title: The integration of the risk management process with the lifecycle of medical device software.
abstract: OBJECTIVE
  The application of software in the Medical Device (MD) domain has become central to the improvement of diagnoses and treatments. The new European regulations that specifically address software as an important component of MD, require complex procedures to make software compliant with safety requirements, introducing thereby new challenges in the qualification and classification of MD software as well as in the performance of risk management activities. Under this perspective, the aim of this paper is to propose an integrated framework that combines the activities to be carried out by the manufacturer to develop safe software within the development lifecycle based on the regulatory requirements reported in US and European regulations as well as in the relevant standards and guidelines.
  
  
  METHODS
  A comparative analysis was carried out to identify the main issues related to the application of the current new regulations. In addition, standards and guidelines recently released to harmonise procedures for the validation of MD software have been used to define the risk management activities to be carried out by the manufacturer during the software development process.
  
  
  RESULTS
  This paper highlights the main issues related to the qualification and classification of MD software, providing an analysis of the different regulations applied in Europe and the US. A model that integrates the risk management process within the software development lifecycle has been proposed too. It is based on regulatory requirements and considers software risk analysis as a central input to be managed by the manufacturer already at the initial stages of the software design, in order to prevent MD failures.
  
  
  CONCLUSIONS
  Relevant changes in the process of MD development have been introduced with the recognition of software being an important component of MDs as stated in regulations and standards. This implies the performance of highly iterative processes that have to integrate the risk management in the framework of software development. It also makes it necessary to involve both medical and software engineering competences to safeguard patient and user safety.
authors.affiliation: Fabrizio Pecoraro, National Research Council, Institute for Research on Population and Social Policies, Via Palestro 32, 00185 Rome, Italy, E-mail: f.pecoraro@irpps.cnr.it.
authors.forename: F
authors.initials: F
authors.lastname: Pecoraro
authors.forename: D
authors.initials: D
authors.lastname: Luzi
mesh_terms: D004868:Equipment Failure; D004869:Equipment Safety; D005060:Europe; D006801:Humans; D066192:Manufacturing Industry / Q000331:legislation & jurisprudence*; D009313:National Health Programs / Q000331:legislation & jurisprudence*; D058996:Quality Improvement / Q000331:legislation & jurisprudence*; D012308:Risk Management / Q000331:legislation & jurisprudence* / Q000458:organization & administration*; D012984:Software / Q000331:legislation & jurisprudence*; D012985:Software Design; D012986:Software Validation
keywords: Medical device software; regulatory marketing procedures; risk management; software lifecycle; software safety