clearance (timeline: 6–18 months, cost: $25K–$250K+). The Texas AG's 2024 Pieces Technologies settlement (over accuracy claims about a clinical AI hallucination rate) is the enforcement precedent. Retain regulatory counsel before writing any code.
AI capabilities involved
Conversational intake replacing static questionnaire
Guideline-grounded risk explanation (RAG over AHA, ACC, USPSTF)
Calibrated uncertainty language enforcement
Aggregate population-health dashboard analytics
Who uses this
- Health insurers offering digital wellness benefits as a retention and engagement tool for members
- Employer wellness programs (self-insured, 1,000+ employees) wanting AI-enhanced health screening that drives preventive-care utilization
- Population-health vendors building conversational HRA as a module in their existing analytics platform
- Digital-health startups with retained clinical-affairs and regulatory-affairs teams
SaaS alternatives on the market
Real products you can sign up for today — with current 2026 pricing, honest pros and cons.
Sharecare
Large self-insured employers and health plans needing a proven, HIPAA-grade HRA with population-health analytics.
None
Enterprise PEPM; partial co-branding
Pros
- +Comprehensive health risk assessment validated in population-health research.
- +HIPAA-compliant infrastructure with BAA for covered-entity employers.
- +Integration with EHR systems for member health-data context.
Cons
- −Co-branding only — Sharecare brand appears alongside yours.
- −Enterprise-only pricing; complex procurement.
- −HRA content is Sharecare's IP — no customization of core risk algorithms.
Wellable
Benefits brokers wanting a WL platform with basic wellness check-in features — not a clinical-grade HRA.
Demo available
Quote-based; WL tier for benefits brokers
Pros
- +Explicit WL tier for benefits brokers; can include basic HRA module.
- +Integrates with employer HR systems for enrollment verification.
- +Broader wellness platform context beyond HRA alone.
Cons
- −HRA features are basic compared to Sharecare — primarily wellness check-in, not clinical risk assessment.
- −Clinical risk framing would require customization outside Wellable's platform.
- −Not FDA-strategy-aligned — does not position itself as a medical-adjacent tool.
The AI stack
The HRA AI stack must be HIPAA-eligible from the first line of code. The only acceptable LLM routing for production: AWS Bedrock (Claude Opus 4.7 available under self-serve BAA) or Azure OpenAI (GPT-5.5 under BAA + EU residency). No consumer-tier APIs.
Conversational HRA intake
Conducts the conversational health assessment, replacing static questionnaire with adaptive dialogue that follows up on risk signals
Claude Opus 4.7 via AWS Bedrock
$5 / $25 per M tokens + Bedrock overheadAny production HRA deployment — the BAA is non-negotiable
Azure OpenAI GPT-5.5 (EU residency endpoint)
$5 / $30 per M tokens + 10% endpoint premiumEU-market health assessments requiring data residency in EU regions
Our pick: Claude Opus 4.7 via AWS Bedrock for US deployments; Azure OpenAI GPT-5.5 for EU requirements. Both provide BAA coverage — the model choice is secondary to the compliance architecture.
Clinical guideline RAG
Provides evidence-based context for risk explanations grounded in AHA, ACC, USPSTF, and CDC guidelines
text-embedding-3-large via Azure (HIPAA-eligible)
$0.13 / M tokens via AzureAll clinical guideline RAG in HIPAA-eligible deployments
Our pick: text-embedding-3-large via Azure for all guideline embeddings. The HIPAA-eligibility of the embedding pipeline is as important as the LLM BAA.
Safety classifier for non-diagnostic framing
Checks every AI response for diagnostic language ('you have X', 'your risk score is Y/100') and replaces with calibrated wellness framing
Claude Sonnet 4.6 structured output
$3 / $15 per M tokensPost-generation validation of all HRA responses
Our pick: Two-stage generation: Opus 4.7 generates response, Sonnet 4.6 validates framing and rewrites any diagnostic language before delivery. The $0.02 per validation is cheap insurance against FTC/FDA exposure.
Reference architecture
The HRA architecture is a compliance-first pipeline: every data point collected, every AI response generated, and every risk narrative delivered must have a documented audit trail. The FDA SaMD boundary is enforced through structured output validation, not just prompt engineering.
User enters platform and provides informed consent
Next.js consent flowExplicit consent: data collection purpose, wellness-only framing, 'not medical advice' statement, right to request deletion. Consent stored with timestamp, IP, and session ID in consent_records.
