IEC 62304 Medical software standard

[zogtrog 1]

I am looking for some advice. I have managed to land a new greenfield job to write some medical software but it has to be written to the IEC 62304 standard. I have previously written medical applications, but never to this particular standard.

Object pascal is my go to language because of it's versatility and ease of readability and rapid application development. In my gut I feel that object pascal is a 'safer language' to program in vs C++ for example when it comes to writing safety critical code.

However I can't find any examples of programs or applications being written to this standard in object pascal for medical devices.  I am worried if I started development in object pascal that because there will be an accreditation process, that the software I have written would failed due to the accreditors being unfamiliar with

object pascal. Would I be be better off using C++ in rad developer studio in order to get through the accreditation process for example ?

Please could someone who has knowledge of this standard give me a few pointers.

 

[Sherlock 663]

There are plenty of applications created with Delphi, that are conform with 62304. My own application for example. 62304 does not demand the use of certain languages, it does however require extensive documentation. Documentation you should have anyway... Have you read anything concerning this standard? Wikipedia grants us a small glance at the implications: https://en.wikipedia.org/wiki/IEC_62304 I would suggest to consult more in depth literature and courses however. The subject is not trivial, especially the risk based decision model, that should be used in almost all aspects of the software life cycle. Auditors or accreditors as you call them, will not read your source code, as that is proprietary to you and your company. They will however read the entire technical documentation.

Most important is the market you want to sell your product, if it is Europe, you will need more that IEC 62304. You will need to adhere to the medical device regulation (MDR 2017/745) and that means you'll need to establish a company wide quality management system such as the ISO 13485. And you'll need certification before selling anything. All in all this will swallow up a ton of money before you can even start thinking about generating any revenue.

[Rollo62 536]

I think the kind of language is the least problem you will face.
Here is a short summary of the current changes, unfortunately in German, but I think it might help anyway.

You will have to do a lot of documentation, tests and verifications around the code, where the "safety" of a language is mostly defined by how you organize and implement your apps and workflows.

 

[Sherlock 663]

@Rollo62 HA! Nice! Johner Institute is my helper to get through this tedious process I can really recommend them.

[Sherlock 663]

I should correct my statement as to what is needed to market: Most important is the declaration of conformity, and how this was obtained, the "conformity assessment route". There are many ways to reach conformity, but some are actually the same... I have a german link to explain further...not english, sorry: https://www.johner-institut.de/blog/tag/konformitatsbewertung/

[Rollo62 536]

3 hours ago, Sherlock said:

..  if it is Europe, you will need more that IEC 62304. You will need to adhere to the medical device regulation (MDR 2017/745) and that means you'll need to establish a company wide quality management system such as the ISO 13485.  ...

That is pretty much true ( for Europe and still UK ).

Maybe the first question should be: For which countries(s) do you want to apply conformity, the IEC 62304 itself should be valid pretty much world-wide.

For USA, Australia, Japan, ... I have no idea howto reach conformity for medical software, only that this is a completely different process.

 

[zogtrog 1]

Thank you all for the very helpful replies!

Just one further hypothetical question for a small medium enterprise, employing 12 people that's making a smart watch which monitors cardiac rhythm's, what's a ball park figure for the amount of money it's going to take to get the watch released under the IEC 62304 standard ?

 

[Sherlock 663]

That watch is a medical device, or rather it should be. Because in the end it is what the manufacturer says it is (intended use). So if you create a smart watch that monitors cardiac rhythms you have to formulate its intended use carefully. For example you might state it should be used by athletes and those who would like to be to keep an eye on their heart  - then you're almost golden... almost, because you'll have to deal with foreseeable misuse, someone with a history of pathologic arrhythmia might think it clever to use this watch to warn them when something really bad happens to their heart - but since the watch or algorithms where designed with healthy users in mind it'll either alert constantly or never (I'm not really fit with cardiology, so I can't think of realistic examples). There is a lot of thought that has to go into this. And more standards...because this is a piece of hardware, you'll need to look into IEC 60601-1 and its more detailed offspring. I am sure however that someone has told your boss about all this or that he has asked someone about it.

 

As to your last question: The IEC 62304 is "merely" a software standard and to understand it fully you'll need to invest some time and/or take some classes such as this https://www.bsigroup.com/en-GB/medical-devices/training/Introduction-to-Medical-Device-Software-Training/  the cost of this particular course should give you an indication as to where the trip is going. Calculate roughly the same for a 13485 course - per person attending, mind you. Then you'll definitely need to know and use the IEC 14971, there are courses too i.e. https://www.bsigroup.com/en-GB/medical-devices/training/iso-14971-2019-risk-management-for-medical-devices/ Then your company should be fit to give it a go. By that time you have to find and auditor. That is a notified body (directly or indirectly accredited and certified by the government) who will check all documentation as I stated earlier. And they don't do this out of the goodness of their heart. Calculate at least 10k€ for this, once a year for the rest of the companies life. All in all prepare to invest around 50 k€ in "compliance" alone. Another really good summation can be found here: https://www.cognidox.com/medical-device-development-guide

[Rollo62 536]

Ok, I understand you have to pass medical directive, because your customer needs it.

 

But there is probably a "grey zone" for such products too, were you could try to convince your customer.

For example: Sennheiser and I think BeyerDynamics too, they have some items pretty much usable as "hearing-aids" in their portfolio.
They explain such function, but they clearly not define them as "a medical device" as a main purpose.

Usually the typical hearing aids would have to fall under MD, with all the consequences.

https://majorhifi.com/sennheiser-reveals-conversation-clear-plus-hearing-aids/

https://www.sennheiser-hearing.com/de-DE/p/conversation-clear-plus/

DeclarationOfConformity

 

Maybe your product can find such a "grey"-path too ?

Of coarse competitors of hearing-aids might find ways to sue against such products.

[Sherlock 663]

2 hours ago, Rollo62 said:

Of coarse competitors of hearing-aids might find ways to sue against such products.

Only if and when Sennheiser chooses to call them hearing aids themselves, but then they might get questions from other folks too. So I'm sure they will avoid using the term wherever they can....at least until they have all the necessary documentation. I mean 849 bucks is a steep price for ear buds, but quite competitive for mid-level hearing aids.

[zogtrog 1]

Thanks very much for all the replies. All the information was highly useful. I am starting my new job in about 3 weeks.

I think it is probably very important to work with advice from a consultancy company right from the get go just make sure your not screwing anything up especially if you are new to developing for medical devices.

[Sherlock 663]

12 hours ago, zogtrog said:

I think it is probably very important to work with advice from a consultancy company right from the get go just make sure your not screwing anything up especially if you are new to developing for medical devices.

That is a very good attitude and will most likely prevent this endeavor from failing. This is one of the very few examples where I actually value consultants....