Working with our customer, we must determine first and foremost – is this considered a medical device? You might be surprised to see that this can be a big issue. In some countries a Patient Lift device is considered an aid for a disabled patient and not a medical device. In other countries it is and must be designed to meet IEC 60601-1 and IEC 62304. Prior to the third edition of IEC 60601-1 (2005), unless a medical device was intended to be used by or under closer supervision of a trained professional, it was not required to be classified as a medical device. This loophole has been closed thus opening up many more devices to be classified as a medical device. These are not specifications for the faint of heart. Read more about some of the specifications that we must be familiar with for getting approval of a medical device with the FDA.
Once we determine that we are designing a medical device we need to make sure that we keep safety in mind throughout the development process. To do that we need to identify the risks and if necessary put in place a Risk Management scheme per ISO 14971 (new to the 2005 edition of IEC 60601-1) and a Quality Management System per ISO 13485 (a stand-alone specification based on ISO 9001 for medical devices).
… identify the stakeholders and assess the risks …
With the contractor, up front we will attempt to identify the stakeholders and assess the risks per ISO 14971:
- Contractor risk of lawsuit – This is not covered under ISO 14971 but part of our risk assessment since our contractor (you) need to be aware of your risks
- Patient
- Caregiver
- Property
- Environment
- Industry
Once the stakeholders are identified we need to identify
- the potential harm
- the probability of the harm
- the consequences of the harm
In the process we create a Risk Management File per ISO 14971 which contains
- Risk Identification
- Risk Management Plan
- Risk analysis
- Risk evaluation
- Risk control
- Traceability for each risk identified to the analysis, evaluation, control and residual risks after the implementation of the plan
- Production and Post Production Support
Post Production support is something that is often overlooked in business plans of startups looking to develop a medical device. IEC 62304 requires the device manufacturer (most likely you) to keep a vigilant watch on the risks that your product might continue to impose upon the public. For example, you may not know that you are
- Required to review similar devices for known hazards
- For SOUP (Software of Unknown Pedigree) like Linux, required to review the errata regularly for possible hazards not previously identified
- Required to verify that the risk control measures are still in place through production
IEC 62304 classifies software into three classes of risk:
- Class C – Death or Serious Injury
- Class B – Non-serious injury
- Class A – No injury or damage to health