Intland s Medical Template

Transcription

1 Intland s Medical Template Traceability Browser Risk Management & FMEA Medical Wiki Supports compliance with IEC 62304, FDA Title 21 CFR Part 11, ISO 14971, IEC and more

2 INTLAND codebeamer ALM is built for Medical Device Medical device development teams are faced with increased software complexity when developing high quality devices. It is essential to manage risks and meet industry safety standards in order to ensure patient safety. The medical industry is highly regulated with standards to define and ensure software quality and to control risks. IEC codebeamer Medical ALM assists manufacturers in achieving compliance with the international standard IEC 62304, the mandatory regulation for manufacturers of medical devices. It also supports compliance with FDA Title 21 CFR Part 11 for manufacturers and developers in the US market. codebeamer Medical ALM provides the full functionality of a complex ALM solution. It includes requirements, development and test management, all customized to meet the needs of users in the medical field. codebeamer ALM is built for Medical Device Development and for Regulatory Compliance (IEC 62304, US FDA Title 21 CFR Part 11)

3 codebeamer ALM is built for Medical Device INTLAND Configured for Medical Lifecycles Quality, requirements, design, test, configuration and change management features and all artifacts are preconfigured for medical processes to ensure full traceability and auditability throughout the complete development lifecycle, in order to help you achieve compliance with IEC and/or FDA 21 CFR Part 11. Medical Requirements Management Customers, systems, software and architecture-related trackers are defined to capture and manage all requirements of the medical device. The integrated Traceability Browser shows the dependencies among requirements and risks, as well as all other work item types. Risk Management & FMEA codebeamer s medical risk tracker comes with a preconfigured, customizable risk management workflow. A Failure Mode and Effects Analysis (FMEA) template is available to help identify, prioritize, and plan the mitigation of risks. Risk Matrix Diagrams give you an overview of your overall risk levels. Medical Wiki The medical wiki fully supports compliance with IEC as its content covers the standard requirements. The medical wiki provides the users of codebeamer s Medical Project with domain knowledge and it supports the application of rules throughout the entire development lifecycle.

4 INTLAND codebeamer ALM is built for Medical Device Medical Document Management with Templates The document management module is equipped with template documents and process descriptions based on the requirements stipulated by the standard IEC Integrated QA & Test Management QA & Test Management is integrated in the ALM solution, letting you conveniently manage testing and quality assurance. Test cases can be generated automatically from requirements, stored in test sets, and saved in the test case library for reuse. A Test Coverage Browser is available to help you ensure complete test coverage. Release Management codebeamer s release management functionality enables you to plan your releases (milestones, versions) in a convenient way, to add requirements to sprints using a simple drag-and-drop interface, and to monitor the progress of your processes.

5 codebeamer ALM is built for Medical Device INTLAND Advanced Workflows & Process Enforcement codebeamer s advanced workflows allow you to customize your processes by configuring your own workflows. You can also set up your workflows to automatically create work items if certain conditions are met. For instance, if a requirement with a high safety rating is submitted, the system can be configured to automatically create a risk and a test case, ensuring these high-risk items are adequately managed. Workflow visualization helps trace and prove development processes, greatly facilitating compliance. Process Guards & FDA-compliant E-signatures Guards with conditions may also be added to workflows, and e-signatures may be required for certain steps in the process. This helps ensure that all necessary approvals are done by the appropriate members of your team, and that only authorized personnel can change or add items (naturally, all changes are recorded and documented). codebeamer s e-signatures support compliance with FDA Title 21 CFR Part 11, as they store all the relevant data about user authorization & the e-signature in human readable format.

