Applying Standards to in-house developed software, an experience to be shared. 29 th May 2012 IPEM Bespoke Software Development, UCL London

Size: px

Start display at page:

Download "Applying Standards to in-house developed software, an experience to be shared. 29 th May 2012 IPEM Bespoke Software Development, UCL London"

Regina White
8 years ago
Views:

1 Applying Standards to in-house developed software, an experience to be shared 29 th May 2012 IPEM Bespoke Software Development, UCL London 1

2 Belfast HSC Trust Based in Regional Medical Physics Service, Clinical Engineering & Physiological Sciences Previous software development projects: Physiological measurement applications Clinical trial databases User interfaces including web based applications Development software packages C, Pascal, Delphi, Labview, Visual Studio.net

measurement applications Clinical trial databases User interfaces including web

3 Background Visual electrophysiology Infra-red occulography Data capture and analysis EMG quantification and analysis Clinical Trial Database development

4 Medical Device Directive Taking account of the growing importance of software in the field of medical devices, be it as stand alone or as software incorporated in a device, validation of software in accordance with the state of the art should be an essential requirement. DIRECTIVE 2007/47/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL Clause 20 4

validation of software in accordance with the state of the art should be an essential

5 Developing a Framework - Quality Management In the beginning... standards were not applied Development now incorporates these as a baseline: IEC 62304: Medical Device Software ISO 13485: Medical Device Quality Management ISO 14971: Application of risk management to medical devices IEC : Application of Risk Management for IT-Networks incorporating medical devices. Part 1: Roles, responsibilities and activities IEC : Medical device software - Part 1: Guidance on the application of ISO to medical device software IEC : General requirements for basic safety and essential performance (PEMS) 5

Management ISO 14971:2007 - Application of risk management to medical devices IEC 80001-1:2010 - Application of Risk Management for IT-Networks incorporating

6 Design Planning and Control The organisation shall plan and control the design and development of the product ISO 13485:2003 Clause

7 Design Planning and Control Determine Roles and responsibilities Core development standards Problem to be solved Stakeholders Business requirements Review periods and estimated completion Quality objectives Major tasks Risks for product delivery and design ISO 13485:2003 Clause The organisation shall plan and control the design and development of the product Who, What, Why, Where When 7

Quality objectives Major tasks Risks for product delivery and design ISO 134

8 Design Verification Verification shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that the design and development outputs have met the design and development input requirements. Records of the results of verification and any necessary actions shall be maintained (see 4.2.4) ISO 13485:2003 Clause

1) to ensure that the design and development outputs have met the design and

9 Design Verification Often confused with validation Set in context by ISO13485 Clause Can not be undertaken unless planned Demands that all records relating to verification activities are maintained 9

10 Design Verification e.g. database entry form EForm Name Question Name Ver Id Ver Type Verification Term / Expression Expected Verification Message Actual Verification Message Cvr PatientNumber 101 Warn if PatientNumb er <101 >150 <201 > Inconsistent Data. Invalid subject number please correct/confirm number '101. Inconsistent Data. Invalid subject number please correct/confir m number' 10

11 Design Validation Design and development validation shall be performed in accordance with planned arrangements (see 7.3.1) to ensure that the resulting product is capable of meeting the requirements for the specified application or intended use. Validation shall be completed prior to the delivery or implementation of the product ISO 13485:2003 Clause

1) to ensure that the resulting product is capable of meeting the requirements for the

12 Design Validation Must be based on a signedoff Design Specification Determines whether the product (software) is Fit for Purpose? Validation requirements should be measureable, typically according to agreed tolerances 12

13 Validation e.g. of output measurement is within tolerance Infra-red Occulography - Comparing numerically and analytically derived captured data against specified validation tolerances 13

14 At the start and throughout the development 14

15 Applying IEC 62304:2006 Medical device software Software life cycle processes Applied in conjunction with IEC 14971:2007 Risk Management of Medical Devices Covers development of medical device software and its maintenance Doesn t cover the System RISK ANALYSIS focuses on the identification of potential software functionality and ANOMALIES that could result in HAZARDOUS SITUATIONS Classification of each SW item based on potential HARM Class A: Injury or damage to health is not possible Class B: Non-serious injury is possible Class C: Death or serious injury is possible 15

identification of potential software functionality and ANOMALIES that could result in HAZARDOUS SITUATIONS Classification of each SW item based

. CAPA management Corrective and preventative actions Audit Scheduling of

16 Quality Management Tools Q-Pulse v5 Quality Management System Document Control Change/version management, copyholders, approval etc.. CAPA management Corrective and preventative actions Audit Scheduling of audits covering QMS Processes, SOPs including design control Design Development Technical Dossier Management 16

17 Work Flow Management Tools ECRI-AIMS Work orders capture Design Control issues for both Development and Deployment Corrective action Main Work Order Type and Responses Design & development stages map product development life cycle. 17

Corrective action Main Work Order Type and Responses

18 Future Delivery and Support Installation and product delivery using PRINCE2 Medical Device Vigilance 18

19 Future Delivery and Support IEC :2010 Risk management for IT-networks incorporating medical devices Provides a specific focus on the Medical Applications residing on Hospital IT Networks When is it applied: BEFORE a medical device is connected to an IT-Network For ANY CHANGES during the entire life cycle of the device on the Medical IT- Network 19

residing on Hospital IT Networks When is it applied: BEFORE a medical device is

20 Thank you Any Questions? 20

Medical Device Software Standards for Safety and Regulatory Compliance

Medical Device Software Standards for Safety and Regulatory Compliance Sherman Eagles +1 612-865-0107 seagles@softwarecpr.com www.softwarecpr.com Assuring safe software SAFE All hazards have been addressed