Building Digital Health on Grant Funding: SBIR/STTR, HRSA, and Federal Timelines

Teams that build a health app with grant funding usually treat the award as the hard part and the build as what comes after. The award has published guidance behind it. The build runs on federal rules that are mostly locked in before you hit submit.

On an SBIR Phase I your company has to perform at least two-thirds of the work itself, so no more than a third of the total award can go to all outside parties combined, and consultants count inside that third. That fixes your outside development budget before anyone has named a feature.

The calendar is just as fixed, and it moved recently. NIH declared every one of its small business funding announcements expired on November 17 2025, effective immediately, and the replacement parent announcements didn’t arrive until May 28 2026.

Then there’s what the terms do after the money lands. Vianair, a software company, paid $225,000 and gave up $299,947 in unpaid grant funds, $524,947 in total, to settle allegations that it performed NSF grant work outside the United States.

Most of what the award does to your build gets decided before the application goes out.

How do you build digital health software on federal grant funding?

On an SBIR Phase I no more than a third of the total award can leave your company, which fixes the outside development budget at roughly $107,000 against a maxed $323,090 NIH award. The federal calendar sets the start date: a September 2026 submission has an earliest project start of April 2027. Name and quote the partner inside the application, because adding one later is a change in scope needing NIH’s written approval.

Key Takeaways:

1. The outside development budget is fixed before anyone discusses features. A third of an SBIR Phase I can leave your company, measured on total costs, which is roughly $107,000 against a maxed NIH award.
2. Phase I funds a feasibility slice, so aims written as a product describe software the award can’t pay for. Comparable Phase II builds ran $1.5 million and up.
3. A named partner can’t lift your review score, but its absence can be written down against you. Adding one after the award needs NIH’s written approval before you sign.

NIH funds the R&D, HRSA funds the service delivery: where digital health software fits

Federal health money divides by what it buys before it divides by mission. NIH buys research and development; HRSA buys service delivery, with technology as a line item inside a care budget.

Timing closes two of those rows right now. AHRQ has nothing open in digital healthcare research, and ARPA-H takes no investigator-initiated proposals at all.

The gate at NSF is the shape of the work. The NSF SBIR Digital Health topic is live and it funds software builds, but the agency returns without review any proposal requesting support for clinical studies. Out of scope:

• pre-clinical and clinical-stage drug and device development
• clinical efficacy and safety studies
• work performed primarily for regulatory purposes

Human-subjects work is acceptable only as feasibility proof of concept, so a build with a pilot study attached has no path at NSF and belongs at NIH.

Eligibility decides the rest. SBIR and STTR awards go to small businesses, which leaves an FQHC or a nonprofit off the applicant line entirely, whatever the science looks like. The route in runs through a HRSA technology grant, or through a small business partner that holds the award while the health center is the site.

How much of an SBIR or STTR budget can go to a software development partner

A third on SBIR Phase I. Half on SBIR Phase II. On STTR, roughly 30%, because the partnering research institution has a floor of its own. Those are the ceilings on what can leave your company and reach an SBIR software development partner.

The mechanism on Phase I is a performance floor. The small business has to perform at least two-thirds of the work itself, so no more than a third of the total award can go to all outside parties combined, and consultants count inside that third alongside contractual arrangements.

The cap, and what it is measured against

The workshare requirements differ by program and phase, and the STTR row carries a second floor.

The denominator is what trips people. The percentage is computed on the total amount requested, including direct costs, indirect costs and fee, and the basis is the total requested costs attributable to each party. So the whole award is the denominator, and teams who apply the percentage to the software line arrive somewhere else entirely.

A university collaborator counts as a subcontractor against the same ratio, which is the part that catches the academic founder, whose instincts come from the university side. The STTR percentages are statutory, so no one can waive them.

Where the extra room actually comes from

Consultants and subcontracts draw on the same allowance, which is why routing developers through a consulting agreement buys no headroom. Both sit inside the same third.

The room comes from payroll, meaning key people brought onto the company as part-time employees.

That route runs into the principal investigator employment rule. The contact principal investigator on a Phase I has to be more than half employed by the small business, at award and through the project.

One aside, because HHS makes SBIR awards as grants and as contracts. On the contract side, deviations are a pre-application conversation. Adam Sorkin, Small Business Policy Manager at the NIH SEED Office, told applicants at the September 2024 pre-proposal conference for the HHS SBIR contract solicitation that “Any deviations from these work requirements must be discussed prior to application.”

