Experience with an Integrated Risk Management Process in the Medical Regulatory Environment

Abstract

In the medical domain, manufacturers are required to implement a Risk Management Process by multiple standards. ISO 14971 provides a framework and taxonomy for medical device risk management process but does not provide details or explanations of its requirements. The IEC 60601 standard family for medical electrical equipment defines the major hazards as an input for the Risk Management Process. Further process standards deal with software and use-related risks in particular (IEC 62304, ISO 62366). It is a challenging task to fulfil all these requirements in one integrated process and provide a comprehensive documentation (Risk Management File) to achieve compliance. We have set up a Risk Management (RM) process for our two different active medical devices. We will share our implementation which handles the Hardware, Software and Use Risk in an integrated way on the functional level. Further particular software-related RM tasks are handled in the software development life-cycle separately. Additionally, we will present our tool chain, which provides evidence of carrying out RM tasks throughout the whole development life-cycle, including connections to the requirement management and effectiveness verification.