International Digital Health Tool Shortlist

International Digital Health Tool Shortlist

A defensible shortlist is a record of which exact candidates may enter deeper evaluation for one defined job in one defined market. It is not a list of famous brands, a global ranking, a procurement approval, or a deployment decision. The same supplier may be eligible for one function, country, entity, product version, and workflow while remaining out of scope or unresolved elsewhere.

Start with the health-system problem, not search results. Then identify each product, function, version, intended use, jurisdiction, data path, evidence package, interoperability claim, localization dependency, operating requirement, and exit path. Missing evidence stays visible. A polished demonstration, certification logo, lower price, or projected saving cannot rescue a failed safety, regulatory, privacy, data-integrity, clinical-authority, recovery, or exit requirement.

This guide is for healthcare technology research and procurement planning. It is not medical, clinical, legal, regulatory, privacy, security, reimbursement, or compliance advice. Qualified local owners must determine the applicable obligations and whether a candidate can move to the next stage.

Use the result as an evidence-controlled handoff. The permitted states are excluded, hold — material question, evidence pending, or eligible for scoped evaluation. The last state only allows deeper review for the named scope. It does not select a winner.

Gate 1: define the health-system problem before naming products

Record the country, purchasing and legal entity, health programme, care setting, workflow, user, population, current process, known failure, desired outcome, and owner who can stop the work. Separate the problem from a preferred technology. A request for an app, platform, AI assistant, or national system is not yet a testable need.

Use the WHO Classification of digital interventions, services and applications in health, second edition to describe the health-system challenge, intervention or capability, service or application type, and intended user with a shared vocabulary. The classification supports like-for-like discovery; it does not endorse a product.

The WHO recommendations on digital interventions for health system strengthening distinguish benefits, harms, acceptability, feasibility, resource use, and equity. A digital intervention still depends on health-system capacity, workflow, training, infrastructure, and accountable people. An intervention-level recommendation is not evidence that a named product will reproduce the result.

List explicit exclusions: countries, sites, specialties, populations, languages, devices, decisions, data classes, and downstream actions that are not part of the search. A narrow shortlist must not become permission for an adjacent use.

Evidence request: approved problem statement, country and entity, current process and alternative, affected users and population, desired capability, measurable outcome, exclusions, sponsor, stop authority, source date, and expiry.

Stop rule: do not create a product longlist when the problem, owner, country, entity, user, workflow, or excluded decisions remain undefined.

Gate 2: freeze candidate identity and intended use

Create one identity record for each candidate. Capture the legal manufacturer or supplier, product, module, function, model and model provider where relevant, software release, configuration, deployment pattern, hosting region, intended purpose, target user and population, inputs, outputs, and evidence date. Company-level marketing cannot substitute for function-level identity.

For a possible software medical-device function, the IMDRF final technical documents on SaMD key definitions, risk categorization, and clinical evaluation can normalize intended medical purpose, significance of the information, healthcare situation, and evaluation evidence. These final technical documents support regulatory convergence; they are not national marketing authorizations.

Record dependencies separately. A platform may embed another model, API, terminology service, identity provider, analytics service, hosting provider, or local implementation partner. Evidence for the supplier brand does not automatically cover those components or their versions.

Specify material-change triggers before screening. A change to function, intended use, model, provider, input data, output, jurisdiction, hosting, subprocessor, interface, or configuration can expire the identity record and reopen later gates.

Evidence request: legal entity, product/module/function, software and model version, dependency tree, intended purpose and user, input/output, environment, country, source URL, evidence date, limitation, and recheck trigger.

Stop rule: a brand name, product family, category page, roadmap, reseller description, or old-version record cannot establish the identity being shortlisted.

Gate 3: build one jurisdiction lane per country and function

Create a separate lane for every country and function. Record the local regulator, possible category, classification basis, applicable law or guidance, marketing or licensing evidence, indication and scope, status date, official record, and accountable local reviewer. Do not copy one market's conclusion into another.

For an EU lane, MDCG 2019-11 rev.1 can support function- and intended-purpose questions about medical-device software. The June 2025 document identifies itself as non-binding guidance. It is not an approval, a CE-mark decision, or a substitute for qualified interpretation of Union and national requirements.

