DEV Community

Alex Kane
Alex Kane

Posted on

n8n for MedTech & Digital Health SaaS Vendors: 5 Automations for FDA 510(k), HIPAA, FTC Health Breach, and EU MDR Compliance

#n8n #medtech #automation #security

MedTech and digital health SaaS vendors face a uniquely dense regulatory stack. If your software touches medical device operations, patient data, or consumer health metrics, you're simultaneously subject to multiple frameworks — each with distinct notification clocks and reporting chains.

The fastest clock in this space: the FDA 5-day expedited MDR (21 CFR §803.53) — applies when a device malfunction would likely cause or contribute to death or serious injury if it recurred. Miss it and you risk a Warning Letter that cascades into 510(k) clearance delays for your next product line.

Here are five self-hosted n8n workflows covering the full MedTech compliance stack.

Customer Tiers

Tier Constant Segment
ENTERPRISE_MEDICAL_DEVICE_MANUFACTURER Large Class II/III MDMs (device + software combined)
MID_MARKET_MEDICAL_DEVICE_SAAS Mid-size SaMD companies (Class I/II software-only)
DIGITAL_HEALTH_PLATFORM Consumer health apps (wearables, mental health, fitness)
CLINICAL_DECISION_SUPPORT_SAAS CDS software vendors (AUC tools, CPOE order-entry)
TELEHEALTH_SAAS_VENDOR Telemedicine platform operators
REMOTE_PATIENT_MONITORING_VENDOR RPM device + software vendors
HEALTH_DATA_ANALYTICS_SAAS Population health analytics, de-identified data platforms

Compliance flags injected at onboarding:

  • FDA_510K_CLEARED — 510(k)-cleared SaMD under 21 CFR §807.92
  • FDA_PMA_REQUIRED — Class III device requiring Premarket Approval
  • HIPAA_BAA_REQUIRED — Handles PHI as a Business Associate (45 CFR §164.308)
  • FTC_HEALTH_BREACH_NOTIFIABLE — Non-HIPAA consumer health app (16 CFR Part 318)
  • MDR_EU_APPLICABLE — EU sales subject to EU MDR 2017/745
  • FDA_SAMD_GUIDANCE — Software as a Medical Device (IMDRF N23/N46/N56)
  • CURES_ACT_COMPLIANCE — 21st Century Cures Act Information Blocking (45 CFR §171)

Workflow 1: MedTech SaaS Customer Onboarding Drip

Runs Monday at 8 AM. Pulls customers in pending, day3, and day7 onboarding stages. The Code node builds tier-specific emails: DIGITAL_HEALTH_PLATFORM customers get FTC Health Breach Rule notices on Day 0; HIPAA_BAA_REQUIRED customers get a BAA signature link; FDA_510K_CLEARED customers receive MDR clock activation instructions. CURES_ACT_COMPLIANCE customers get a §171.103 OIG $1M/violation perimeter note on Day 3.

