Clinical Medication Adherence Platform Development: Pharma Programs, Connected Packaging, And Cms Reimbursement (Not A Reminder App)

US health spending wastes about $528 billion a year on nonoptimized medication therapy, with nonadherence as the primary driver. For a Medicare Part D plan, that same problem shows up as a Star Rating, and a plan’s adherence measures decide whether it clears the threshold for the federal quality bonus that funds next year’s benefits. That’s the buyer a clinical medication adherence platform is built for.

If you’re building a consumer reminder app (dose scheduling, wearable sync, interaction alerts), we have a separate guide for that. This piece is for the teams building adherence infrastructure for pharma sponsors, specialty pharmacies, chronic-disease programs, and value-based care. The buyer, the technology, the regulatory profile, and the reimbursement model are all different.

Here’s the build: technical architecture, the connected-packaging stack, pharmacy and EHR integration, the CMS reimbursement pathways that pay for it, and the FDA classification map for the intelligence layer that decides whether you’re shipping software or a medical device.

What does building a clinical adherence platform actually require?

A clinical adherence platform is enterprise infrastructure for pharma sponsors, specialty pharmacies, PBMs, and value-based payers. It requires verified adherence data (claims-based PDC/MPR, connected packaging, or ingestion), NCPDP SCRIPT pharmacy integration with FHIR EHR write-back, a CMS reimbursement pathway (MTM, RPM/RTM, or Star Ratings), and an FDA classification call on any adherence scoring layer.

Key Takeaways:

1. The $528 billion problem is clinical infrastructure. That’s the cost of nonoptimized medication therapy, with nonadherence a primary driver, and closing it takes verified data, integration, and reimbursement that pays for the program.
2. The institutional buyers are paying for proof their program works. Pharma sponsors, specialty pharmacies, PBMs, and payers want verified adherence data, system integration, reimbursement workflows, and outcomes evidence for the spend.
3. Every technical decision follows from who the platform is for and what its data must prove. NCPDP SCRIPT integration, PDC methodology, and 21 CFR Part 11 are all downstream of the buyer and the claim the data supports.

Table of Contents

1. Reminder app vs. clinical adherence platform: the distinction that defines the build
2. The four adherence verification methods: why self-report is not enough
3. Pharma patient support program technology: what the platform must do
4. Pharmacy system integration: the technical foundation
5. CMS reimbursement for medication adherence: the B2B revenue model
6. Technology layer matrix: architecture for a clinical adherence platform
7. FDA classification for clinical adherence platforms
8. HIPAA is table stakes. Part 11 is the hard part.’
9. Why choose Topflight Apps for clinical adherence platform development

Reminder app vs. clinical adherence platform: the distinction that defines the build

A consumer reminder app helps one patient remember a dose. A clinical adherence platform measures adherence across a population and documents it with an audit-defensible methodology, so a sponsor or payer can prove the program works.

The split starts with who’s buying. A reminder app is a consumer download on an app-store subscription. A medication adherence app for pharma sponsors, specialty pharmacies, PBMs, ACOs, or health systems is an enterprise product sold under contract, and that one fact drives the technology, the regulatory load, and the revenue model. On the clinical side, HIPAA compliant app development is the floor; you’re also carrying 21 CFR Part 11 and a possible SaMD determination on top of it.

Get the column wrong and you build the wrong product: a consumer app no sponsor will fund, or an enterprise stack aimed at a patient who just wanted a reminder. The rows below are the decisions that diverge.

Everything past this section is about the right-hand column. If you’re building the left-hand one, our medication reminder app development guide is the better starting point.

The four adherence verification methods: why self-report is not enough

Tapping “taken” in an app reports what the patient meant to do. It says nothing about whether the pill actually went down. Clinical programs can’t run on intent, so they reach for one of four methods. The first three climb in rigor, from billing records to a confirmed swallow; the fourth looks forward, scoring risk before a gap opens.

Method 1: pharmacy dispensing records (claims-based)

Claims-based measurement is the workhorse: the easiest to run across a whole population, and the one every payer already understands. It computes adherence from pharmacy dispensing claims, no hardware required.

Two metrics do the work:

• PDC (proportion of days covered): the share of days in a period the patient had the drug on hand. This is the measure CMS uses.
• MPR (medication possession ratio): the ratio of days supply dispensed to days in the period. It can run past 100% with early refills, which is why CMS prefers PDC.

The bar is PDC at or above 80%, the adherence cut the Pharmacy Quality Alliance set and CMS adopted. The data comes from PBM and pharmacy claims over the NCPDP SCRIPT network, pulled through medication-history transactions.