For a United States device claim, use the FDA medical-device databases and device study and marketing pathway to distinguish 510(k), De Novo, PMA, registration, listing, and other records. Verify the exact manufacturer, device, decision type, indication, date, and status. FDA registration and listing do not mean clearance or approval.

For Canada, the Medical Devices Active Licence Listing covers licensed Class II, III, and IV devices offered for sale. Class I devices do not appear in MDALL because they do not require a device licence. Absence from that database is therefore not a universal product or legality conclusion without class and scope review.

Evidence request: country, entity, exact function, regulator, category and classification rationale, official record and identifier, indication, status and decision date, limitation, local reviewer, observed date, and expiry.

Hold rule: keep a candidate on hold — material question when a status claim is unsupported, belongs to a different function or version, conflicts across sources, or lacks an accountable local decision owner.

Gate 4: map data, hosting, and cross-border transfers

Trace the actual proposed flow. Record data categories, source and destination systems, controller, processor or locally relevant roles, patient and workforce access, hosting and backup locations, remote support, subprocessors, telemetry, model training or reuse, retention, deletion, export, incident duties, and termination handling.

For EEA personal-data flows, the European Commission's rules on international data transfers identify mechanisms such as adequacy decisions, standard contractual clauses, and binding corporate rules. The final EDPB Recommendations 01/2020, version 2.0 address supplementary measures. Naming SCCs does not establish that the actual transfer, roles, destination, local law, contract, and controls are adequate.

Keep jurisdiction lanes separate. EEA transfer analysis is not a global data-residency rule. Another country may define health-data, consent, localization, hosting, breach, government-access, or retention obligations differently. The shortlist record routes those questions to local counsel and privacy owners rather than inventing a universal answer.

Unknown support access, undisclosed subprocessors, unbounded secondary use, missing critical logs, unverifiable deletion, or an unusable export may be a hard stop. Do not transform a missing data-flow answer into a lower numeric score.

Evidence request: field-level data-flow map, roles and purposes, transfer locations and mechanism, subprocessor list, access and support paths, training and reuse terms, retention/deletion/export evidence, incident duties, local owner, gap, and review date.

Stop rule: a candidate cannot be eligible while a material data flow, secondary use, transfer basis, critical access path, retention term, or exit disposition is unknown and unowned.

Gate 5: match clinical, AI, and safety evidence to intended use

Match every performance or safety claim to the exact product function, software and model version, intended use, population, setting, language, input, endpoint, comparator, study method, date, limitations, and excluded cases. Keep supplier studies, regulatory decisions, independent studies, and local buyer observations in separate evidence classes.

The WHO publication on regulatory considerations for artificial intelligence for health can prompt questions about intended use, risk-benefit evidence, performance evaluation, lifecycle monitoring, and stakeholder accountability. WHO expressly describes it as a high-level, nonexclusive overview, not guidance, a regulatory framework, or a policy. It does not certify a candidate or create one global legal test.

For a possible SaMD function, record the evidence supporting valid clinical association, analytical or technical validation, and clinical validation as applicable to the chosen jurisdiction lane. A regulatory authorization answers only its stated scope. It does not prove local workflow fit, subgroup performance, usability, language quality, or safe operation in the buyer's environment.

For AI, record data provenance and representativeness, subgroup results, uncertainty, failure modes, human authority, correction, model and software change controls, monitoring, incident response, and evidence expiry. Labels such as assistive or human in the loop do not prove a safe operating design.

Evidence request: claim ID, exact function and version, source and evidence class, population and setting, language, endpoint and comparator, sample and method, results, limitations and negative findings, transfer gap, buyer test needed, owner, date, and expiry.

Open rule: when evidence does not match the named version, population, setting, language, workflow, outcome, or jurisdiction, keep it open / conflicting / expired rather than treating it as favorable partial proof.

Gate 6: verify implemented interoperability and localization

Treat API, standards-based, FHIR, multilingual, localized, accessible, and integrates with claims as supplier assertions until they are tied to the proposed configuration and buyer-observed evidence. Record what is exchanged, which direction it moves, when it changes, how errors surface, and who reconciles the final state.

The official FHIR R5 specification identifies R5 5.0.0 as the current published release and labels it Standard for Trial Use. The HL7 publication directory distinguishes published releases from R6 development, ballot, and snapshot material. A candidate must identify the exact release, profiles, implementation guides, resources, operations, terminology, extensions, authentication, conformance statement, and supported behavior. A FHIR label does not prove local fit or plug-and-play interoperability.