On a maxed Phase I, then, the outside development budget is roughly $106,600, and that figure exists before anyone has named a single feature. That’s why the cap belongs in the first scoping conversation.

What an SBIR Phase I software budget actually buys

An SBIR Phase I software budget comes to roughly $107,000 for an outside development shop, out of an award that reads as $323,090. For a physician innovator who has never priced a build, that gap is the whole problem, so here’s the working.

Where a $323,090 award actually goes

NIH’s default indirect rate for small businesses is 40% of total direct costs, and it applies only to SBIR and STTR applications. A requested rate at or below 40% needs no further justification at award. Fee normally doesn’t exceed 7% of total costs.

Work backwards from those two rates and a maxed $323,090 Phase I comes apart like this:

• direct costs: roughly $215,700
• indirect: roughly $86,300
• fee: roughly $21,100

Set the $106,600 outside-party ceiling against that $215,700 of direct costs. A maxed development subcontract consumes close to half of everything the award can actually spend. The indirect and the fee are real money, and neither line is available to spend on the software.

Some Institutes fund above the published guideline on SBA-approved waiver topics. Inside its approved waiver area, NIDA will consider up to $320,000 in total costs over a project period of up to one year at Phase I, or up to $2.5 million over up to three years at Phase II, on adequate justification.

Whatever the total, the rules on allowable costs hold: necessary, reasonable, allocable to the award, and adequately documented.

What Phase II money built

The honest measure for a Phase I subcontract is what a Phase II award pays for.

MEDITRACE took $1,655,949 under NICHD award 4R44HD107729-02, a Fast-Track Phase II running from August 2024 to July 2026. The money built CentraView 2.0, a neurocritical-care monitoring platform for the NICU, on top of the company’s earlier cleared Vital Sync monitor.

Square2 Systems used $1,519,197 under NIDA award 2R44DA047150-02 to expand Laddr, its mobile digital therapeutics platform for substance use disorder. Phrase Health went bigger: $2 million from NCATS, award R44TR005274, for a library of quality-improvement templates inside Outcomes, its EHR clinical-workflow analytics tool.

Each of those extends something that already worked. A Phase I development subcontract buys the feasibility study that comes before a build at that scale.

The trap gets set at application time. The aims describe a product while the budget funds a feasibility study, and the mismatch surfaces when someone finally quotes the work.

You can check this against your own target Institute. NIH RePORTER at reporter.nih.gov is the free public database of NIH-funded projects, searchable by institute and fiscal year. Filter by activity code to R43 and R44 and you’ll see what that Institute has funded in software, and at what size. Records go back to 1985 and refresh weekly.

Those ranges sit outside the grant question. We keep separate breakdowns of healthcare app development cost and app development costs if you need them.

Name your development partner in the application: quotes, letters of support, and budget justification

Your development partner goes in the application, named and quoted, before the award exists. Most teams treat NIH SBIR software development as something to shop for once the money arrives, and doing it that way turns work a review panel already approved into a change-of-scope request.

What the application has to carry

The application has to make the partner’s work legible to a reviewer.

Under Fast-Track, the Specific Aims section of the Phase I portion has to state clear, measurable milestones to be achieved before Phase II work begins, which is what turns a milestone-mapped development scope from a nicety into a requirement.

A grant-ready vendor quote carries:

• a scope tied to named specific aims
• deliverables mapped to go/no-go milestones
• a labor breakdown by category and hours
• a letter of support confirming the partner will do the work at that price

All four land in the budget justification, and the labor breakdown is what a contracting officer tests for reasonableness.

What it costs to add a partner later

Leaving the partner out costs you in two steps.

First, change in scope. Transferring performance of already peer reviewed programmatic work needs no prior approval by itself. Moving substantive programmatic work to a third party does, whether by consortium agreement, by contract, or by any other means: NIH treats it as a change in scope, and change in scope requires prior approval in all instances. The request goes in writing to the Grants Management Officer no later than 30 days before the change, signed by your Authorized Organization Representative.

Second, SBIR and STTR add their own layer. Adding a domestic subaward that wasn’t part of the peer reviewed and approved application triggers a foreign risk assessment on that entity, plus an updated SBIR STTR Foreign Disclosure Form through eRA Commons, and written approval from the Grants Management Official has to arrive before the subaward agreement is signed. Since January 27 2025 those requests run through the eRA Prior Approval Module, under NOT-OD-24-149.

