DirectTrust Health App accreditation is an assessment of smartphone and web-based health applications, and the platforms that support them, against DirectTrust's program criteria, with a Digital Therapeutics add-on and a separate CARIN Code of Conduct program for consumer-facing apps. It is for developers of consumer and clinical health applications that have set a DirectTrust accreditation objective. IHS drafts the governance, privacy and user-information procedures and the evidence file for the chosen track; the developer's specialists own effectiveness claims, FDA questions and engineering.
This service sits in the IHS Accreditation Consulting practice line.
What is DirectTrust Health App accreditation?
DirectTrust released 2026 criteria versions for “its 28 accreditation programs starting January 1, 2026” (DirectTrust release, January 5, 2026). The three tracks on this page, by their 2026 version names:
- “Health App v2.1”
- “Digital Therapeutics v1.1”
- “CARIN Code of Conduct for Consumer-Facing Applications v1.1”
“DirectTrust's accreditation and certification programs are governed by the organization's Electronic Healthcare Network Accreditation Commission (EHNAC).” (DirectTrust release)
On scope, DirectTrust says: “The Health App base program is for smart-phone and web-based health application clients and/or the platforms that support them.” The program “also assesses health app stakeholder-specific criteria focused on systems that operate outside of HIPAA, such as the privacy and security for health and wellness data, including compliance with the FTC Health Breach Notification Rule.” (DirectTrust Health App program)
The Digital Therapeutics track builds on it: “The Digital Therapeutic program is an add on to the Health App accreditation.” DirectTrust describes it as “for those who desire to demonstrate compliance with efficacy, data privacy and security requirements for digital therapeutics applications and platforms (DTx). This program was developed in conjunction with the Digital Therapeutics Alliance, and is administered by DirectTrust.” (DirectTrust Digital Therapeutics program)
The CARIN program “developed in collaboration with the CARIN Alliance, is for consumer-facing apps desiring to enable patient and data holder confidence in app developers' ability to safeguard sensitive consumer health data” (DirectTrust programs overview). It “assures third parties and consumers that an organization will only share data collected in the application with the knowledge and consent of the end user” (DirectTrust Health App program).
The criteria documents are released on request. DirectTrust's program pages say: “Criteria for each of our Accreditation Programs are available for request at the top of the Programs and Criteria page.” (DirectTrust program page) DirectTrust has also published a draft of its 2027 criteria release; “the comment period ends on November 17, 2026” (DirectTrust programs overview).
Who needs it and what triggers it
The buyers are developers of consumer and clinical health applications. The trigger is a defined DirectTrust accreditation objective, or the need to build the operating program that the criteria assess. Situations described on DirectTrust's pages:
- An app or platform handles health and wellness data outside HIPAA, which the Health App program assesses, “including compliance with the FTC Health Breach Notification Rule” (Health App program).
- A digital therapeutic needs to show “compliance with efficacy, data privacy and security requirements” through the add-on (Digital Therapeutics program).
- A consumer-facing app wants to show it shares data only “with the knowledge and consent of the end user” (Health App program).
- An accredited organization faces renewal: “The accreditation cycle is for 2 years.” (DirectTrust accreditation process)
How the DirectTrust process runs
From DirectTrust's accreditation process page:
- “An Accreditation Program Agreement must be signed by the applicant and submitted.” and “A Financial Attestation to verify your organization's revenue must also be submitted.”
- After approval, “the Self-Assessment zip file will be made available to the organization, the Assessor will be assigned and the organization will be added to the Accredited Organizations page as a Candidate.”
- “New applicants can submit the self-assessment as soon as it is completed before the due date.” Renewing organizations “Submit complete self-assessment 4 months prior to the expiration date.”
- “The purpose of a Location Review is to confirm that the practices documented by the organization are being carried out in real life.”
- “The Commission reviews and votes on the Accreditation Report.”
- “DirectTrust offers an optional Midterm Accreditation review.”
The pages we reviewed do not state a total duration from application to decision.
How IHS helps
IHS works from the criteria the developer requests from DirectTrust for its chosen track. The process:
- Gap assessment of the developer's operations against the chosen track's criteria.
- Questionnaires to the product, clinical and legal leads on data use, user information, privacy, security and change control.
- A crosswalk from each criterion to the evidence that meets it and the person who owns it.
- Drafting governance procedures, the privacy notice and user-information procedures, change control and incident procedures, for the developer's leads to review and adopt.
- A mock review of the self-assessment and evidence file against the criteria.
- Readiness support, including drafted responses to assessor findings for the developer to submit.
What the developer supplies: the criteria document, product documentation, the current privacy policy, security records, and its product, clinical and legal leads.
The limit: effectiveness claims, FDA classification and engineering belong to the developer's own specialists. IHS does not test software or validate clinical efficacy. The developer signs the agreement, submits its own application and self-assessment, and deals with DirectTrust directly.
What to have ready
Each item below ties to DirectTrust's published program and process pages for the 2026 criteria versions (Health App v2.1, Digital Therapeutics v1.1, CARIN Code of Conduct v1.1). The criteria text itself comes from DirectTrust on request.
- The criteria document for your track, requested from DirectTrust; criteria “are available for request at the top of the Programs and Criteria page” (source).
- A decision on scope: Health App alone, Health App with the Digital Therapeutics add-on, or the CARIN program (source).
- Someone with authority to sign the “Accreditation Program Agreement” (source).
- Revenue figures for the “Financial Attestation to verify your organization's revenue”; DirectTrust says fees are based on program(s), location(s) and revenue level (source; fees).
- A list of your locations, since fees are “based on program(s), location(s), and revenue-level” and a Location Review checks practice on site (source).
- Privacy and security records for “health and wellness data” held outside HIPAA, including how you handle the “FTC Health Breach Notification Rule” (source).