The limitation is real: claims show the pharmacy handed over the drug, and whether the patient took it is invisible to the data. A 90-day fill sitting in a kitchen drawer still scores as covered.

Even so, this is the method CMS Star Ratings are built on, which is why it carries the most weight for a payer-facing build (more on the money in Section 5).

Method 2: connected packaging (event-verified)

Connected packaging medication adherence is more rigorous than claims because it captures a physical event. A device timestamps each dispense event and transmits it, which puts the build closer to IoT app development than to a standard health app.

• Cellular smart caps. Smart pill bottle development usually centers on a cellular smart cap like AdhereTech’s Aidia System, used in specialty-pharmacy programs; the cap prompts the patient and reports each open. One correction worth banking: AdhereTech is a software and data company, and its bottle is a low-risk FDA Class I device, so don’t assume a Class II accessory classification carries over.
• Electronic blister packs. The electronic blister pack is the clinical-trial gold standard. AARDEX, maker of the MEMS Cap, and Information Mediary Corporation build medication event monitoring systems (MEMS) with timestamped, tamper-evident records of every cell opened.
• NFC and RFID packaging. Cheaper and lighter to build: the patient taps the pack to log a dose. NFC medication packaging and RFID medication tracking are less reliable, because they depend on the patient remembering to scan.

This is the practical core of IoT medication adherence. The limit: an opened container is one step short of a confirmed dose. Devices also need a companion app development layer and hardware logistics, so save it for programs that need event-level proof.

Method 3: ingestible sensors (ingestion-confirmed)

Ingestible sensors are the most rigorous option, the only method that confirms the drug was actually swallowed. The economics never worked. Otsuka’s Abilify MyCite, the first FDA-approved digital medicine (2017), was discontinued in 2024, and Proteus Digital Health went bankrupt before it.

EtectRx’s ID-Cap keeps the ingestible sensor alive, barely. At roughly $1,650 a month against a sub-$20 generic, ingestion confirmation survives mainly inside REMS programs and clinical-trial endpoints, so build for it only there.

Method 4: behavioral and biometric proxy signals

The fourth method estimates risk instead of confirming a dose. Machine learning over dispensing history, app engagement, and wearable signals flags a patient drifting toward a gap before the refill is missed, which helps a care team triage a large panel.

Here’s the flag, though: an adherence risk score that triggers a clinical action is the highest-FDA-risk feature in the platform. Classification hinges on what the score sets in motion downstream; the same data feeding a passive dashboard wouldn’t trip it. Section 7 draws that line.

Pharma patient support program technology: what the platform must do

Pharma patient support program technology answers to three masters at once. The patient wants engagement. The sponsor cares about outcomes and program metrics. Prescribers and pharmacists want adherence data where they already work. Serve all three or the program stalls, and with US sponsors pouring tens of billions a year into these programs, the bar for proof sits high.

What pharma sponsors specifically need

A patient support program (PSP) bundles copay assistance and patient access program support around a therapy. Strip that back, and here’s what the sponsor is actually buying when it pays for the technology:

Verified adherence with a documented methodology

Self-report won’t survive scrutiny. The sponsor needs a defensible calculation it can put in front of medical affairs and, later, a regulator.

Population-level PDC and MPR

Aggregated and de-identified, reported at the cohort level. Sponsors think in populations.

Gap-in-therapy identification and outreach

Catch the patient drifting toward discontinuation and reach out before the gap, while there’s still therapy to save.

Persistence over 6- and 12-month windows

Medication persistence, how long a patient stays on therapy, is where specialty biologics, oncology adherence, and transplant medication adherence live or die; it’s the same retention problem a chronic disease management app is built to solve, at higher stakes.

A real-world evidence (RWE) package

Aggregated, de-identified outcomes feeding health-economics dossiers and formulary submissions, the evidence base for market access and value-based contracts.

Hub-services integration

A feed into the specialty pharmacy hub’s case-management system, carrying enrollment and coverage status plus the dispensing events that are your primary specialty adherence source. Operators like CareMetx and ConnectiveRx run these hub services; budget custom work against each hub.

The methodology bar is the one teams trip over. “We track adherence” means nothing to medical affairs. “PDC computed to the CMS spec and audit-ready” means something.

Some REMS programs make adherence a condition of dispensing

REMS (Risk Evaluation and Mitigation Strategies) are FDA-mandated safety programs for high-risk drugs, and some require adherence or compliance monitoring as a condition of dispensing. Here the platform documents REMS-program compliance, a broader bar than medication adherence: that the right safety conditions were met before each dispense, and that the record proves it.

iPLEDGE is the one most people know (isotretinoin); THALOMID and Revlimid run the same playbook for thalidomide and lenalidomide. The platform’s job is to make “the program ran correctly” provable on demand, because an FDA inspector won’t take your word for it.