{
  "name": "MedTech SaaS Customer Onboarding Drip",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "triggerAtHour": 8,
              "triggerAtMinute": 0,
              "weekdays": [
                "monday"
              ]
            }
          ]
        }
      },
      "id": "t1",
      "name": "Schedule Trigger",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        250,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT id, company_name, customer_tier, primary_email, compliance_flags, onboarding_step FROM medtech_customers WHERE onboarding_step IN ('pending','day3','day7') AND created_at <= NOW() - (CASE onboarding_step WHEN 'pending' THEN INTERVAL '0 days' WHEN 'day3' THEN INTERVAL '3 days' WHEN 'day7' THEN INTERVAL '7 days' END)"
      },
      "id": "db1",
      "name": "Get Onboarding Customers",
      "type": "n8n-nodes-base.postgres",
      "position": [
        450,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const tier = $json.customer_tier;\nconst flags = ($json.compliance_flags || '').split(',');\nconst step = $json.onboarding_step;\nlet subject, body;\nif (step === 'pending') {\n  subject = `Welcome to FlowKit \u2014 Your MedTech Automation Starter Kit`;\n  body = `Hi ${$json.company_name} team,\\n\\nWelcome! Your compliance automation templates are active.\\n\\n`;\n  if (flags.includes('HIPAA_BAA_REQUIRED')) body += `ACTION REQUIRED: Sign your BAA before activating PHI workflows: [Sign BAA]\\n\\n`;\n  if (flags.includes('FDA_510K_CLEARED')) body += `Your FDA-cleared device workflows include MDR malfunction tracking (21 CFR \\u00a7803.50, 30-day clock).\\n\\n`;\n  if (flags.includes('FTC_HEALTH_BREACH_NOTIFIABLE')) body += `FTC Health Breach Notification Rule (16 CFR Part 318) timeline automation is pre-configured.\\n\\n`;\n  if (flags.includes('MDR_EU_APPLICABLE')) body += `EU MDR 2017/745 Art.87 serious incident 15-day clock is active.\\n\\n`;\n  body += `Start here: [QuickStart Guide] | [Schedule Onboarding Call]\\n\\nAlex Kane, FlowKit`;\n} else if (step === 'day3') {\n  subject = `Day 3: Connect Your EHR/EMR Integration (${$json.company_name})`;\n  body = `Hi team,\\n\\nDay 3 \u2014 ready to connect your EHR or device data pipeline?\\n\\n`;\n  if (flags.includes('FDA_510K_CLEARED') || flags.includes('FDA_PMA_REQUIRED')) body += `SaMD workflows log to Postgres for FDA 21 CFR \\u00a711 audit trail (tamper-evident, \\u00a711.10(e)).\\n\\n`;\n  if (flags.includes('MDR_EU_APPLICABLE')) body += `EU MDR Art.10(9) PMCF workflow is pre-configured for post-market surveillance.\\n\\n`;\n  if (flags.includes('CURES_ACT_COMPLIANCE')) body += `21st Century Cures Act information blocking workflows active \u2014 \\u00a7171.103 OIG $1M/violation perimeter.\\n\\n`;\n  body += `Questions? Reply here or [Book 30 min] \u2014 Alex`;\n} else {\n  subject = `Day 7: Your Regulatory Deadline Tracker Is Active`;\n  body = `Hi team,\\n\\nWeek 1 complete. Active regulatory clocks:\\n\\u2022 FDA MDR malfunction: 30-day (21 CFR \\u00a7803.50)\\n\\u2022 FDA MDR death expedited: 5-day (\\u00a7803.53)\\n\\u2022 HIPAA breach: 60-day (45 CFR \\u00a7164.404)\\n\\u2022 EU MDR serious incident: 15-day (Art.87)\\n\\u2022 FTC Health Breach: 60-day (16 CFR \\u00a7318.5)\\n\\nCompliance dashboard: [Open Dashboard]\\n\\nAlex Kane, FlowKit`;\n}\nreturn [{ json: { ...$json, email_subject: subject, email_body: body } }];"
      },
      "id": "c1",
      "name": "Build Tier Email",
      "type": "n8n-nodes-base.code",
      "position": [
        650,
        300
      ]
    },
    {
      "parameters": {
        "sendTo": "={{ $json.primary_email }}",
        "subject": "={{ $json.email_subject }}",
        "message": "={{ $json.email_body }}",
        "options": {}
      },
      "id": "e1",
      "name": "Send Email",
      "type": "n8n-nodes-base.gmail",
      "position": [
        850,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "UPDATE medtech_customers SET onboarding_step = CASE onboarding_step WHEN 'pending' THEN 'day3' WHEN 'day3' THEN 'day7' WHEN 'day7' THEN 'complete' END, updated_at = NOW() WHERE id = {{ $json.id }}"
      },
      "id": "db2",
      "name": "Advance Step",
      "type": "n8n-nodes-base.postgres",
      "position": [
        1050,
        300
      ]
    }
  ],
  "connections": {
    "Schedule Trigger": {
      "main": [
        [
          {
            "node": "Get Onboarding Customers",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Onboarding Customers": {
      "main": [
        [
          {
            "node": "Build Tier Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Tier Email": {
      "main": [
        [
          {
            "node": "Send Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Send Email": {
      "main": [
        [
          {
            "node": "Advance Step",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 2: FDA MDR / HIPAA / EU MDR / FTC Regulatory Deadline Tracker

Runs daily at 7:30 AM. Tracks 12 deadline types:

Deadline Type Clock Regulation
FDA_MDR_DEATH_EXPEDITED_5DAY 5 days 21 CFR §803.53 — fastest clock in MedTech
FDA_MDR_MALFUNCTION_REPORT_30DAY 30 days 21 CFR §803.50
FDA_MDR_SERIOUS_INJURY_30DAY 30 days 21 CFR §803.50
FDA_510K_DEFICIENCY_RESPONSE_90DAY 90 days 21 CFR §807.87(k)
FDA_UDI_GUDID_SUBMISSION Before distribution 21 CFR §830.300
HIPAA_BREACH_NOTIFICATION_60DAY 60 days 45 CFR §164.404
FTC_HEALTH_BREACH_NOTIFICATION_60DAY 60 days + media 16 CFR §318.5
EU_MDR_SERIOUS_INCIDENT_15DAY 15 days EU MDR Art.87
EU_MDR_PMSR_ANNUAL Annual EU MDR Art.85/86
HIPAA_RISK_ASSESSMENT_ANNUAL Annual 45 CFR §164.308(a)(1)
ISO_13485_SURVEILLANCE_AUDIT Per cert schedule ISO 13485:2016
SOC2_TYPE2_RENEWAL Annual Customer procurement

The FDA_MDR_DEATH_EXPEDITED_5DAY urgency threshold triggers a CRITICAL Slack alert at day 0 of creation, escalating to VP Regulatory at 3 days remaining — because this clock starts running the moment you become aware, not when you report.

{
  "name": "FDA MDR / HIPAA / EU MDR Regulatory Deadline Tracker",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "triggerAtHour": 7,
              "triggerAtMinute": 30
            }
          ]
        }
      },
      "id": "t2",
      "name": "Daily 7:30 AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        250,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT id, deadline_type, deadline_date, owner_email, customer_id, notes FROM medtech_regulatory_deadlines WHERE status = 'open' AND deadline_date <= NOW() + INTERVAL '120 days' ORDER BY deadline_date ASC"
      },
      "id": "db3",
      "name": "Get Deadlines",
      "type": "n8n-nodes-base.postgres",
      "position": [
        450,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const d = new Date($json.deadline_date);\nconst now = new Date();\nconst days = Math.ceil((d - now) / 86400000);\nconst type = $json.deadline_type;\nconst regulatoryNote = {\n  'FDA_MDR_DEATH_EXPEDITED_5DAY': '21 CFR \u00a7803.53 \u2014 5-day expedited MDR. FASTEST CLOCK IN MEDTECH.',\n  'FDA_MDR_MALFUNCTION_REPORT_30DAY': '21 CFR \u00a7803.50 \u2014 30-day malfunction MDR. Device failure report to FDA.',\n  'FDA_MDR_SERIOUS_INJURY_30DAY': '21 CFR \u00a7803.50 \u2014 30-day serious injury MDR.',\n  'FDA_510K_DEFICIENCY_RESPONSE_90DAY': '21 CFR \u00a7807.87(k) \u2014 90-day 510(k) deficiency response. No extension without HSR.',\n  'FDA_UDI_GUDID_SUBMISSION': '21 CFR \u00a7830.300 \u2014 GUDID submission required before commercial distribution.',\n  'HIPAA_BREACH_NOTIFICATION_60DAY': '45 CFR \u00a7164.404 \u2014 60-day breach notification to HHS OCR + affected individuals.',\n  'FTC_HEALTH_BREACH_NOTIFICATION_60DAY': '16 CFR \u00a7318.5 \u2014 FTC Health Breach Notification. Media notice if >500 state residents.',\n  'EU_MDR_SERIOUS_INCIDENT_15DAY': 'EU MDR Art.87 \u2014 15-day serious incident report to competent authority.',\n  'EU_MDR_PMSR_ANNUAL': 'EU MDR Art.85 \u2014 Annual PMSR (Class IIa). Art.86 PSUR for Class IIb/III.',\n  'HIPAA_RISK_ASSESSMENT_ANNUAL': '45 CFR \u00a7164.308(a)(1) \u2014 Annual security risk assessment. OCR audit item #1.',\n  'ISO_13485_SURVEILLANCE_AUDIT': 'ISO 13485:2016 \u2014 Surveillance audit by certification body.',\n  'SOC2_TYPE2_RENEWAL': 'SOC 2 Type II \u2014 Annual audit. Customer procurement requirement.'