Healthtech software company due diligence

A buyer under a letter of intent is past judging and into proving. One method is to ask for the document, then check it against something the seller did not write: a public listing, a customer agreement, a second source. Healthtech software adds two layers to ordinary software diligence, a privacy layer and a regulatory one, and each can produce findings that change a deal in specific ways. The sections below cover what to request and what the results can mean.

The product and regulatory file

Ask for the company’s written assessment of whether any feature is a medical device function, and for any correspondence with Health Canada. If the company says it holds a medical device establishment licence, search Health Canada’s public live listing of licences yourself rather than relying on a copy supplied by the seller. Then compare the product’s release notes over time with the assessment, because features added after the assessment was written are the ones it may not cover. This page cannot say where the line falls. That is a classification question for Health Canada’s guidance and a regulatory specialist. What the buyer can establish is whether the company has ever asked itself the question in writing.

Privacy and data handling

Start with the incident file. Organizations covered by PIPEDA must report a breach of security safeguards involving personal information under their control if it is reasonable in the circumstances to believe it creates a real risk of significant harm, and must keep a record of every breach, serious or not, and the OPC says those records must be detailed enough for it to judge whether the risk was assessed properly. A company with no incident records has either had no breaches or has not been keeping records, and a buyer can ask which. Next, compare the privacy policy and sales claims with a data-flow description from the technical team, including where the data is hosted.

For Quebec customers, the regulator’s Law 25 guidance says organizations must carry out a privacy impact assessment, among other cases, for any project to acquire, develop or overhaul an information system involving personal information, and before communicating personal information outside Quebec. It also requires a register of confidentiality incidents that can be produced to the Commission, and says the privacy settings of a technology product offered to the public must default to the highest level of confidentiality (cookie settings are excepted). Ask for those assessments and the register. Finally, read the agreements with clinics. Ontario’s privacy commissioner’s succession-planning guidance for custodians names, among the tasks during a transfer of records, making agreements with agents, such as a record storage company, that set out their duties concerning the records, so ask what the company’s own agreements say on the same point.

Contracts and EMR integrations

Build a schedule of every customer contract with its term, renewal date, assignment clause and any change-of-control right. Institutional agreements can carry consent requirements and termination rights, and a health authority’s procurement terms may differ from a clinic’s standard form. Then read the EMR vendor documents separately: the integration agreement, any certification, and the credentials the product uses to connect. Ask whether each is issued to the corporation or to a named person, whether it can be transferred, and what the vendor’s process is. An integration that cannot move to the buyer on closing is not a paperwork problem. It means the part of the product customers value most may not work for the new owner.

Code and chain of title

Software ownership turns on paper. Under the Copyright Act, where an author was employed under a contract of service or apprenticeship and made the work in the course of that employment, the employer is the first owner of the copyright in the absence of any agreement to the contrary, subject to the section’s own exceptions. That rule speaks only of employees and apprentices. An assignment of copyright is valid only if it is in writing and signed by the owner or the owner’s duly authorized agent, and moral rights cannot be assigned but may be waived. So ask for signed contracts or assignments from every contractor, co-founder and former employee who wrote material code, and for a scan of the code base for open-source components and their licences. A signed confirmatory IP assignment from the author is one way to close a gap, and the Canadian Intellectual Property Office explains how an assignment can be registered.

Tax credits and the financial file

If the company has claimed SR&ED credits, ask for the claim filings, the project descriptions and any CRA correspondence. The CRA offers optional pre-claim approval and has a process for claims that need review, so the file shows whether the work was described consistently and whether any review is open. Match recurring revenue to signed contracts customer by customer, and look at renewals and cancellations over time.

What the findings mean

Findings are not equal, and the same item can mean different things depending on what else turns up.

• A feature that may be a medical device function without the licensing it needs is a regulatory problem the buyer would take on, so settle with a regulatory specialist whether and how it can be fixed before deciding whether to proceed.
• Data handling that does not match the company’s own claims can lead to a price reduction, a specific indemnity or a fix before closing, depending on how serious the gap is.
• An EMR certification or integration that does not transfer cuts off the product’s core function, so it may need to be a closing condition rather than a task for after closing.
• A missing code assignment clouds title to part of the product. The seller may be able to cure it, but only if the author can be found and will sign.
• An undisclosed incident can matter less for what it was than for what it says about record-keeping and candour.