A procurement gate runs in parallel, split at your simplified acquisition threshold:

• above micro-purchase and at or below your threshold: price or rate quotations from an adequate number of qualified sources, with you judging what counts as adequate
• above your threshold: formal procurement methods, competitive and publicly noticed

You set that threshold from internal controls, a risk evaluation and documented procedures, and it can sit below the Federal Acquisition Regulation value but never above it. Since October 1 2025 the FAR values are $15,000 and $350,000, up from $10,000 and $250,000. A Phase I contract near $107,000 sits in the quotations band; a Phase II contract past $1 million crosses into the noticed one.

Skip a required prior approval and you’re looking at disallowed costs or a terminated award, among other enforcement actions. A material misstatement in that foreign disclosure, if the agencies find it poses a national security risk, means repaying everything received under the award.

Why the review framework caps what a partner can do for you

Under the simplified review framework, which applies to applications submitted from January 25 2025, reviewers score importance of the research and rigor and feasibility on a 1 to 9 scale. Expertise and resources gets a sufficiency rating rather than a score, with a written explanation required when reviewers select that additional expertise or resources are needed.

Budget and period of support is a review consideration too, with no effect on the overall impact score.

So the exposure runs one way. A named partner with a scoped quote can’t lift your score, and a reviewer who doubts you can build the thing has to write that doubt down. Keeping that sentence out of your summary statement is what the partner buys you.

The federal timeline: registrations, review cycles, and when development actually starts

On November 17 2025 NIH declared every one of its small business funding announcements expired effective immediately, and nothing replaced them until May 28 2026. Grant-funded app development now runs on a calendar that didn’t exist in 2024, and a guide written then will hand you dates that have moved. Registrations gate everything, so they come first.

6 weeks before you can submit anything

NIH’s own guidance puts the registration process at 6 weeks or more. SAM.gov alone runs 3 weeks or more for an initial registration and 2 weeks for the annual renewal. The chain is ordered, and each step needs credentials from the one before it:

• SAM.gov, which issues the unique entity identifier
• the CAGE code
• SBIR.gov
• the SBA Company Registry, which produces the SBC Control ID that both the application’s SBIR/STTR information section and your eRA Commons registration require
• Grants.gov
• SciENcv, for biosketches
• eRA Commons accounts for the Signing Official and the principal investigator

The SBA Company Registration itself takes 1 to 2 business days.

Your SAM.gov registration has to be active at the time of application and again at the time of award. Renewal runs annually, so a submission in one federal fiscal year with a project start in the next crosses a renewal boundary.

The chain from expiry to project start

Statutory authority for both programs expired on October 1 2025. On November 17 2025 NIH declared its announcements expired and stopped issuing noncompeting continuation awards for projects already underway, until reauthorization. Public Law 119-83 was signed on April 13 2026 and reauthorized both programs through September 30 2031.

NIH, CDC and FDA posted the replacement parent announcement, PA-27-100, on May 28 2026. It consolidates two earlier announcements into a single NOFO covering Phase I, Phase II, Direct to Phase II and Fast-Track, and its clinical trial designation is optional. Submission opened on August 5 2026. The printed standard due date is September 5 2026, a Saturday, and the Monday after it is Labor Day, so the operative submission day is Tuesday September 8 2026. Standard dates then run January 5 2027 and April 5 2027, and the earliest project start for the September cycle is April 2027.

Just-in-time (JIT) sits between peer review and the Notice of Award, where NIH asks for what it deferred at submission: current other support, certification of IRB approval, the human subjects education requirement, and an SBIR or STTR funding agreement certification, all filed through the Status module in eRA Commons. Pending or out-of-date IRB approvals aren’t accepted, and IRB review itself can run 60 days or longer.

The calendar runs past the build, and so does grant reporting: the final financial report, the final performance report and the final invention statement are all due within 120 days of the project period end date.

NSF ran its own freeze, pausing Project Pitch submissions in December 2025 and reopening the portal on June 2 2026.

Counted from the September deadline, a team with its technical plan and its quote ready before submission is writing code the following spring. A team that starts looking for a development partner at award is starting that search a year after the aims were written.