\n}[type] || type;\nlet urgency;\nif (days < 0) urgency = 'OVERDUE';\nelse if (days <= 5) urgency = 'CRITICAL';\nelse if (days <= 14) urgency = 'URGENT';\nelse if (days <= 30) urgency = 'WARNING';\nelse if (days <= 60) urgency = 'NOTICE';\nelse urgency = 'UPCOMING';\nreturn [{ json: { ...$json, days_remaining: days, urgency, regulatory_note: regulatoryNote } }];"
      },
      "id": "c2",
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "position": [
        650,
        300
      ]
    },
    {
      "parameters": {
        "conditions": {
          "options": {
            "caseSensitive": true
          },
          "conditions": [
            {
              "leftValue": "={{ $json.urgency }}",
              "rightValue": "UPCOMING",
              "operator": {
                "type": "string",
                "operation": "notEquals"
              }
            }
          ]
        }
      },
      "id": "if1",
      "name": "Skip UPCOMING",
      "type": "n8n-nodes-base.if",
      "position": [
        850,
        300
      ]
    },
    {
      "parameters": {
        "resource": "message",
        "operation": "post",
        "channel": "#regulatory-compliance",
        "text": "={{ $json.urgency }}: {{ $json.deadline_type }} | {{ $json.days_remaining }} days | {{ $json.regulatory_note }}"
      },
      "id": "sl1",
      "name": "Slack Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        1050,
        300
      ]
    },
    {
      "parameters": {
        "sendTo": "={{ $json.owner_email }}",
        "subject": "={{ $json.urgency }}: {{ $json.deadline_type }} due in {{ $json.days_remaining }} days",
        "message": "={{ $json.deadline_type }} deadline approaching.\\n\\nDue: {{ $json.deadline_date }}\\nDays remaining: {{ $json.days_remaining }}\\n\\nRegulatory note: {{ $json.regulatory_note }}\\n\\nNotes: {{ $json.notes }}",
        "options": {}
      },
      "id": "e2",
      "name": "Email Owner",
      "type": "n8n-nodes-base.gmail",
      "position": [
        1050,
        450
      ]
    }
  ],
  "connections": {
    "Daily 7:30 AM": {
      "main": [
        [
          {
            "node": "Get Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Deadlines": {
      "main": [
        [
          {
            "node": "Classify Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Urgency": {
      "main": [
        [
          {
            "node": "Skip UPCOMING",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Skip UPCOMING": {
      "main": [
        [
          {
            "node": "Slack Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email Owner",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 3: MedTech API & Integration Health Monitor

