Medical device software standards

Abstract

Much medical device software is safety-related, and therefore needs to have high integrity (in other words its probability of failure has to be low.) There is a consensus that if you want to develop high-integrity software, you need a quality system. This is because software is a complex product that is easy to change and difficult to test, and the management system that handles these issues must include such quality system elements as: detailed traceable specifications, disciplined processes, planned verification and validation and a comprehensive configuration management and change control system. It is also agreed that software quality management systems need specific processes which are different from and additional to more general quality management systems such as that required by EN 13485. Historically, ISO 9000-3 Part 3: Guidelines for the application of ISO 9001:1994 to the development, supply, installation and maintenance of computer software states these additional processes very clearly, but is not mandatory. (This is now ISO 90003.) In both Europe and the USA there is therefore a gap in both regulations and standards for Medical Devices. There is no comprehensive requirement specifically for software development methods. In Europe, IEC 60601-1 Medical electrical equipment Part 1: General requirements for safety and essential performance, has specific requirements for software in section 14 Programmable Electrical Medical Systems (PEMS). This requires (at a fairly abstract level) some basic processes and documents, and includes an invocation of the risk management process of ISO 14971 Medical devices Application of risk management to medical devices In the US, there is an FDA regulation requiring Good Manufacturing Practice, with guidance on software development methods (strangely entitled Software Validat