When those records feed FDA reporting, 21 CFR Part 11 applies: audit trail and e-signatures, for starters. Section 8 covers it. The standards are catching up, too: NCPDP SCRIPT 2023011 added REMS observation elements, so the dispensing message itself can carry the compliance data.

Pharmacy system integration: the technical foundation

Real adherence data lives inside pharmacy dispensing systems and pharmacy benefit manager (PBM) records. A platform that can’t reach them is back to self-report, however polished the app. Pharmacy system integration is the foundation the rest of it sits on, and it’s where most of the real engineering time goes.

NCPDP SCRIPT: the pharmacy data standard

NCPDP SCRIPT is the US standard for e-prescribing and pharmacy-data messaging. Version 2017071 is in production today, mandated since 2020, but CMS has named 2023011 as the successor, mandatory January 1, 2028. Build toward 2023011 now; the older version is already on the clock.

Two transactions carry the adherence load:

• Medication history: a patient’s cross-pharmacy fill history, the prescription data behind claims-based PDC and MPR.
• Fill notification: a real-time dispense signal, the trigger for gap-in-therapy alerts and outreach.

All of this rides the Surescripts network, which reaches the large majority of US retail pharmacies and handles eRx integration and refill synchronization, with real-time benefit check traffic on the same rails. Getting on it takes an agreement and a serious certification process, so plan 4 to 6 months.

The certification is the part teams underestimate: it looks like engineering and turns out to be testing and paperwork, and it gates your go-live.

Specialty pharmacy hub integration

Specialty drugs dispense through specialty pharmacies like CVS Specialty or Accredo. The integration looks different from retail. This is also where the adherence dollars concentrate, so the hub work earns its keep.

The case-management feed carries enrollment and coverage status. Dispensing events are your primary adherence source for specialty therapy, every fill as it happens. Prior authorizations are the quiet risk: specialty PAs expire, so flag a lapse before it stops therapy, and CMS-0057-F is now pushing prior authorization toward FHIR-based exchange.

Every hub is built differently, so budget 4 to 8 weeks of custom API work per hub. Across a multi-hub program, that adds up fast.

EHR integration for adherence data write-back

Prescribers want adherence data in the workflow they already use, which makes medication adherence EHR integration a growing procurement requirement; enterprise buyers increasingly won’t sign without it. The mechanism is HL7 FHIR R4 write-back, and a few resources do the heavy lifting:

• MedicationStatement. PDC and current gap status.
• MedicationAdministration. The inpatient medication administration record (MAR).
• Observation. PDC tracked over time.

CDS Hooks is the highest-value pattern: a real-time adherence alert at the point of prescribing. Whether that alert counts as FDA-exempt is a real question, and Section 7 settles it. Wiring into a specific system? Our guide on how to integrate with epic EHR covers the mechanics, and how will AI help change EHR looks at where it’s going.

CMS reimbursement for medication adherence: the B2B revenue model

What turns an adherence platform into a business is simple: CMS will pay for this. Three pathways, each a different buyer conversation. Get fluent in all three and you can position the platform against whichever one your buyer already cares about.

Medication therapy management (MTM): CPT 99605, 99606, 99607

Medication therapy management (MTM) is a Medicare Part D benefit. Pharmacists run comprehensive medication reviews (CMR) and targeted medication reviews (TMR), and they bill for them:

• CPT 99605: the initial MTM encounter.
• CPT 99606: a subsequent encounter.
• CPT 99607: each additional 15 minutes.

The dollar amounts are modest and track the annual fee schedule, so treat any figure as approximate. An MTM medication therapy management app earns its keep by generating the documentation behind the bill: a structured med list, adherence data, intervention notes, and an action plan. That documentation living in the record is the premise of EHR in medical billing: if it isn’t captured, it isn’t billable.

Eligibility widened sharply in 2025. The CMS-4205-F rule cut the Medicare Part D MTM threshold to roughly $1,276 in total covered drug cost, about eight generic drugs. It also set 10 core chronic conditions, now including HIV/AIDS, and kept the 2-to-8 Part D drug range. That moved the eligible population from about 9% of Part D members to about 23%, more than doubling the billable-encounter base.

CMS now encourages FHIR-enabled MTM platforms and points to the NCPDP/HL7 MTM Template CDA, so build the documentation layer on those standards from the start.