Polls 5 integration endpoints every 3 minutes. Each endpoint is annotated with the specific regulatory risk its downtime creates:

  • fda_device_api — FDA 510(k)/GUDID database sync. Downtime = MDR malfunction reporting gap (21 CFR §803)
  • ehr_integration_api — EHR/EMR integration. Downtime = HIPAA §164.312(a)(2)(iv) encrypted PHI transmission gap
  • device_telemetry_api — Device data ingestion. Downtime = SaMD IMDRF N23 §4.1.1 clinical evaluation data integrity risk
  • payment_processing_api — Patient billing. PCI DSS 4.0 Req 6.4.3 — note warns never to cache card data in n8n variables
  • ftc_health_data_api — Consumer health metrics. FTC Health Breach Rule 16 CFR Part 318 scope annotation 
{
  "name": "MedTech API & Integration Health Monitor",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "minutes",
              "minutesInterval": 3
            }
          ]
        }
      },
      "id": "t3",
      "name": "Every 3 Minutes",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        250,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "return [\n  { json: { endpoint: 'fda_device_api', url: 'https://api.fda.gov/device/510k.json?limit=1', note: '21 CFR \u00a7803 MDR clock data feed \u2014 outage = 30-day malfunction reporting gap' }},\n  { json: { endpoint: 'ehr_integration_api', url: '{{ $vars.EHR_HEALTH_ENDPOINT }}', note: '45 CFR \u00a7164.312(a)(2)(iv) encrypted PHI transmission \u2014 BAA subprocessor chain at risk' }},\n  { json: { endpoint: 'device_telemetry_api', url: '{{ $vars.DEVICE_TELEMETRY_ENDPOINT }}', note: 'SaMD IMDRF N23 \u00a74.1.1 clinical evaluation data integrity \u2014 MDR serious injury risk' }},\n  { json: { endpoint: 'payment_processing_api', url: '{{ $vars.PAYMENT_HEALTH_ENDPOINT }}', note: 'PCI DSS 4.0 Req 6.4.3 \u2014 patient billing data. Never cache card data in n8n variables' }},\n  { json: { endpoint: 'ftc_health_data_api', url: '{{ $vars.HEALTH_DATA_ENDPOINT }}', note: 'FTC Health Breach Notification Rule 16 CFR Part 318 \u2014 consumer health metrics endpoint' }}\n];"
      },
      "id": "c3",
      "name": "Define Endpoints",
      "type": "n8n-nodes-base.code",
      "position": [
        450,
        300
      ]
    },
    {
      "parameters": {
        "url": "={{ $json.url }}",
        "options": {
          "timeout": 5000,
          "response": {
            "response": {
              "responseFormat": "text"
            }
          }
        }
      },
      "id": "h1",
      "name": "HTTP Ping",
      "type": "n8n-nodes-base.httpRequest",
      "position": [
        650,
        300
      ],
      "continueOnFail": true
    },
    {
      "parameters": {
        "jsCode": "const ok = !$json.error && $input.first().json.statusCode < 400;\nif (ok) return [];\nreturn [{ json: { ...$json, status: 'DOWN', alert: `MEDTECH API ALERT: ${$json.endpoint} DOWN | ${$json.note}` } }];"
      },
      "id": "c4",
      "name": "Check Status",
      "type": "n8n-nodes-base.code",
      "position": [
        850,
        300
      ]
    },
    {
      "parameters": {
        "resource": "message",
        "operation": "post",
        "channel": "#platform-ops",
        "text": "={{ $json.alert }}"
      },
      "id": "sl2",
      "name": "Slack Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        1050,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO api_incident_log (endpoint, status, note, ts) VALUES ('{{ $json.endpoint }}', 'DOWN', '{{ $json.note }}', NOW())"
      },
      "id": "db4",
      "name": "Log Incident",
      "type": "n8n-nodes-base.postgres",
      "position": [
        1050,
        450
      ]
    }
  ],
  "connections": {
    "Every 3 Minutes": {
      "main": [
        [
          {
            "node": "Define Endpoints",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Define Endpoints": {
      "main": [
        [
          {
            "node": "HTTP Ping",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "HTTP Ping": {
      "main": [
        [
          {
            "node": "Check Status",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Status": {
      "main": [
        [
          {
            "node": "Slack Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Log Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 4: FDA MDR + FTC Health Breach Incident Response Pipeline

Webhook endpoint receives incident events. The Code node classifies into 8 types:

Incident Type Clock Regulatory Action
FDA_MDR_DEATH_EXPEDITED 5 days (§803.53) #regulatory-urgent + VP Regulatory + FDA MedWatch
FDA_MDR_MALFUNCTION_30DAY 30 days (§803.50) #regulatory-ops + Reg Affairs lead
FDA_MDR_SERIOUS_INJURY_30DAY 30 days (§803.50) #regulatory-ops + VP Clinical Affairs
HIPAA_PHI_BREACH 60 days (45 CFR §164.404) #privacy-incident + Privacy Officer + HHS OCR
FTC_HEALTH_BREACH 60 days (16 CFR §318.5) #privacy-incident + General Counsel + FTC Web Report
EU_MDR_SERIOUS_INCIDENT 15 days (EU MDR Art.87) #eu-regulatory + EU QP + Notified Body
CURES_ACT_INFO_BLOCKING Immediate #legal-urgent + GC + CEO — $1M/violation OIG
FDA_SAMD_SOFTWARE_DEFECT 10 biz days CAPA #qa-urgent + QA Director + DHF update

The CURES_ACT_INFO_BLOCKING branch includes an annotation: if your automation throttles data access or blocks interoperability requests, this incident type fires. OIG penalty is $1M per violation under 45 CFR §171.103.