Localization includes more than interface translation. Record local terminology, content ownership, clinical guideline adaptation, units, date and number formats, names and identifiers, reading level, accessibility, language fallback, consent text, user support, and change control. Test missing translations, mixed-language records, right-to-left display where applicable, truncated content, unsupported characters, and ambiguous clinical terms.

The WHO Digital Implementation Investment Guide supports needs-based planning aligned with country readiness, national digital architecture, implementation capacity, interoperability, and health-system goals. It does not provide a product score, certification, universal pass mark, or proof of local readiness.

Evidence request: standard and exact version, profile and implementation guide, resources and operations, terminology, interface direction, authentication, error and reconciliation design, localization requirements, accessibility evidence, test environment, observed result, defect, owner, and retest plan.

Stop rule: do not call candidates comparable when they use different interface versions, profiles, data, workflow paths, languages, or success criteria, or when a material failure cannot be reconstructed and reconciled.

Gate 7: expose implementation, commercial, and exit dependencies

Make customer work visible before a candidate survives. Record connectivity, devices, identity, integration, configuration, migration, local content and clinical validation, testing environments, accessibility remediation, training, monitoring, incident response, support timezone and language, local partner duties, internal staffing, and operating ownership.

Commercial inputs must match the same entity, country, product/module/version, users, volume, currency, tax treatment, implementation boundary, support tier, contract period, renewal condition, and exit scenario. Do not publish a vendor price, implementation duration, market share, saving, or return without a separate, dated, verified source.

Exit is a shortlist requirement, not a post-contract detail. Ask whether the buyer can export data, configurations, users, decisions, logs, evidence, incidents, and version history in usable formats. Record transition support, access revocation, return or deletion, retained records, dependency replacement, and the owner who verifies completion.

Route detailed cost inputs to the pricing page and economic assumptions to the ROI page. A low quote, projected value, popularity, or short deployment estimate cannot compensate for a safety, regulatory, privacy, data-integrity, clinical-authority, recovery, or exit failure.

Evidence request: implementation and dependency plan, named owners, environment and staffing inputs, support and escalation terms, comparable quote basis, renewal and change terms, export format, transition duties, return/deletion evidence, source date, open assumptions, and expiry.

Hold rule: keep the candidate on hold when required internal work, local partner duties, support coverage, dependency cost, renewal exposure, usable export, deletion, or transition assistance remains unknown.

Gate 8: record a scoped shortlist decision and handoff

Review the five buyer-owned artifacts in a buyer-controlled meeting. Record one state for each exact country/function/product/version scope: excluded, hold — material question, evidence pending, or eligible for scoped evaluation. Preserve rejected assumptions, failed candidates, negative findings, dissent, exceptions, and evidence gaps.

Do not calculate a weighted winner. Safety, regulatory, privacy, data-integrity, clinical-authority, recovery, and exit failures cannot be offset by a weighted total, feature count, price, projected savings, executive preference, or vendor popularity. An exception needs a qualified owner, rationale, interim control, deadline, expiry, and a rule for reopening the decision.

Define the next stage for every surviving candidate. Questions for cross-vendor evaluation, security and compliance review, configured workflow validation, quote normalization, ROI analysis, and local pilot design travel with the handoff. The shortlist does not complete those reviews.

Expire the decision when evidence ages or when the candidate changes its function, intended use, software, model, provider, data path, subprocessor, country, hosting, interface, configuration, terms, support, or exit capability.

Evidence request: candidate and bounded scope, gate-by-gate result, stage state, reason, hard stop, condition or exception, unresolved evidence, dissent, decision owner, date, expiry, material-change triggers, next-stage owner, and linked artifacts.

Stop rule: a shortlist without traceable evidence, an accountable decision owner, an expiry date, and a named next-stage handoff is incomplete and cannot authorize procurement, contracting, pilot success, deployment, expansion, renewal, or clinical use.

Questions by accountable owner

Each answer must point to a field in a buyer-owned artifact. A meeting statement without a source, exact scope, version, owner, observed date, limitation, and next action remains evidence pending.

Country sponsor and health-program owners

• Which country, entity, health-system problem, workflow, user, population, outcome, current alternative, and exclusions define this search?
• Which digital intervention or capability is required, and which adjacent needs are explicitly outside this shortlist?
• Who can stop the search, approve entry to deeper evaluation, and reopen the decision after a material change?

