Scoring PHQ-9 without becoming a medical device
A practitioner platform wanted validated depression screeners next to glucose data. Holding the line between helpful tool and medical device came down to a series of product decisions — including removing question nine.
· 5 min read · Health platforms, Product judgment
To be open about where I stand: I have my own experience in this area, almost losing somebody to suicide a while ago. So when a product feature touches this ground, I'm conscious of contributing to anything that might not keep people in that position safe in the ways they need. A depression score has never been abstract to me.
When practitioners on one of the platforms I work with, a US metabolic-health product, asked for validated mental-health instruments, I started with the responsibility questions rather than the implementation ones. What follows is how that played out, including the week it stopped being theoretical.
In brief
- A wellness platform can compute validated clinical scores like PHQ-9 without becoming a medical device — the line is held by explicit product decisions, not by the code.
- PHQ-9's question nine implies a crisis safety net. Without guaranteed real-time response, the responsible move was removing it: the standard PHQ-8 swap.
- Notifications were built deliberately dumb — every practitioner, every submission, no score-based filtering — because filtering on clinical content is triage.
- Decide explicitly and early what your product is not: a diagnostician, a triage system, or the responsible clinician. Skip the deciding and the decisions still get made, silently.
Why a depression score belongs next to a glucose chart
The connection between metabolic health and mood is one of the more interesting frontiers in the practitioners' field, and they wanted to see it in their own patients: depression scores plotted against glucose and ketone data on the same timeline. One chart. For a clinician exploring metabolic approaches to mental health, that chart is the whole point. Their request list ran to nine validated instruments, and PHQ-9, the standard depression screener, sat at the top of it.
A wellness platform that computes depression scores is standing on a line. On one side, a tool that helps qualified practitioners see their patients more clearly; on the other, software that interprets mental-health data, which the world reasonably expects to carry the rigour, the classification and the liability of a medical device. The code on either side of the line can look identical. The difference is a series of product decisions, and most teams that end up on the wrong side never notice themselves making them.
We built the scoring, and for a while the line held without much drama. The product computed the number and showed it to the practitioner the patient chose to share it with. It did not diagnose, categorise, alert, or advise. When the request list tempted us toward templating all nine instruments, we wrote a scope line saying no, because every added instrument multiplies the surface where the subtleties live.
Then a piece of feedback arrived that tested the whole position.
Question nine
PHQ-9's final question asks directly about self-harm. This spring, a clinician raised the question we should all have been louder about sooner: if a patient answers it with a "2" or a "3", does anyone get told immediately? Email and push, she pointed out, may not be sufficient. Practices that use these surveys properly have crisis workflows behind them; an app that renders the question without one is implying a safety net it doesn't have.
Sit with the ordinary version of that for a second. Someone signals they need help on a Friday evening, and it doesn't get seen until Monday. It might not be law-breaking. But do you want it hanging over you? I know I don't.
For me this was never an abstract product debate, and I pushed hard on it. There's the legal obligation, and then there's the human moral responsibility, especially once something has been flagged to you. The statistics are clear that someone who indicates ideation on a PHQ-9 is at greater risk of going on to die by suicide. And we could not regulate who used and managed our surveys once they were out there. We might never have been legally responsible for a consequence. I'm sure every one of us would still have felt it as a moral failure.
The easy answers all turned out to be traps. Alert automatically on a high-risk answer, and the software is now triaging mental health, which is the regulatory line in the sand. Promise notifications and you own their delivery: a wrong email address or a network failure becomes your failure, in the worst possible moment. And the question itself, sitting in a wellness survey, implies that someone is listening on the other end, which was an implication we had no guaranteed way to honour.
So I proposed we take the question out, and we did. PHQ-9 became PHQ-8, the standard swap for platforms without real-time crisis response, and the usage data confirmed nobody's live surveys were disrupted. Notifications went in with deliberate dumbness: every practitioner in a practice is notified on every submission, with no score-based filtering, because the moment we filter on clinical content we've become the triage system we just declined to be. Before any practitioner can switch those notifications on, they tick to accept, logged server-side down to the version of the disclaimer they accepted, that they, the qualified human, own the clinical response. And the next layer on the roadmap is a check that scans custom survey questions for crisis-adjacent language and makes the practitioner explicitly acknowledge responsibility before publishing.
The upside and the downside of working on products with real-world impact is that we have real-world impact. Both halves of that sentence were true in the same week.
What this means if you're building anything like it
You can support validated clinical instruments without claiming clinical authority. The condition is deciding, explicitly and early, what your product is not: a diagnostician, a triage system, or the responsible clinician. Each of those is a product decision with a name, an owner and a paper trail. Skip the deciding and the decisions still get made, silently, in your backlog, and you learn which way they went at the worst possible time.
Sometimes, when we're building products, whether we're the engineer, the product owner, the marketer, the CEO or the science-writer, we get so consumed by our processes, learned standards, logic and intellect that we forget about the real lived experience on the other end. It becomes abstract to us, until we remember, again, to use that little thing called imagination. That's what puts us in another person's shoes, and it is worth using deliberately when the stakes are as important as life or death.
Somewhere on the other end of a feature like this is a person answering question nine honestly at two in the morning. Build like they're real, because they are.
Common questions
Can a wellness app use PHQ-9 without being classed as a medical device?
Yes, if the line is held deliberately: compute the score and show it to the practitioner the patient chose to share it with, and do not diagnose, categorise, alert or advise. The code on either side of that line can look identical — the difference is a series of explicit product decisions, each with a name, an owner and a paper trail.
Why would a platform use PHQ-8 instead of PHQ-9?
PHQ-9's final question asks directly about self-harm, and rendering it implies a crisis safety net behind it. A platform that cannot guarantee real-time crisis response shouldn't imply one, so the standard swap for platforms without that response is PHQ-8 — the same instrument with question nine removed.
Should an app alert practitioners automatically on high-risk PHQ-9 answers?
Alerting automatically on a high-risk answer means the software is triaging mental health, which is the regulatory line in the sand. One workable alternative is deliberately dumb notifications — every practitioner notified on every submission, with no score-based filtering — plus a server-side logged acknowledgement that the qualified human owns the clinical response.