{
  "name": "FDA MDR + FTC Health Breach Incident Response Pipeline",
  "nodes": [
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "medtech-incident",
        "responseMode": "responseNode"
      },
      "id": "wh1",
      "name": "Incident Webhook",
      "type": "n8n-nodes-base.webhook",
      "position": [
        250,
        300
      ]
    },
    {
      "parameters": {
        "jsCode": "const type = $json.incident_type;\nconst clocks = {\n  'FDA_MDR_DEATH_EXPEDITED': { days: 5, reg: '21 CFR \u00a7803.53 \u2014 EXPEDITED 5-DAY MDR. Device implant death or previously-reported failure.', channel: '#regulatory-urgent', escalate: 'VP Regulatory Affairs' },\n  'FDA_MDR_MALFUNCTION_30DAY': { days: 30, reg: '21 CFR \u00a7803.50 \u2014 30-day malfunction MDR. Report to FDA MedWatch.', channel: '#regulatory-ops', escalate: 'Regulatory Affairs Lead' },\n  'FDA_MDR_SERIOUS_INJURY_30DAY': { days: 30, reg: '21 CFR \u00a7803.50 \u2014 30-day serious injury MDR.', channel: '#regulatory-ops', escalate: 'VP Clinical Affairs' },\n  'HIPAA_PHI_BREACH': { days: 60, reg: '45 CFR \u00a7164.404 \u2014 60-day breach notification to HHS OCR + affected individuals. If >500 state residents: media notice.', channel: '#privacy-incident', escalate: 'Privacy Officer' },\n  'FTC_HEALTH_BREACH': { days: 60, reg: '16 CFR \u00a7318.5 \u2014 60-day FTC Health Breach Notification. If >500 state residents: media + FTC Web Report simultaneously.', channel: '#privacy-incident', escalate: 'General Counsel' },\n  'EU_MDR_SERIOUS_INCIDENT': { days: 15, reg: 'EU MDR Art.87 \u2014 15-day serious incident report to national competent authority. Notify Notified Body.', channel: '#eu-regulatory', escalate: 'EU Qualified Person' },\n  'CURES_ACT_INFO_BLOCKING': { days: 0, reg: '45 CFR \u00a7171.103 \u2014 $1M/violation OIG penalty. If your automation throttles or blocks data access for interoperability requests, this fires. Route to GC immediately.', channel: '#legal-urgent', escalate: 'General Counsel + CEO' },\n  'FDA_SAMD_SOFTWARE_DEFECT': { days: 10, reg: 'FDA SaMD CAPA requirement \u2014 10 business days CAPA initiation. Document in Design History File (DHF).', channel: '#qa-urgent', escalate: 'QA Director' }\n};\nconst c = clocks[type] || { days: 30, reg: 'Unknown incident type \u2014 review manually', channel: '#regulatory-ops', escalate: 'Compliance Team' };\nconst deadline = new Date(Date.now() + c.days * 86400000).toISOString().slice(0,10);\nreturn [{ json: { ...$json, clock_days: c.days, regulatory_note: c.reg, slack_channel: c.channel, escalate_to: c.escalate, response_deadline: deadline } }];"
      },
      "id": "c5",
      "name": "Classify Incident",
      "type": "n8n-nodes-base.code",
      "position": [
        450,
        300
      ]
    },
    {
      "parameters": {
        "resource": "message",
        "operation": "post",
        "channel": "={{ $json.slack_channel }}",
        "text": "INCIDENT: {{ $json.incident_type }} | Deadline: {{ $json.response_deadline }} ({{ $json.clock_days }}d) | Escalate: {{ $json.escalate_to }}\\n{{ $json.regulatory_note }}"
      },
      "id": "sl3",
      "name": "Slack Incident Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        650,
        300
      ]
    },
    {
      "parameters": {
        "sendTo": "={{ $json.regulatory_contact_email }}",
        "subject": "INCIDENT: {{ $json.incident_type }} \u2014 Response deadline {{ $json.response_deadline }}",
        "message": "Incident type: {{ $json.incident_type }}\\nReported: {{ $now }}\\nResponse deadline: {{ $json.response_deadline }} ({{ $json.clock_days }} days)\\nEscalate to: {{ $json.escalate_to }}\\n\\nRegulatory note: {{ $json.regulatory_note }}\\n\\nIncident data: {{ $json | toJsonString }}",
        "options": {}
      },
      "id": "e3",
      "name": "Email Response Lead",
      "type": "n8n-nodes-base.gmail",
      "position": [
        650,
        450
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "INSERT INTO incident_log (incident_type, regulatory_note, response_deadline, clock_days, escalate_to, raw_payload, created_at) VALUES ('{{ $json.incident_type }}', '{{ $json.regulatory_note }}', '{{ $json.response_deadline }}', {{ $json.clock_days }}, '{{ $json.escalate_to }}', '{{ $json | toJsonString }}', NOW())"
      },
      "id": "db5",
      "name": "Log to Postgres",
      "type": "n8n-nodes-base.postgres",
      "position": [
        850,
        300
      ]
    },
    {
      "parameters": {
        "respondWith": "json",
        "responseBody": "{\"status\":\"received\",\"incident_type\":\"{{ $json.incident_type }}\",\"deadline\":\"{{ $json.response_deadline }}\"}"
      },
      "id": "r1",
      "name": "Respond",
      "type": "n8n-nodes-base.respondToWebhook",
      "position": [
        850,
        150
      ]
    }
  ],
  "connections": {
    "Incident Webhook": {
      "main": [
        [
          {
            "node": "Classify Incident",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Incident": {
      "main": [
        [
          {
            "node": "Slack Incident Alert",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Email Response Lead",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack Incident Alert": {
      "main": [
        [
          {
            "node": "Log to Postgres",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Log to Postgres": {
      "main": [
        [
          {
            "node": "Respond",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 5: Weekly MedTech SaaS KPI Dashboard

