Increasing Access to Safe, Effective, and Secure Digital Mental Health Technology Should Be a Federal Priority

Getting people with mental health and substance use disorders the right services is a challenge because of the limited availability of behavioral health providers. Recent national data show that only about half of adolescents and adults with mental illness, and only a quarter of adults with substance use problems, are receiving any care. These figures are lower for people in rural areas and those with limited financial resources. Ensuring that individuals receive care is critical to improving their health and contributes to overall reductions in costs. Digital mental health technology (DMHT) can be an important part in delivering this care.

How Can DMHT Help?

DMHT ranges from mental health digital apps that provide depression treatment or teach the practice of mindfulness, as well as other patient-facing tools that can be used in screening, diagnosis, and monitoring of behavioral health conditions. DMHT also includes tools to support clinicians in delivering care. Estimates of the market value for digital mental health technology range widely — from $9 billion to $20 billion — and are expected to more than double in the next decade. Despite the proliferation of digital tools, there is little guidance on safety, efficacy, and privacy, which has thwarted integration into behavioral health care. Both private and public purchasers are looking for data on impact and outcomes to inform coverage and payment decisions.

As with many health care products, how DMHT is regulated and reimbursed by the federal government can have a significant impact on patients’ access. To understand the impact of current federal rules on access to DMHT, we analyzed existing laws and regulations and gathered input from DMHT developers and other stakeholders with experience using and prescribing these tools. We found that while U.S. government rules are generally not specific to DMHT, there are laws and regulations that can impact DMHT across the product lifecycle.

Our work revealed several key themes:

Inconsistent oversight. Only a small portion of DMHT clearly falls under current regulations for consumer access and the mechanisms for reviewing what does are outdated. Tools classified as a “device” and “intended for use in the diagnosis of disease or other conditions, or in the cure, mitigation, treatment, or prevention of disease,” are subject to U.S. Food and Drug Administration (FDA) regulation. But most digital health apps are focused on “wellness management,” which means that most — more than 90,000 in 2020 — are not subject to FDA oversight. Thus, there is little information to guide purchase decisions or address concerns about risks to consumers.

Impact of artificial intelligence (AI). The mechanisms for FDA review do not consider how tools may change as companies use AI to improve usability and performance or to deliver and support care; this is different from a drug that has a specific formula that will not change. FDA noted these challenges in a 2022 report, where it called for new regulatory authority to augment existing rules.

Perceived lack of federal coordination. DMHT developers reported an apparent lack of coordination across federal entities, which can make it more costly to meet the needs of different agencies. FDA and the Centers for Medicare and Medicaid Services (CMS) have different mandates based on their authorizing legislation and regulations and have made attempts to coordinate. The differences in those mandates, however, can create challenges, particularly for smaller companies that target underserved populations and have limited resources for creating the evidence needed to address the different expectations of FDA and CMS. Further coordination and clarity will help drive government and private sector efficiency.

Concerns about data use and sharing. Data privacy and security arose as key concerns, especially given the highly sensitive nature of DMHT, recent data breaches affecting health care entities, and the growing use of AI. Health care privacy and security rules under the Health Insurance Portability and Accountability Act (HIPAA) do not apply when tools are not controlled by a health care entity, and it can be difficult for consumers, clinicians, and even vendors to know when these rules do apply. The Federal Trade Commission’s responsibility for protecting privacy and personal information is relevant for tools that do not fall under HIPAA.

Opportunities to Promote Access to DMHT by Updating and Clarifying Federal Regulations

Ensuring that DMHT is safe, effective, and secure is critical to addressing the mental health crisis that threatens our country’s productivity and the well-being of our citizens. With a new U.S. Department of Health and Human Services (HHS) Secretary who has promised to focus on strategies to improve health, wellness, and government efficiency, this is a good time to assess and clarify federal authorities affecting DMHT. The new administration and Congress should work with private sector entities to address specific problems and confusion reported by stakeholders. These include:

• Targeting evidence requirements for faster market access. The Trump administration could work with private payers to give DMHT vendors more clarity and guidance on evidence requirements for use and payment to help provide more predictability and faster market availability.
• Expand Medicare reimbursement of DMHT. While the new DMHT billing codes to the 2025 Medicare Physician Fee Schedule are an important initial step, Congress and the administration could seek additional opportunities to ensure uptake of these services and expand reimbursement for other categories of DMHT that demonstrate safety and effectiveness.
• Forge consensus on a modern regulatory framework. The Trump administration could encourage the development of a multistakeholder, consensus-based process to develop a modern and efficient regulatory framework to advance access and adoption of DMHT. This may involve Congress using an oversight role to determine where new authorities are needed.
• Boost data privacy and security awareness. HHS could provide more clarity and awareness regarding data privacy and security requirements and work with vendors and other stakeholders to improve consumer awareness of data privacy and security requirements.
• Expand DMHT Access to People in Need. HHS could make DMHT more broadly available, especially among communities with limited access to broadband, individuals with limited resources, and locations with the greatest shortages of behavioral health providers.