Remote monitoring for adherence: RPM and RTM

Remote monitoring is the second pathway, and it splits in two. RPM reimbursement (remote physiologic monitoring) bills CPT 99454 for device supply and transmission across 16-plus days, and CPT 99457 for staff review time. It can apply when a qualifying connected device sends adherence data to the provider.

RTM (remote therapeutic monitoring, CPT 98975 through 98981) was built for non-physiologic data including medication adherence, which makes it the better conceptual fit for connected-packaging adherence. For a connected-packaging program, RTM is usually where the conversation starts.

One caution worth a lawyer’s time: whether a smart pill bottle counts as a “qualifying device” is unsettled, and amounts here track the fee schedule too. Engage a healthcare attorney before you build a billing model on it.

Star Ratings and quality bonus payments

The medication adherence Star Ratings are where the real money is, and where the ROI argument actually lands. Three measures, PDC for diabetes, for hypertension (RAS antagonists), and for statins (they double as CMS HEDIS adherence measures), drive about a third of a Part D plan’s Star Rating.

Normally they’re triple-weighted, though CMS single-weighted them just for measure year 2026 during the SDS risk-adjustment transition, with triple weighting back in 2027.

This pitch survives a skeptical payer for a concrete reason. The clinical-outcomes argument, that better adherence improves health, is true but unprovable on their timeline. The Star Ratings math is auditable: count the members below 80% PDC, model the bonus gain from nudging them over, and you have a number the CFO can check.

The bar is 80% PDC, but the 2026 five-star cut points sit around 92 to 93%, almost no margin. Plans at 4 stars and up earn a 5% Part D quality bonus payment; for a large plan, a single Star can run around $150 million, illustrative, but enough to get the CFO in the room. A 1-to-2-point PDC move near the threshold can flip a tier.

The same math reframes for value-based care adherence. An ACO faces a different incentive: it’s measured on population adherence rates in its contract and penalized when they slip, so it needs documented adherence data for outcomes reporting and ACO quality metrics. Different buyer, same engine.

It all rests on one build requirement: a PDC methodology that matches the CMS spec exactly, including the measure-year-2026 change that stops excluding inpatient and SNF days. Slightly off, and the number won’t hold up.

Technology layer matrix: architecture for a clinical adherence platform

The whole platform in one view: ten layers, each with its FDA-risk flag, HIPAA status, a build-or-buy call, and the consideration that matters most. Read the flags closely; Section 7 explains the reasoning behind them.

FDA-risk key: Low means non-device, the display, documentation, and admin layers. Medium means CDS-adjacent, where classification depends on framing. High means decision support that’s likely not exempt, with an FDA assessment required first.

FDA classification for clinical adherence platforms

Does a medication adherence platform need FDA clearance? The answer turns on what the intelligence layer does with the data. The software’s behavior decides classification, regardless of whether there’s hardware in the box.

The framework is FDA’s Clinical Decision Support Software guidance, refreshed in January 2026 to supersede the 2022 version, plus the four 21st Century Cures Act criteria for non-device clinical decision support. Software stays non-device only if it meets all four:

1. It doesn’t acquire or process a medical image, an IVD signal, or a signal-acquisition pattern.
2. It displays or analyzes medical information.
3. It gives a recommendation to a clinician, supporting rather than replacing them.
4. The clinician can independently review the basis for that recommendation.

Criterion 4 is the linchpin: if a clinician can’t see and judge the basis, the software is doing the deciding. That’s a separate test from the general wellness exemption covering a consumer reminder app, and it sits at the center of AI in healthcare compliance for anything that touches clinical decisions.

Non-device (no clearance required)

Non-device functions need no clearance. The clear cases:

• Dispensing-data display, fill history and PDC in a dashboard.
• Administrative gap-in-therapy routing.
• MTM documentation generation.
• De-identified aggregate analytics.

A drug-interaction checker built on a rules-based, reviewable rule set also stays non-device. The common thread: the software shows or organizes information, and a human decides. These are the layers most of the platform lives in, which is why a well-scoped adherence platform is mostly non-device.

The CDS exemption gray zone

The gray zone is where it gets unsettled, and where you want a regulatory opinion. Two patterns sit right on the line.

Real-time prescriber alerts through CDS Hooks may be exempt, but only if the alert goes to a licensed clinician who can independently review the basis. Strip away either condition and it drifts toward device territory.

Adherence-based therapy-adjustment suggestions are riskier. An alert that reads “PDC below 70%, consider switching to once-daily” is a treatment recommendation, and those are likely not exempt. The boundary between showing the data and prescribing the next step is exactly where exemption ends.