Runs Monday at 8 AM. Pulls MRR, account counts, and a compliance debt table: open MDR reports, critical MDR items (≤5 days remaining), open HIPAA breaches, open FTC Health Breach notifications, open EU MDR serious incidents, and overdue items. Sends HTML email to CEO + CPO with BCC to Regulatory Affairs + CISO.

The $getWorkflowStaticData call maintains WoW% MRR tracking across executions without a separate database table.

{
  "name": "Weekly MedTech SaaS KPI Dashboard",
  "nodes": [
    {
      "parameters": {
        "rule": {
          "interval": [
            {
              "triggerAtHour": 8,
              "triggerAtMinute": 0,
              "weekdays": [
                "monday"
              ]
            }
          ]
        }
      },
      "id": "t5",
      "name": "Monday 8 AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        250,
        300
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as total_accounts, SUM(mrr_usd) as total_mrr, SUM(CASE WHEN tier='ENTERPRISE_MEDICAL_DEVICE_MANUFACTURER' THEN mrr_usd ELSE 0 END) as enterprise_mrr, COUNT(CASE WHEN created_at >= NOW() - INTERVAL '7 days' THEN 1 END) as new_accounts_7d, COUNT(CASE WHEN churned_at >= NOW() - INTERVAL '7 days' THEN 1 END) as churned_7d FROM medtech_customers WHERE status='active'"
      },
      "id": "db6",
      "name": "Get Revenue KPIs",
      "type": "n8n-nodes-base.postgres",
      "position": [
        450,
        250
      ]
    },
    {
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) as open_mdr_reports, COUNT(CASE WHEN deadline_type LIKE 'FDA_MDR%' AND deadline_date <= NOW() + INTERVAL '5 days' THEN 1 END) as critical_mdr_count, COUNT(CASE WHEN deadline_type = 'HIPAA_BREACH_NOTIFICATION_60DAY' AND status = 'open' THEN 1 END) as open_hipaa_breaches, COUNT(CASE WHEN deadline_type = 'FTC_HEALTH_BREACH_NOTIFICATION_60DAY' AND status = 'open' THEN 1 END) as open_ftc_breaches, COUNT(CASE WHEN deadline_type = 'EU_MDR_SERIOUS_INCIDENT_15DAY' AND status = 'open' THEN 1 END) as open_eu_mdr, COUNT(CASE WHEN status = 'open' AND deadline_date < NOW() THEN 1 END) as overdue_items FROM medtech_regulatory_deadlines"
      },
      "id": "db7",
      "name": "Get Compliance KPIs",
      "type": "n8n-nodes-base.postgres",
      "position": [
        450,
        450
      ]
    },
    {
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByIndex",
        "options": {}
      },
      "id": "m1",
      "name": "Merge KPIs",
      "type": "n8n-nodes-base.merge",
      "position": [
        650,
        350
      ]
    },
    {
      "parameters": {
        "jsCode": "const d = $json;\nconst prev = $getWorkflowStaticData('global');\nconst mrrWoW = prev.last_mrr ? (((d.total_mrr - prev.last_mrr) / prev.last_mrr) * 100).toFixed(1) : 'N/A';\nprev.last_mrr = d.total_mrr;\n$setWorkflowStaticData('global', prev);\nconst criticalMDR = d.critical_mdr_count > 0 ? `<span style='color:red'>&#9888; ${d.critical_mdr_count} MDR CRITICAL (&le;5 days)</span>` : '0 critical';\nconst html = `<h2>MedTech SaaS Weekly KPI \u2014 ${new Date().toISOString().slice(0,10)}</h2><table border='1' cellpadding='6' style='border-collapse:collapse'><tr><th>Metric</th><th>Value</th><th>WoW</th></tr><tr><td>Total MRR</td><td>$${Number(d.total_mrr||0).toLocaleString()}</td><td>${mrrWoW}%</td></tr><tr><td>Total Accounts</td><td>${d.total_accounts}</td><td>\u2014</td></tr><tr><td>New Accounts (7d)</td><td>${d.new_accounts_7d}</td><td>\u2014</td></tr><tr><td>Churned (7d)</td><td>${d.churned_7d}</td><td>\u2014</td></tr></table><h3>Compliance Debt</h3><table border='1' cellpadding='6' style='border-collapse:collapse'><tr><th>Item</th><th>Count</th></tr><tr><td>Open MDR Reports</td><td>${d.open_mdr_reports}</td></tr><tr><td>Critical MDR (&le;5d)</td><td>${criticalMDR}</td></tr><tr><td>Open HIPAA Breaches</td><td>${d.open_hipaa_breaches}</td></tr><tr><td>Open FTC Health Breaches</td><td>${d.open_ftc_breaches}</td></tr><tr><td>Open EU MDR Incidents</td><td>${d.open_eu_mdr}</td></tr><tr><td>Overdue Items</td><td>${d.overdue_items}</td></tr></table>`;\nreturn [{ json: { ...d, html_report: html, mrr_wow: mrrWoW } }];"
      },
      "id": "c6",
      "name": "Build KPI Report",
      "type": "n8n-nodes-base.code",
      "position": [
        850,
        350
      ]
    },
    {
      "parameters": {
        "sendTo": "ceo@yourcompany.com",
        "subject": "MedTech Weekly KPI \u2014 MRR ${{ $json.total_mrr }} | {{ $json.open_mdr_reports }} open MDR",
        "message": "={{ $json.html_report }}",
        "options": {
          "appendAttribution": false,
          "ccList": "cpo@yourcompany.com",
          "bccList": "regulatory@yourcompany.com, ciso@yourcompany.com"
        }
      },
      "id": "e4",
      "name": "Email KPI Report",
      "type": "n8n-nodes-base.gmail",
      "position": [
        1050,
        350
      ]
    }
  ],
  "connections": {
    "Monday 8 AM": {
      "main": [
        [
          {
            "node": "Get Revenue KPIs",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Get Compliance KPIs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Revenue KPIs": {
      "main": [
        [
          {
            "node": "Merge KPIs",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Get Compliance KPIs": {
      "main": [
        [
          {
            "node": "Merge KPIs",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge KPIs": {
      "main": [
        [
          {
            "node": "Build KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build KPI Report": {
      "main": [
        [
          {
            "node": "Email KPI Report",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Why Self-Hosted n8n for MedTech & Digital Health?