Clinical, safety, and regulatory owners

• Which exact function, intended purpose, population, setting, language, output, and downstream action does each regulatory or evidence record cover?
• Which safety, clinical-authority, wrong-record, omission, subgroup, accessibility, or monitoring gap is non-compensating?
• Who owns the local classification and authorization conclusion for each country and records its source, status, date, limitation, and expiry?

Privacy, legal, and security owners

• What data is created, received, stored, transferred, viewed, reused, retained, deleted, or exported by each entity and subprocessor?
• Which transfer mechanism, role, contract, security evidence, incident duty, and supplementary measure applies to this exact flow?
• Which unknown access, secondary use, location, retention, deletion, recovery, or exit fact must stop or hold the candidate?

Architecture, interoperability, and implementation owners

• Which standard release, profile, implementation guide, resource, operation, terminology, authentication method, and interface direction was examined?
• Which identical normal, error, correction, outage, fallback, recovery, reconciliation, localization, and accessibility scenarios must every candidate face?
• Which infrastructure, integration, configuration, validation, training, support, staffing, and local-partner dependencies remain unverified?

Procurement, finance, and decision owners

• Are candidates scoped to the same entity, country, product/module/version, volume, term, support tier, implementation boundary, and exit scenario?
• Which supplier claims are official jurisdiction records, supplier documented, independent study or standard evidence, buyer observed, or open / conflicting / expired?
• Who records excluded, hold — material question, evidence pending, or eligible for scoped evaluation, and when does that decision expire?

Five buyer-owned shortlist artifacts

The buyer owns these records. A supplier attachment is evidence input, not the system of record for the decision. Every artifact retains source URL, document or version, observed date, owner, limitation, expiry or recheck trigger, and next action.

A. Need and country-scope charter

Record the country and entity, workflow and health-system problem, current process and alternative, user and population, intervention or capability taxonomy, desired outcome, included and excluded scope, sponsor, stop authority, approval date, and expiry.

This charter prevents product-first search. If the need, local owner, or country lane is missing, stop before collecting vendor names.

B. Candidate identity and jurisdiction matrix

Record legal manufacturer or supplier, product, module, function, model and provider, software version, configuration, intended use, country, regulator, category, classification basis, official record, identifier, indication, status and date, local reviewer, dependencies, and material-change trigger.

One row covers one bounded identity and country lane. Company-level badges and another market's status do not close it.

C. Claim-to-evidence ledger

Record the requirement or claim, evidence class, source artifact, exact function and version, population, setting, language, endpoint, method, results, limitations, negative findings, transfer gap, verifier, status, observed date, expiry, and buyer test needed.

Keep conflicting and expired evidence. Do not delete a failed claim because another candidate presents a stronger one.

D. Data, interoperability, and localization fit matrix

Record data classes, roles, purposes, systems, locations, transfers, subprocessors, access, reuse, retention, deletion, export, incident path, standard/profile/version, operations, terminology, interface direction, localization and accessibility requirement, infrastructure, workforce, support, observed test, gap, owner, and retest.

This matrix shows whether deeper evaluation is plausible. It does not prove configured production readiness.

E. Shortlist decision and handoff record

Record candidate and scope, gate results, stage state, reason, hard stops, conditions, exceptions, dissent, decision owner and approver, decision and expiry date, material-change triggers, retained rejection reason, next specialist, and linked evidence.

The handoff preserves open questions. It does not convert them into approval simply because another team will review them later.

Evidence classes and shortlist states

Use official jurisdiction record for a law, regulator, official database, or official decision tied to the exact scope. It is not portable across jurisdictions.

Use supplier documented for a contract, policy, technical file, roadmap, statement, or supplied study. It remains a supplier assertion unless another evidence class verifies it.

Use independent study or standard evidence for a study, guideline, technical document, or standard. Preserve its population, version, method, maturity, and applicability; it is not automatically a product authorization.

Use buyer observed for a configured demonstration, reference check, technical test, or local pilot in the named environment. Do not generalize it beyond that environment.

Use open / conflicting / expired when evidence is missing, inconsistent, stale, for another version, or outside the proposed context. It never means zero risk.