Contracting under the award: subcontract type, fixed price, and where the work happens

Your subcontract has to settle how the relationship is classified, where each person physically works, and what happens if the build runs past its budget period. On SBIR app development those three terms decide how much room you have when something slips.

Contractor or subrecipient, and why fixed price depends on the answer

You decide, case by case, whether the firm you’re paying is a subrecipient or a contractor.

• A subaward carries out a portion of the federal award and puts the recipient in a financial assistance relationship, responsible for programmatic decisions and for the program’s own requirements.
• A contractor supplies goods or services in its normal business operations, to many purchasers, in a competitive environment, ancillary to the program.

A development firm sits on the contractor side, though the rule says no single factor decides it.

That classification settles the fixed-price vs cost-reimbursement question. Fixed price is an agreed amount for a defined scope; cost reimbursement pays whatever the work costs. Fixed-amount subawards sit on NIH’s prior-approval list, and a fixed-price procurement contract with a vendor doesn’t, so a fixed-price development contract is yours to use without asking NIH.

It’s also the structure that protects a budget period against overrun, which is the whole reason to care about the classification.

Every hour of the work has to happen in the United States

The domestic performance requirement arrives in three layers. Statute first: the research and development activity has to be performed in its entirety in the United States.

NIH goes further and no longer recognizes foreign subawards at all. It will consider only foreign consultants, foreign vendors or non-monetary collaboration, on compelling scientific justification that the work can’t be done domestically, approved case by case by Institute program officials and recorded on the Notice of Award.

SBA closes the loop. The sub-awardee’s own location doesn’t matter, but every hour of research and development work it performs has to happen in the United States.

Which brings us back to Vianair. In March 2025 Vianair, a Naples, Florida company that builds airport management software, settled False Claims Act allegations over an NSF SBIR grant.

The government alleged that the company performed grant work outside the United States, which the grant’s terms expressly prohibited and its own proposal contradicted, and separately that it kept no timesheets on its NSF grant effort while certifying compliance with both conditions.

NSF suspended payments when it learned of the conduct. Vianair paid $225,000 and gave up the $299,947 that hadn’t been paid out, $524,947 in total. Erik S. Siebert, the U.S. Attorney for the Eastern District of Virginia, framed the US-performance requirement as protecting national security and the recordkeeping requirement as protecting taxpayer resources. The case sits on the SBA’s own fraud, waste and abuse page.

What happens when the build runs late

A standard non-Fast-Track Phase I award, activity code R43 or R41, is excluded from NIH’s automatic carryover authority, so unspent Phase I money doesn’t move into a later period without prior approval. A no-cost extension runs one time for up to 12 months, needs no additional funds and no change in approved scope, and has to be taken before the project period ends. Funds remaining at expiration is explicitly not sufficient justification on its own. So the extension buys time and nothing else.

With any vendor, require the subcontract to name where each person performs the work, and keep timesheets against the grant from week one.

IP, data rights, and IRB timing: what unmarked deliverables cost you

You own the code. SBIR data rights protect it for at least 20 years from the date of award, and they protect only the deliverables you marked. That puts the marking requirement in the development contract, where it can be enforced.

20 years of protection, conditional on a legend

The protection period begins at award of the funding agreement and ends not less than 20 years from that date, a single period that can’t be extended. Computer software is a protected category in its own right rather than a subset of technical data. During it the government holds SBIR and STTR data rights only; after it expires, government purpose rights, short of unlimited.

In unmarked SBIR and STTR data, the government holds unlimited rights. The legend is prescribed wording published in the SBA’s Policy Directive, and it has to be reproduced exactly, on the front page of the deliverable. Pull the text from the directive itself.

Night Vision Corp v United States shows what that costs. The company delivered prototypes to the Air Force without the required legend and lost its SBIR data rights in them. The government then handed the design to Insight Technology, a competitor that had previously been Night Vision’s own subcontractor, for reverse engineering.

The Court of Federal Claims decided against it in 2005; the Federal Circuit affirmed in 2006. Those were hardware prototypes, and the holding is the part that transfers to code: rights lost for failure to mark.

What goes in the contract, and what the calendar does to it

Two clauses belong in the development contract:

• The legend as a condition of delivery. No deliverable gets accepted without it.
• An intellectual property position that keeps the two regimes apart. Data rights govern the delivered code; the patent rights clause governs patentable inventions.