SaMD (FDA clearance required)

SaMD, software as a medical device, needs FDA clearance. Three adherence features land here:

• Predictive adherence risk scoring that triggers an automated clinical protocol.
• AI that predicts an outcome and recommends a change in therapy.
• Ingestion confirmation used as a clinical endpoint in a regulatory submission.

Per the January 2026 guidance, predictive analytics whose basis a clinician can’t independently review, and software that recommends a specific treatment plan, are device functions, FDA SaMD that needs clearance. If your roadmap includes any of these, treat FDA strategy as an early workstream, planned from the start; our health AI FDA clearance guide walks the path.

HIPAA is table stakes. Part 11 is the hard part.

For this audience, HIPAA is the familiar part: you’ve signed the BAAs, you’ve done the risk assessment. Part 11 is the one that catches adherence platforms off guard, because they generate records that end up in regulatory use, where a different rulebook applies.

HIPAA (briefly)

Every adherence platform handles PHI: med lists, dispensing history, diagnosis codes, contact info. You know the rule. The real work hides in the business associate agreement chain, because every pharmacy data provider, EHR partner, cloud host, and analytics vendor that touches identifiable adherence data needs a BAA, and you’re liable for the weakest link.

HIPAA compliant software development is well-trodden ground; the BAA chain is where the diligence actually goes.

21 CFR Part 11: electronic records for regulatory use

21 CFR Part 11 is FDA’s rule for electronic records and signatures. It applies the moment your platform generates a record that goes to FDA or into a regulatory proceeding, a REMS compliance report or a clinical-trial endpoint, say. The trigger is narrow but real, and adherence platforms hit it more often than teams expect, because sponsors love to repurpose adherence data for filings. Three requirements define compliance:

• Audit trail. Every change to a record logged with who did it and when, immutable and tamper-evident.
• Electronic signature. A compliant e-signature with identity verification wherever a signature is required, ingestible-sensor consent or a REMS patient agreement.
• Record integrity. Records protected from after-the-fact alteration, so you can prove a submitted record matches the one generated at the event.

The expensive surprise comes later: a sponsor using your adherence data in an FDA submission will ask for Part 11 documentation, and retrofitting it then is a major remediation effort. If regulatory use is anywhere in scope, design for it up front. SOC 2 Type II is a separate, parallel ask, the one enterprise buyers gate procurement on, and our SOC 2 healthcare startups guide covers it. CCPA, GDPR, and FTC health breach notification can apply too, depending on your data and footprint.

The clinical adherence platform build checklist

Before you deploy in a pharma, specialty-pharmacy, or health-system program, confirm:

• The adherence verification method is chosen and its data feed scoped, claims, connected packaging, or ingestion.
• The PDC engine is validated against the current CMS Star Ratings spec, including the MY2026 inpatient/SNF change.
• NCPDP SCRIPT connectivity or a PBM/pharmacy feed is secured, and per-hub integration is scoped for each program hub.
• FHIR write-back resources are mapped for the target EHRs, and any CDS Hooks alerting is FDA-classified if it reaches the point of prescribing.
• The BAA chain is documented across pharmacy data, EHR, hosting, and analytics.
• A 21 CFR Part 11 assessment is done if records feed regulatory submissions like REMS or trials.
• An FDA classification assessment is done for any adherence scoring or alerting feature.
• Sponsor analytics are de-identified with the methodology documented, and a SOC 2 Type II roadmap is in place for enterprise sales.

Every box here gates go-live. An unchecked one blocks the launch.

Why choose Topflight Apps for clinical adherence platform development

Topflight Apps builds HIPAA-compliant clinical health platforms for enterprise buyers. We’ve built pharma patient-support technology and the pharmacy integrations behind chronic-disease adherence programs, the kind of work where an EHR sandbox timeout can turn a short integration into a long one, and the regulatory line between software and device decides the roadmap. The hard part of these builds lives in the pharmacy and EHR plumbing, the reimbursement logic, and that classification call. That’s the work we do.

What we bring to a clinical adherence platform:

• Pharmacy integration: NCPDP SCRIPT via Surescripts, specialty hub APIs, and PBM feeds.
• EHR integration: FHIR R4 write-back and CDS Hooks, on Epic and Cerner via SMART on FHIR.
• HIPAA plus 21 CFR Part 11 architecture, built for records that may face a regulator.
• FDA classification guidance, the device-versus-non-device call before you build the scoring layer.
• A CMS-compliant PDC and MPR engine that matches the Star Ratings spec.
• De-identified sponsor analytics for market access and value-based contracts.

If you’re scoping medication adherence platform development for a pharma sponsor or a specialty pharmacy, let’s talk through the data sources and enterprise-buyer requirements that decide the build.