- Consent records and data-sharing flows showing data is shared only “with the knowledge and consent of the end user” (source).
- For a digital therapeutic, the evidence your clinical leads hold on “efficacy, data privacy and security requirements” (source).
- Written procedures that match how the team works, because the Location Review confirms “the practices documented by the organization are being carried out in real life” (source).
Bring what you have to the introductory call; gaps in this list are where the work starts.
How it compares
DirectTrust offers several related tracks for apps. The table sets them side by side from DirectTrust's own descriptions.
| Track | What DirectTrust says it covers | Source |
|---|---|---|
| Health App (base program) | Smartphone and web-based health applications and their platforms, including privacy and security for health and wellness data outside HIPAA. | Health App program |
| Digital Therapeutics add-on | Efficacy, data privacy and security requirements for DTx applications and platforms; an add-on to Health App accreditation. | Digital Therapeutics program |
| CARIN Code of Conduct program | Consumer-facing apps showing they safeguard sensitive consumer health data and share it only with end-user knowledge and consent. | Programs overview |
| UDAP Client App add-on | “demonstrates through assessment and testing that a client application can interoperate with health information networks and FHIR® endpoints”. | Health App program |
The right track depends on what the product does, who asks for the accreditation and what the developer needs to demonstrate. FDA regulation of software is a separate question that these programs do not answer.
What it costs
DirectTrust publishes its fee schedule on its apply page: “Accreditation fees are based on program(s), location(s), and revenue-level. Accredited organizations incur an Annual Fee. Every other year when an organization pursues accreditation (their On-Cycle year), they additionally incur Assessment, Location, and (if applicable) Multi-Program Discounted and Program-Specific Fees, as appropriate. On Off-Cycle years, organizations pay only the Annual Fee.”
The page lists six revenue tiers. Examples as published:
| Revenue tier | Annual Fee | Multi-Program Discounted Fee | Assessment Fee | Assessment Fee, additional programs | Additional Location Fee |
|---|---|---|---|---|---|
| 1 – Very Small – Under $3M | $3,100 | $1,550 | $5,500 | $1,500 | $3,500 |
| 3 – Medium – Greater than $8 Less than $20M | $8,700 | $4,350 | $9,500 | $2,500 | $4,000 |
| 6 – Very Large – Greater than $75M | $27,500 | $13,750 | $15,000 | $5,000 | $6,000 |
Other published items: the Small tier is $4,300 annual and $6,000 assessment, and “Federal, state, and non-profit organizations are included in the Small Size”. The CARIN Code of Conduct program lists a program-specific fee of $3,100 annual and $2,500 assessment. No separate Digital Therapeutics fee line appears on the page. “Travel expenses are not included and will be invoiced after any physical location review(s) occur,” and DirectTrust charges “$250/hour for the Assessor time per additional submission of documentation.” Verify current fees with DirectTrust.
IHS scopes each engagement after a free introductory call.
What this is not
- It is not a guarantee of DirectTrust's decision; DirectTrust's Commission reviews and votes on the Accreditation Report.
- It is not legal, regulatory or FDA advice, and it does not validate a product's clinical claims or code.
- IHS does not submit to or correspond with DirectTrust. The developer submits its own application, self-assessment and responses.
Frequently asked questions
What is DirectTrust Health App accreditation?
It is a DirectTrust program for smartphone and web-based health applications and the platforms that support them, assessed against criteria that DirectTrust released in a 2026 version, Health App v2.1. DirectTrust programs are governed by its Electronic Healthcare Network Accreditation Commission (EHNAC).
Does a consumer health app outside HIPAA still need privacy and security controls?
The Health App program assesses criteria focused on systems that operate outside of HIPAA, including privacy and security for health and wellness data and compliance with the FTC Health Breach Notification Rule. What the FTC rule itself requires is a question for the developer's legal lead.
What is the Digital Therapeutics add-on, and does it require Health App accreditation first?
DirectTrust describes the Digital Therapeutic program as an add-on to the Health App accreditation. It covers efficacy, data privacy and security requirements for digital therapeutics applications and platforms, and was developed with the Digital Therapeutics Alliance.
What is the CARIN Code of Conduct program?
It is a DirectTrust program, developed with the CARIN Alliance, for consumer-facing apps that want to show they safeguard sensitive consumer health data. DirectTrust says it assures third parties and consumers that the app shares data only with the knowledge and consent of the end user. The 2026 version is CARIN Code of Conduct for Consumer-Facing Applications v1.1.
Does DirectTrust accreditation replace FDA clearance for a digital therapeutic?
The DirectTrust pages we reviewed do not describe any of these programs as an FDA pathway. FDA classification is a separate question for the developer's regulatory specialists, and IHS does not advise on it.
How much does Health App accreditation cost?
DirectTrust publishes fees by revenue tier, program and location. For example, the Very Small tier (under $3M) lists a $3,100 Annual Fee and a $5,500 Assessment Fee, with travel for location reviews invoiced separately. Verify current fees with DirectTrust.
How long does health app accreditation take?
The DirectTrust pages we reviewed do not give a total timeline. New applicants can submit the self-assessment as soon as it is complete, and the process then runs through a Location Review and a Commission vote on the Accreditation Report.
What policies does an app developer need before applying?
The exact list comes from the criteria, which DirectTrust releases on request. The program pages point to written privacy and security practices for health and wellness data, consent-based data sharing, and documented practices that a Location Review can confirm are carried out.
How often is health app accreditation renewed?
DirectTrust states the accreditation cycle is two years, with an annual fee each year and assessment fees in the on-cycle year. Renewing organizations submit a complete self-assessment four months before expiration, and an optional Midterm Accreditation review is available.