That second one takes drafting, because the patent side has its own flow-down. The Bayh-Dole patent rights clause flows into all subcontracts at any tier for experimental, developmental or research work, so your partner keeps the same rights the clause gives you. You may not take rights in its subject inventions as consideration for the subcontract, which is what a blanket assignment clause tries to do.

Subject inventions means patentable inventions made under the award. Copyright in the delivered code isn’t one, and it travels under data rights instead.

Then the calendar gets a say. If the funded work involves human subjects research, an IRB approval has to be current at award and again at any no-cost extension, because extending the final budget period obliges you to update all certifications and assurances.

The Quality Management System Regulation took effect on February 2 2026, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. It binds finished device manufacturers intending to commercially distribute, so a feasibility prototype sits outside it. What changed is the framework a later submission’s design history gets read against.

We cover health AI FDA clearance and HIPAA compliant software development separately.

Phase II and beyond: what survives from the feasibility prototype

Phase II is a different program with a looser cap and more than one way in. The announcements to know:

• PA-27-100, the parent SBIR announcement on the R43/R44 activity codes, taking Phase I, Phase II, Direct to Phase II and Fast-Track
• PA-27-101, the SBIR Phase IIB Strategic Breakthrough Award
• PAR-27-098, the Commercialization Readiness Program (CRP), on activity code SB1
• PA-27-102, the parent STTR announcement, on activity codes R41 and R42, which is where STTR app development files

Direct to Phase II is for companies that completed Phase I equivalent milestones on non-SBIR money, and it files as a new application. A company already holding a relevant Phase I award from any agency files a regular Phase II renewal instead.

Only one Phase II award gets made for a given Phase I-supported project, and a Phase II awardee can receive one additional sequential award, the Phase IIB. At NSF, the Strategic Breakthrough tier goes up to $30 million against a one-to-one match, after conferring with the cognizant Program Officer.

NIH Data Book figures put Phase I to Phase II conversion at roughly 25%, down from roughly 31% a decade ago.

Phase II lifts the outside-party ceiling to half the award, the largest slice of non-dilutive funding a build like this gets. The prototype that carries forward is the one built to be extended. A feasibility prototype and an MVP are different artifacts, and code written to survive a demo gets rebuilt on Phase II money, which is a cost your Phase I scope decides. Phase II also asks for a commercialization plan, and the build has to support what that plan claims.

Two build shapes we’ve documented in detail: eCOA/ePRO app development and companion app development.

The grant-funded build checklist

The work that decides whether your software is buildable happens before submission. Run this list while the budget is still a draft, because digital health grant funding locks most of it at submit.

Before you write the budget

• Confirm your entity type can hold the award
• Pick the funder by what the money buys, mission fit second
• Check whether the build includes a pilot study, which rules out NSF
• Start the registration chain, 6 weeks or more

While you write the application

• Fix the outside-party ceiling before scoping features
• Get a development scope tied to named specific aims
• Map deliverables to go and no-go milestones
• Ask for a labor breakdown by category and hours
• Get a letter of support from the partner
• Name the partner in the application

In the subcontract, once the award lands

• Classify the relationship, contractor or subrecipient
• Set fixed price where the classification allows
• Name each person’s place of performance
• Require the data rights legend as a condition of delivery
• Separate the code from patentable inventions in the IP terms
• Keep timesheets against the grant from week one

Our healthcare app development guide covers the build sequence itself.

The item teams skip is naming the development partner in the application. That’s what puts its scope through peer review, and it’s the only thing here you can’t do after the fact.

Why Topflight Apps for grant-funded digital health development

A reviewer reading your application is answering one question about the software: can this team build what the aims describe. That judgment gets recorded as sufficient or not, and what answers it is a development partner who is named, scoped, quoted and committed to milestones before you submit.

That’s the work we do at the application stage. We scope the technical plan against your specific aims, produce a quote tied to those aims and mapped to go and no-go milestones, and give you a letter of support to file with the application. Then we build under the award.

Topflight Apps staffs grant-funded engagements with US-based personnel and names each person’s place of performance in the subcontract. A scope that went through peer review is work we can start the week the money arrives; a partner added afterwards is a prior-approval request first.

We don’t write the application and we’re not grant consultants. The technical plan and the build are our parts, and the science stays yours. The useful time for this conversation is while the budget is still a draft, because once the notice of award lands the scope has already been reviewed and the ceiling is already fixed. If you’re scoping grant-funded digital health work for a September submission, that draft window is open now.