6 Compliance with IEC codebeamer function Chapter of IEC Trackers Configuration Items Medical Wiki Document Management SCM Repositories Reports Test Management 4 General requirements 4.1 Quality management system Defined in corporate documentation 4.2 Risk management l l 4.3 Software safety classification l l 5 Software development process 5.1 Software development planning l l Software development plan, updates, definition of standards methods and tools. Test and verification planning, risk management, documentation and configuration planning. 5.2 Software requirements analysis l l l l System-Software-requirements definition, risk control measures, risk evaluation and mitigation. 5.3 Software architectural design l l l Architecture requirements, SOUP definition, hardware requirements, risk control measures and verification. 5.4 Software detailed design l l l Design for software units, interface design, software unit implementation, verification and acceptance. 5.5 Software unit implementation and verification l l 5.6 Software integration and integration testing l l Software integration and integration testing, software units integration, test inteagration, verification, regression test, problem resolution process. Design for software units, interface design, software unit implementation, verification and acceptance. 5.7 Software systems testing l l 5.8 Software release l l l l Software release verification, evaluate residual anomalies, documentation task completation report, archive and repeatability of software releases. 6 Software maintenance process 6.1 Establish software maintenance plan l l 6.2 Problem and modification analysis l Feedback documentation, evaluation and monitoring, safety problem reports, change request analysis, CRQ approval, communication to users. 6.3 Modification implementation l l Use established process to implement modification, re-release modified software system. 7 Software risk management process 7.1 Analysis of software contributing to hazardous situations l l Identify software items that could contribute to a hazardous situation and potential causes of contribution to a hazardous situation, evaluate published SOUP anomaly lists and prepare documentation. 7.2 Risk control measures l l Define risk control measures, and implement risk control measures in software development. 7.3 Verification of risk control measures l l Identify software items that could contribute to a hazardous situation and potential causes of contribution to a hazardous situation. 7.4 Risk management of software changes l Analyse changes to medical device software with respect to safety, analyse impact of software changes on existing risk control, perform risk management activities based on analyses. 8 Software configuration management process 8.1 Configuration identification l l Establish means to identify configuration items, identify SOUP, identify system configuration documentation. 8.2 Change control l l Approve change requests (CRQ), implement and verify change, provide means for traceability of changes. 8.3 Configuration status accounting l l 9 Software problem resolution process 9.1 Prepare problem reports l l 9.2 Investigate the problem l l 9.3 Advise relevant parties l l 9.4 Use change control process l l 9.5 Maintain records l l 9.6 Analyse problems for trends l l 9.7 Verify software problem resolution l l 9.8 Test documentation contents l l

7 Compliance with US FDA Title 21 CFR Part 11 Chapter in FDA FDA regulation Original Text codebeamer compliance Subpart B Electronic Records a Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. All artifacts/records in codebeamer can be tracked and traced via history data. Permission control can be used to ensure only those with authorization can access data b The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. All documents in codebeamer can be exported to readable industry standard formats. ReqIF and MS Office integration is fully supported, including export and roundtrip export-import functionality c Protection of records to enable their accurate and ready retrieval throughout the records retention period. All data is stored in the database (MySQL or Oracle) that can be regularly saved and maintained even during software upgrades. Electronic records with electronic signatures are stored in the database d Limiting system access to authorized individuals. System administration security rules are fully supported by codebeamer. All administrative changes are recorded e Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying. All date and time information regarding creating, modifying or deleting artifacts in codebeamer are logged. Full change history is saved (what was edited by whom, at what point in time). Log files can be exported and supervised by authorized administrators. Electronic signatures attached to records are maintained f Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate. Using workflows, a fixed sequence of steps and events as well as status transition rules can be set up in codebeamer in order to enforce certain processes g Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. Security experts are contracted to test codebeamer. Industry standard user authentication, single-sign-on, and role based access is provided to manage system access and record modification. Electronic signatures can be enforced h Use of device (e.g. terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction. Guards with workflows are provided for data source validation i Determination that persons who develop, maintain, or use electronic record/ electronic signature systems have the education, training, and experience to perform their assigned tasks. It is the responsibility area of the company that is in charge of the maintenance and management of the system. This documentation is a part of FDA 21 CFR QM system docs j The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification. It is the responsibility area of the company that is in charge of the maintenance and management of the system. Thus, it is not a system requirement k 1.) and 2.) Use of appropriate controls over systems documentation including: Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance. Revision and change control procedures to maintain an audit trail that documents time sequenced development and modification of systems documentation. All documents are managed by codebeamer s integrated document management system. The same rules and system features are applicable for documents that are marked under e. (i.e. all changes, modifications etc. are recorded and logged). Revision and change control are available in the document management subsystem, documents are stored in the active database a Signature manifestation Signed electronic records shall contain information associated with the signing that clearly indicates all of the following: 1. The printed name of the signer; 2. The date and time when the signature was executed; and 3. The meaning (such as review, approval, responsibility, or authorship) associated with the signature. Electronic signature in codebeamer contains the following data: The printed name of the signer; The date and time when the signature was executed; and The meaning (such as review, approval, responsibility, or authorship) associated with the signature b The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout). Electronic signature records can be displayed in human readable format Signature record linking Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means. Electronic signatures are linked to the adequate electronic record (artifact). They can not be removed, deleted, or attached to another artifact.