Conversational HRA intake via Claude Opus 4.7 (Bedrock)
Supabase Edge Function → AWS Bedrock SDKSystem prompt enforces: 'You are a wellness self-assessment guide. Never diagnose. Never recommend specific medications or treatments. Use calibrated language: always say consider, may, could suggest, or discuss with your doctor.' Each response validated for diagnostic language. Conversation stored in assessments table under HIPAA-eligible Supabase + Bedrock configuration.
Risk narrative generation with USPSTF/AHA RAG context
Supabase pgvector (Azure-hosted embeddings) + Opus 4.7User's assessment responses embedded and matched against clinical guideline corpus. Top 3 relevant guidelines retrieved as context. Opus 4.7 generates risk narrative: calibrated uncertainty language, lifestyle recommendations (not prescriptions), 'consider discussing X with your healthcare provider.' Structured output validation checks for forbidden phrases.
Safety classification before delivery
Claude Sonnet 4.6 structured output validatorSonnet validates every generated response against a prohibited-language checklist: no diagnoses, no medication recommendations, no percentile risk scores presented as medical fact. If violation detected: substitute safe language variant. Log all substitutions for clinical audit.
Aggregate analytics generated for employer/insurer dashboard
Nightly Supabase aggregation + Haiku 4.5Individual assessment data aggregated to groups of 10+ (minimum group size to prevent re-identification). Haiku generates natural-language summary of population risk signals for the HR/insurer dashboard. NEVER per-individual data in employer-facing reports.
Estimated cost per request
~$0.25–$0.60 per complete HRA conversational session (Opus 4.7 via Bedrock, ~8K–15K tokens total including RAG); ~$0.05 per aggregate population dashboard update.
Cost calculator
Drag the sliders to model your actual usage. The numbers update in real time so you can stress-test economics before writing a single line of code.
Cost model for an employer wellness deployment: 2,000 employees, 40% completing the annual HRA.
Estimated monthly cost
$875
≈ $10.5k per year
Calculator notes
- HRA is an annual event — the $0.40 per employee per session is a one-time annual cost, not monthly. At 2,000 employees with 40% completion = 800 HRAs = $320/year total AI cost. Negligible.
- FDA regulatory counsel retainer is the real cost driver — budget $5K–$20K/month for retained regulatory counsel during development and clearance strategy.
- Clinical content validation (physician review of RAG corpus and response templates) adds $10K–$30K one-time.
- EEOC/ADA wellness-program incentive compliance: if HRA completion is incentivized, EEOC wellness-incentive rules apply (see employee wellness platform brief).
Build it yourself with vibe-coding tools
A Lovable prototype is acceptable for investor demos, regulatory-strategy discussions, and IRB-approved internal research. NEVER deploy to real users without BAA-covered infrastructure, clinical validation, and regulatory counsel review.
Time to MVP
1–2 weekends (demo prototype); 14–22 weeks for production
Total cost to MVP
$25 Lovable Pro + $40 Anthropic credits = working demo (not for real users)
You'll need
Starter prompt
Build a DEMO-ONLY prototype of an AI wellness self-assessment platform. PROMINENT DISCLAIMER ON EVERY PAGE: 'DEMO PROTOTYPE — NOT FOR USE WITH REAL HEALTH DATA. Not medical advice. For regulatory and investor demonstration only.' Features for demo: 1. Welcome screen with wellness self-assessment framing and explicit 'this is a demo, not medical advice' banner. 2. Conversational intake (5-10 questions): Edge Function calls Claude Sonnet 4.6 (note: production uses Opus 4.7 via Bedrock with BAA). System prompt: 'You are a wellness self-assessment guide. NEVER diagnose. NEVER recommend medications. NEVER use phrases like your risk is X%. Use only: consider, may suggest, discuss with your healthcare provider. Ask one follow-up question at a time about lifestyle factors (diet, exercise, sleep, stress) in a conversational way.' 3. Assessment summary: Sonnet generates a 200-word wellness summary using calibrated language. MUST include: 'These are general wellness observations, not medical advice. Please discuss any health concerns with your healthcare provider.' 4. Demo disclaimer footer on every page: 'FOR DEMONSTRATION PURPOSES ONLY. Production version uses HIPAA-eligible AI infrastructure (AWS Bedrock under BAA), structured output validation, and regulatory counsel review.' Note: this demo uses Anthropic API (non-HIPAA). Production MUST use AWS Bedrock with signed BAA.
Paste this into Lovable
Follow-up prompts (run in order)
- 1
For production: migrate from Anthropic API to AWS Bedrock SDK. Replace anthropic.messages.create() with @aws-sdk/client-bedrock-runtime InvokeModelCommand. Ensure aws_access_key_id, aws_secret_access_key, and aws_region are in Supabase Secrets. All Claude Opus 4.7 calls must route through Bedrock.
