IEC 62304, the international standard that defines software development lifecycle requirements for medical device software, was developed from the perspective that product testing alone is insufficient to ensure patient safety. It provides a common framework for medical device manufacturers to develop software components. Conformance with this standard demonstrates that there is a software development process in place that fulfills the requirements of the Medical Device Directive.
If your medical device has software that regulates its functionality in a way that contributes to Basic Safety or Essential Performance, then you will need to comply with IEC 62304. This standard requires all aspects of the Software Development Life Cycle (SDLC) to be appropriately managed to ensure patient safety, including:
- Development and code reviews
- Risk management
- Configuration management
- Incident and bug resolution
The most common mistake medical device manufacturers make is failing to assess which elements of risk their software mitigates. These are the elements that must be addressed by IEC 62304. For example, what would happen if the creator of a hoist didn’t properly vet the software that signaled the hoist to lower the patient at a certain speed? If a patient were lowered too quickly – or not at all – there would be a risk management nightmare. Since software plays a role in the Basic Safety functions of the hoist, it must comply with 62304’s requirements.
Common software functionality manufacturers fail to recognize as IEC 62304 compliance issues include:
- Alarms and Alerts – often an Essential Performance requirement because they are intended to detect abnormalities
- Speed & Position Sensors – use of software to limit range of motion, speed and force, which are Basic Safety concerns
- Algorithms – remove the software and the device is no longer able to operate as intended, resulting in the algorithms being part of Essential Performance
It is critical to have clearly defined processes for your company and your Software Development Life Cycle, in particular. IEC 62304 identifies several expectations related to the information that should be included in your SDLC procedures, including:
- Documentation of your process – document management is essential for meeting compliance goals
- Software of Unknown Pedigree (SOUP) – manage your SOUP appropriately
- Document Development – make certain you are sufficiently resourced to support document development needs
- Version Control & Updates – clearly define software updates and how software will be maintained in a validated state.
Medical device manufacturers frequently seek 3rd party software development assistance. However, the manufacturer remains responsible for the device software. Important areas to consider when contracting out your software development include:
- Supplier Management Process – confirm that your software vendor complies with IEC 62304 and their processes are reviewed during vendor audit
- Quality Agreement – confirm that:
- It defines vendor responsibilities and IEC 62304 Deliverables
- Vendor procedures used for software development will be provided to you and the test lab for review
- Establish your SDLC – at minimum, your process will define acceptance criteria (i.e. IEC 62304 compliance and deliverables) from your vendor
Once you know you must comply with IEC 62304, how do you go about preparing? To start, know that compliance with this standard is defined as implementing all of the processes, activities and tasks identified in the standard in accordance with the software safety class. 62304 itself does not prescribe a particular organizational structure or specific format for documentation. Compliance is determined by a review of all required documentation, including the risk management file.
IEC 62304 file will be reviewed to ensure:
- It contains all required documentation including a risk management file
- Procedures meet the requirements of the standard
- Each check list item is satisfied
- A product review is conducted and further a review of the relevant software segments if it has been decided that the software performs Basic Safety or Essential Performance for your device
If you get caught in any of the above-mentioned pitfalls, you’ve probably got a problem. You will either not receive a report at all, or will receive a report that says you failed somewhere in IEC 60601-1 or IEC 62304.
Because the standards are voluntary in the US, you don’t necessarily have to make product changes. However, for each “fail,” you will be required to provide justification for each deviation. If you have valid justification, your device should still attain regulatory approval from the FDA, although developing this justification can be a lengthy process in itself. In the end, though, you may find it more efficient to comply with IEC 62304.
Russ King is President of Methodsense, a consulting firm that helps clients deliver medical and technological breakthroughs by effectively meeting the requirements needed to bring their products to market. He can be reached at (919) 313-3962 or firstname.lastname@example.org.