Risk Area Cloud iPaaS (Zapier/Make) Self-Hosted n8n
HIPAA PHI data flow PHI routes through vendor cloud — BAA required but data still egresses PHI stays in your VPC — BAA is a formality, not a data boundary
FDA §11 audit trail Vendor logs may not meet 21 CFR §11.10(e) tamper-evident requirement Postgres audit log in your infrastructure — §11-compliant
EU MDR QMS traceability Workflow data in US cloud — EU data localization risk under GDPR + MDR On-prem/EU cloud — Art.10(9) QMS boundary intact
FTC Health Breach Rule Health metrics in 3rd-party cloud = potential breach triggering 16 CFR §318 Consumer health data stays on-prem — FTC Rule scope controlled
ISO 13485 CSV validation Cloud SaaS updates require Computer System Validation revalidation Version-pinned n8n — IQ/OQ/PQ on your schedule
SOC 2 CC9.2 subprocessor Zapier/Make in your vendor list = scope expansion at every audit n8n is infrastructure — removes from CC9.2 subprocessor assessment
FDA SBOM documentation Third-party cloud workflow vendor = undocumented data flow in 510(k) Self-hosted with versioned node SBOM = tractable FDA submission artifact

The SBOM angle is increasingly material: FDA's 2023 cybersecurity guidance for medical devices (21 CFR §524b) requires a software bill of materials for premarket submissions. A self-hosted n8n instance with documented node versions and data flows is a tractable submission artifact. A third-party cloud iPaaS is a gap.

Get all 5 workflows (import-ready JSON + Postgres schema): stripeai.gumroad.com

All workflows import directly into n8n. Replace credential placeholders (your-postgres-connection, your-slack-workspace, email addresses) before activating.

Top comments (0)