- 2
Add structured output validation layer: after every Sonnet/Opus response, a second Haiku 4.5 call validates against prohibited phrases (risk is X%, you have, you should take, diagnosis, treat). Returns {is_safe: bool, violations: [], safe_rewrite: string}. If unsafe: use safe_rewrite instead. Log all validations.
Expected output
A working demo conversational wellness assessment for investor pitches and regulatory-strategy discussions. Explicitly labeled as a demo — not for real users.
Known gotchas
- !FDA SaMD boundary: The output of your HRA is the key risk signal. 'Your ASCVD 10-year risk is 18%' = likely medical device. 'Your responses suggest some cardiovascular lifestyle risk factors — consider discussing this with your doctor' = potentially wellness software. Run every planned output format by a regulatory counsel before building.
- !Texas AG Pieces Technologies settlement (2024): Pieces Technologies settled with the Texas AG over accuracy claims about their clinical AI's hallucination rate. Any claim about your HRA's accuracy or reliability — even in marketing materials — can create regulatory exposure. Be extremely conservative in all public statements about accuracy.
- !EEOC/ADA: if HRA completion is incentivized (extra PTO, lower insurance premiums), EEOC wellness-incentive rules apply. Health-contingent incentives (completing HRA AND meeting a health benchmark) face the 30% incentive cap under ADA.
- !Zero-data-retention at the Bedrock level: enable ZDR (zero-data-retention) per call on Bedrock to ensure assessment responses are not retained by AWS after the API call completes. Document this in your HIPAA security assessment.
- !The clinical RAG corpus must be versioned: USPSTF, AHA, ACC, and CDC guidelines update regularly. When guidelines change (e.g. blood pressure targets changed significantly in 2023), your risk narrative templates must be updated. Build a corpus versioning workflow before launch.
Compliance & risk reality check
Health risk assessment tools sit at the intersection of the three most serious compliance areas in this cluster: FDA SaMD risk, HIPAA BAA, and FTC HBNR. All three must be addressed before production.
FDA SaMD — non-device CDS exemption is narrow
FDA's revised CDS guidance (January 2026) provides exemption for software intended to support general wellness and healthy lifestyle. The exemption does not apply if the software is intended to diagnose, treat, prevent, cure, or mitigate a disease or condition. An AI conversational HRA that outputs condition-specific risk scores is at high risk of SaMD classification. The 510(k) pathway for Class II wellness-adjacent devices costs $25K–$250K and takes 6–18 months.
Mitigation: Frame exclusively as 'wellness self-assessment that suggests healthcare provider conversations.' Never output a numerical risk score presented as a medical finding. Retain regulatory counsel pre-development to review your intended use statement, indications for use, and marketing copy.
HIPAA BAA — non-negotiable in any employer/insurer context
If the HRA platform is deployed by a covered entity (health plan, healthcare provider) or their employer-administrator acting as a business associate, a signed BAA is required with every PHI-touching technology vendor, including the LLM provider. AWS Bedrock (via AWS BAA) and Azure OpenAI (via Microsoft's HIPAA BAA) are the only production-viable LLM options.
Mitigation: Execute AWS Enterprise Agreement or Azure Enterprise Agreement with BAA before any real-user data touches the LLM layer. Configure zero-data-retention (ZDR) per call. Document BAA chain in your HIPAA security assessment.
FTC HBNR — health data exposure
HRA responses (diet, exercise, blood pressure history, family health history, stress levels) constitute health data under FTC HBNR. BetterHelp ($7.8M) and Cerebral ($5.1M) both had wellness-adjacent data sharing with ad pixels triggered enforcement. Any third-party analytics, advertising, or data broker sharing triggers HBNR notification obligations.
Mitigation: No third-party analytics or advertising on any HRA screen. Use privacy-preserving analytics only. Strict no-data-sharing policy contractually enforced with employer/insurer customers. Include in your privacy policy the specific data not shared.
EEOC/ADA — employer wellness incentives
If HRA completion is incentivized in an employer context, ADA wellness-program rules apply. Health-contingent incentives (tied to health outcomes) are capped at 30% of health coverage cost. Participatory incentives (reward for completing the HRA regardless of results) face fewer restrictions but EEOC has been actively challenging incentive structures.
Mitigation: Design as participatory (reward completion, not health outcomes). Consult benefits counsel on incentive structure before finalizing with employer clients. Do not auto-share HRA results with employer health plans without explicit employee consent.
Build vs buy: the real math
14–22 weeks (software); excluding FDA regulatory timeline
Custom build time
$40,000–$80,000
One-time investment
Year one (at insurer/employer PEPM contracts with 10,000+ covered lives)
Breakeven vs buying
A health insurer contract covering 100,000 members at $2–$5 PEPM = $200K–$500K annual contract value. A $60K custom build (including legal and clinical-validation costs) recoups in the first contract. The challenge is the regulatory-affairs investment: clinical validation, FDA regulatory strategy, and HIPAA security assessment add $50K–$150K to the build cost before launch. Total investment before first client: $110K–$230K. Tier-one insurer or large self-insured employer contracts are the only use cases where the economics close in year one.
Skip the DIY — RapidDev builds the production version
A Lovable MVP gets you a demo. Production needs auth that doesn't leak data, AI calls that don't bankrupt you, observability when models drift, and code you can audit. That's what we ship.
Discovery call (free)
30 minWe map your exact Health Risk Assessment Tool use case: who uses it, target volume, AI model choice, integrations, compliance scope. You get a detailed scope document and fixed-price quote within 48 hours.
AI-accelerated build
14–22 weeks (software); excluding FDA regulatory timelineOur engineers use Claude Code, Lovable, and custom tooling to ship 3–5x faster than agencies. You see weekly progress in a staging environment — not a black box.
Launch + handoff
1 weekWe deploy to your infrastructure, transfer the GitHub repo, set up CI/CD and monitoring, and train your team. You own 100% of the source code, prompts, and model configurations.
What you get
Timeline
14–22 weeks (software); excluding FDA regulatory timeline
Investment
$40,000–$80,000
vs SaaS
ROI in Year one (at insurer/employer PEPM contracts with 10,000+ covered lives)
30-min call. Fixed-price quote within 48 hours. No commitment.
Frequently asked questions
How much does it cost to build a white-label AI health risk assessment tool?
The software build from RapidDev runs $40K–$80K. Add $10K–$30K for clinical content validation and $30K–$100K for regulatory counsel and compliance infrastructure. Total pre-launch investment: $80K–$210K. A demo prototype costs $25 in Lovable + $40 API credits — only appropriate for investor and regulatory conversations, not real users.
What is the FDA SaMD risk for an AI health risk assessment?
Any AI tool that outputs specific medical risk scores, diagnoses, or treatment recommendations to users or providers is likely a Software as a Medical Device under FDA's 21st Century Cures Act regulations. Class II medical devices typically require 510(k) premarket clearance ($25K–$250K, 6–18 months). The safe zone is 'wellness self-assessment' that suggests healthcare provider conversations — but the line is narrow and must be confirmed by retained regulatory counsel.
Does an AI HRA need a HIPAA BAA with the AI provider?
Yes, in any employer or insurer deployment where PHI may be processed. AWS Bedrock provides a BAA via your AWS customer agreement. Azure OpenAI provides a BAA via Microsoft's HIPAA BAA program. Neither the standard Anthropic API tier nor the standard OpenAI API tier provide a HIPAA BAA. Do not use any AI that doesn't have a signed BAA for any health assessment data.
What's the Texas AG Pieces Technologies precedent?
In 2024, the Texas Attorney General settled with Pieces Technologies — a clinical AI company — over accuracy claims made about their AI's hallucination rate in marketing materials. The settlement established that overstating AI accuracy in health contexts is a deceptive trade practice under state consumer-protection laws. Any health AI company making specific accuracy claims ('our AI is 95% accurate') faces similar risk. Be extremely conservative: use 'may,' 'could suggest,' and 'wellness-oriented' framing in all public claims.
Is there any honest white-label HRA SaaS I can resell?
No fully honest one exists. Sharecare and WebMD Health Services offer co-branded employer wellness platforms with HRA modules — not true white-label. Wellable has a WL tier but its HRA module is basic wellness check-in, not clinical-grade risk assessment. The absence of a white-label HRA SaaS is both the compliance barrier (no vendor wants the regulatory exposure at a reseller price point) and the market opportunity.
Can RapidDev build a white-label HRA platform for our wellness program?
Yes, but with mandatory prerequisites. RapidDev has shipped 600+ applications and can build a HIPAA-grade conversational HRA platform on AWS Bedrock with structured output safety validation. We require that clients have: (1) retained healthcare regulatory counsel, (2) a clinical advisor to validate the RAG corpus, and (3) a clear FDA regulatory strategy before we start the build. Standard builds run $40K–$80K. Book a free 30-minute consultation — we'll help you determine whether a wellness-framed HRA or a more conservative health-tracking approach is the right scope.
Want the production version?
- Delivered in 14–22 weeks (software); excluding FDA regulatory timeline
- You own 100% of the code
- AI cost monitoring built in
30-min call. No commitment.