Stage states are excluded, hold — material question, evidence pending, and eligible for scoped evaluation. Eligible for scoped evaluation does not mean selected, purchased, approved, compliant, safe, effective, interoperable, or ready for production. No blank field becomes a pass or not applicable without a recorded rationale and owner.

Current legal, guidance, and standards boundaries

The WHO Global Strategy on Digital Health 2020–2027 is the current strategy period. WHA78(22) extended the original period to 2027; the 2028–2033 strategy is still under development. The strategy supports coordinated financial, organizational, human, and technical planning. It does not name, rank, approve, or endorse products.

IMDRF N10, N12, and N41 are final technical documents, not national marketing authorizations. Each country applies its own law, classification, process, and official records. MDCG 2019-11 rev.1 is non-binding guidance, not a binding court interpretation or product decision.

Use the current consolidated EU AI Act rather than an undated summary. Determine the specific system or function, provider or operator role, provision, risk branch, and applicable date. The text contains later application dates for specified high-risk obligations; it does not support saying all healthcare AI is high-risk or attaching one date to every duty.

FHIR R5 5.0.0 is the current published release and is labelled Standard for Trial Use. R6 entries observed in the official directory remain development, ballot, or snapshot material. A roadmap referencing R6 is not current production support, and an R5 claim still requires exact profiles, operations, configuration, and test evidence.

FDA registration and listing do not mean clearance or approval. Health Canada MDALL covers active Class II, III, and IV licences; Class I devices do not appear in MDALL. In both cases, verify the exact product, company, identifier, indication or scope, decision type, date, and current status before using the record.

FAQs

How many candidates should survive the shortlist?

There is no universal number. Keep only candidates that satisfy the same mandatory eligibility fields for the named country and function, while preserving material open questions. Capacity for deeper review is a planning constraint, not evidence that a fixed number is correct.

Does WHO identify the best digital health products?

No. The cited WHO materials help define needs, capabilities, context, evidence questions, readiness, and architecture. They do not endorse a product, publish this shortlist, or prove local fit.

Does one country's authorization transfer to another country?

No. It may be evidence input, but each country lane needs its own law, category, status source, scope, decision owner, and observed date. Even within one market, evidence for one module, indication, population, or version cannot be applied automatically to another.

Does FHIR support prove interoperability?

No. Record the release, profiles, implementation guides, resources, operations, terminology, authentication, direction, configuration, and buyer-observed scenarios. A label does not show that the required data moves correctly or can be reconciled after failure.

Do SCCs automatically make an EEA transfer compliant?

No. The buyer must map the actual exporter, importer, data, purpose, destination, subprocessor chain, transfer tool, local-law assessment, supplementary measures where applicable, and other sectoral duties. Qualified owners determine applicability.

What does eligible for scoped evaluation authorize?

Only entry into a named deeper review for the recorded country, entity, function, product, version, and conditions. It does not authorize purchase, contracting, pilot success, clinical or legal approval, deployment, expansion, renewal, or use with patient data.

Handoff to adjacent decision pages

Use the international buyer checklist for procurement readiness, owners, and the minimum evidence request before or alongside discovery.

Use the international vendor evaluation guide for cross-vendor evaluation, deeper hard gates, comparable diligence, and a bounded selection record after candidates become eligible.

Use the international workflow implementation guide for configured implementation, cutover, downtime, rollback, reconciliation, monitoring, and operational authority after selection.

Use the international security review and compliance questions for security and compliance deep review, local legal interpretation, contracts, controls, and residual-risk acceptance.

Use the international pricing questions and international ROI model for pricing and ROI: quote normalization, country-level cost, local baseline, attribution, cash and capacity, downside, and realization.

Use international pilot planning for local pilot execution, cohort, scenarios, acceptance and stop criteria, staffing, adverse findings, and exit. A demo is not a pilot result.

This shortlist method routes work to those pages and does not complete their reviews. No candidate crosses a material hard stop merely because another review is scheduled later.

Evidence boundary

This page provides a buyer-owned method, not a named product shortlist. The gates, artifacts, evidence classes, and stage states are HealthAIdir editorial design, not an official procurement template from WHO, IMDRF, the European Union, FDA, Health Canada, or HL7.

Official sources are cited only for their stated status and scope. No source here establishes product performance, local workflow fit, legal applicability, interoperability, price, availability, market leadership, or vendor approval outside its explicit record. No vendor products were tested, ranked, scored, interviewed, recommended, or compared for this article.