8 Compliance with US FDA Title 21 CFR Part 11 Chapter in FDA FDA regulation Original Text codebeamer compliance Subpart C Electronic Signature a Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else. codebeamer requires a User name (ID) and password to issue electronic signatures. All electronic signatures are generated as unique. The same signature can not be generated twice. User ID and password are required to authenticate the identity of users. All electronic signatures that are successfully created are logged and recorded in the system and are attached to the electronic records b Before an organization establishes, assigns, certifies, or otherwise sanctions an individual s electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual. The procedure has to be defined and executed by the company. This can be enforced with the organization s AD system. Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures. This has to be managed by the company and can be enforced by their AD system c 1. The certification shall be submitted in paper form and signed with a traditional handwritten signature, to the Office of Regional Operations (HFCJ100), 5600 Fishers Lane, Rockville, MD Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer s handwritten signature a 1,2,3 Electronic signatures that are not based upon biometrics shall: 1. Employ at least two distinct identification components such as an identification code and password. ( i ) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual. ( ii ) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components. 2. Be used only by their genuine owners; and 3. Be administered and executed to ensure that attempted use of an individual s electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals. codebeamer requires a User name (ID) and a password to issue each and every electronic signature. All electronic signatures are generated as unique, meaning that authentication is required every time a signature is issued b Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging). codebeamer can be configured so as to make sure that ID codes and passwords need to be changed periodically. This can be enforced via the organization s AD system c Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls. It has to be regulated by the company and measurements have to be taken d Use of transaction safeguards to prevent unauthorized use of passwords and / or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management. Unauthorized access after a number of failed logon attempts can be automatically configured to alert maintenance administration. Notification are sent via . All failed logon attempts are recorded and reports are generated. Further prevention can be enforced with the organization s AD system e Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner. This is outside the scope of use of codebeamer; has to be regulated by the company.

9 codebeamer ALM is built for Medical Device INTLAND Main Benefits of codebeamer Medical ALM codebeamer Medical ALM has been designed for use in the medical industry to support compliance with IEC 62304, IEC & relevant FDA regulations. Manufacturers of medical devices can benefit from significant cost savings both in terms of time and effort, gapless end-to-end traceability, and complete process control to facilitate compliance. The medical template is flexibly configurable and can be customized to suit all internal processes and practices. It also offers document management and reporting features to help prepare for compliance audits. Access to domain knowledge: codebeamer s Medical Project has been developed with domain experts and contains in-depth domain knowledge based on the IEC standard and available practices. codebeamer Medical ALM offers a wealth of medical knowledge, a collaborative development platform, and advanced medical process capabilities to support the development of high quality, reliable medical devices, and to help prepare for compliance audits. For further details please visit our website:

10 INTLAND codebeamer ALM is built for Medical Device codebeamer ALM at a Glance Demand Management l Project & Portfolio Management (PPM) l Requirements Management l Change and Configuration Management l Test and QA Management l Document Management and Versioning l Workflow Management l Web-based Collaboration l

11 Intland Software is a dynamically growing player in the Application Lifecycle Management market. It is our mission to help you achieve higher quality processes in your software development efforts. codebeamer, the Jolt award-winning development suite from Intland Software assists you in managing your requirements and specifications from requirements all the way through to release. Our medical references: Free download: