medical apps: 5 steps to ce-mark

Medical AppsDevelop compliant with laws & standards Document efficiently Safely pass audits

Prof. Dr. Christian Johner

You learn the five steps and learn to know the … ▪ regulations (e.g. laws) to comply with, ▪ documents you have to write / compile, ▪mistakes you want to avoid, !in order to place your medical app on the market.

Step 1Evaluate whether you app is a medical device at all

Medical Device No Medical Device

For diagnostic purposes For documentation only

For therapeutic purposes For education/training only

For monitoring e.g. of vital parameters Not specifically for healthcare

Medical Device: Yes or No?

Medical Device No Medical Device

For diagnostic purposes For documentation only

For therapeutic purposes For education/training only

For monitoring e.g. of vital parameters Not specifically for healthcare

Medical Device No Medical Device

Calculates drug dose Captures data for a clinical study

Controls a diagnostic or therapeutic device Is a digital version of a book

Shows radiology images Digital magnifying (general scope)

Visualizes data for ICU monitor Game for health education

Medical Device: Yes or No?

Examples

Unsecure whether your app is a medical device?

Just ask us!

www.johner-institut.de/kontakt

Step 2Understand the regulations (if your app is a medical device only)

The Medical Device Directives (MDD, 93/42/EWG) and thereby the nationals laws (e.g. MPG) require:

MDD

The Medical Device Directives (MDD, 93/42/EWG) and thereby the nationals laws (e.g. MPG) require:

MDD

1. Risk Management

The Medical Device Directives (MDD, 93/42/EWG) and thereby the nationals laws (e.g. MPG) require:

MDD

1. Risk Management

2. Software-Lifecycle processes, Verification and Validation

The Medical Device Directives (MDD, 93/42/EWG) and thereby the nationals laws (e.g. MPG) require:

MDD

1. Risk Management

2. Software-Lifecycle processes, Verification and Validation3. Usability

Medical Device Directivewwwhttp://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:1993L0042:20071011:EN:HTML

The Medical Device Directives (MDD, 93/42/EWG) and thereby the nationals laws (e.g. MPG) require:

MDD

1. Risk Management

2. Software-Lifecycle processes, Verification and Validation3. Usability

Take these requirements seriously!

Authorities will assume compliance with these “essential requirements” if you stick to the respective standards

MDD

ISO 14971 Risk Management

Software-Lifecycle Processes, Verification and Validation

IEC 62304Usability

IEC 62366

IEC 62304 requires a Quality Management System itself:

MDD

ISO 14971 Risk Management

Software-Lifecycle Processes, Verification and Validation

IEC 62304Usability

IEC 62366

IEC 62304 requires a Quality Management System itself:

MDD

ISO 14971 Risk Management

Software-Lifecycle Processes, Verification and Validation

IEC 62304Usability

IEC 62366

QM-System ISO 13485

Read these standards!

Read these standards!

✓ISO 13485

Read these standards!

✓ISO 13485

✓ISO 14971

Read these standards!

✓ISO 13485

✓ISO 14971

✓IEC 62304

Read these standards!

✓ISO 13485

✓ISO 14971

✓IEC 62304

✓IEC 62366

Step 3Establish a QM-System (not trivial)

Describe…

Describe…▪ your organization, quality politics and quality gaols

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources▪ your processes e.g.:

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources▪ your processes e.g.:− (Software-)Development and Maintenance

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources▪ your processes e.g.:− (Software-)Development and Maintenance− Hotline, Support

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources▪ your processes e.g.:− (Software-)Development and Maintenance− Hotline, Support− Risk Management

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources▪ your processes e.g.:− (Software-)Development and Maintenance− Hotline, Support− Risk Management

▪ how you improve your QM-System (measurement, internal audits, management reviews etc.)

Describe…▪ your organization, quality politics and quality gaols▪ how you control your documents▪ how you manage your (Human) Resources▪ your processes e.g.:− (Software-)Development and Maintenance− Hotline, Support− Risk Management

▪ how you improve your QM-System (measurement, internal audits, management reviews etc.)

As a result you will have !▪SOPs (process descriptions) ▪Work Instructions ▪Templates, Forms ▪Check lists !as word documents, PDFs or web pages

▪ Do you have any questions? Do you need support? ▪ Are you looking for example documents or templates you

just have to adapt? ▪ Do you want to be sure that you will pass your next

audit?

▪ Do you have any questions? Do you need support? ▪ Are you looking for example documents or templates you

just have to adapt? ▪ Do you want to be sure that you will pass your next

audit?

Then ask us!www.johner-institut.de/kontakt

Step 4Write and compile your Technical Documentation (according to your QM-System)

Risk M

anag

emen

t

Usab

ility

Softw

are-D

evelo

pmen

t

Clinic

al Ev

aluat

ion

Othe

r

Risk M

anag

emen

t

Usab

ility

Softw

are-D

evelo

pmen

t

Clinic

al Ev

aluat

ion

Othe

r

These are the files you have to compile

Risk M

anag

meen

t

Usab

ility

Softw

are-D

evelo

pmen

t

Clinic

al Ev

aluat

ion

Othe

r

Risk M

anag

meen

t

Usab

ility

Softw

are-D

evelo

pmen

t

Clinic

al Ev

aluat

ion

Othe

r

Example: Software-Development ▪ Software Development Plan ▪ Software Requirements ▪ Software Architecture ▪ Code, Code Reviews ▪ Static Code Analysis ▪ Unit, Integration and System

Tests ▪ Software Validation ▪ Software Release

Step 5Declare conformity of your product and submit Technical Documentation to your notified body (depends on class of your product)

▪ You(!) declare – following a conformity assessment procedure – the conformity of your medical device with the essential requirements according to MDD.

▪ You(!) declare – following a conformity assessment procedure – the conformity of your medical device with the essential requirements according to MDD.

▪ Depending on the class (I, IIa, IIb, III as defined by MDD) you have to submit the Technical Documentation to your notified body (e.g. TÜV, bsi, mdc).

▪ You(!) declare – following a conformity assessment procedure – the conformity of your medical device with the essential requirements according to MDD.

▪ Depending on the class (I, IIa, IIb, III as defined by MDD) you have to submit the Technical Documentation to your notified body (e.g. TÜV, bsi, mdc).

▪ That’s it!

Frequent Traps

As we are (lead) auditors, consultants and developers ourselves we know the challenges app developers are facing frequently:

As we are (lead) auditors, consultants and developers ourselves we know the challenges app developers are facing frequently:▪ Risk management file is incomplete or incorrect. Terms as

hazard and hazardous situation are mistaken.

As we are (lead) auditors, consultants and developers ourselves we know the challenges app developers are facing frequently:▪ Risk management file is incomplete or incorrect. Terms as

hazard and hazardous situation are mistaken.

▪ Principals of a professional software engineering are ignored – in particular during maintenance

As we are (lead) auditors, consultants and developers ourselves we know the challenges app developers are facing frequently:▪ Risk management file is incomplete or incorrect. Terms as

hazard and hazardous situation are mistaken.

▪ Principals of a professional software engineering are ignored – in particular during maintenance

▪ The QM-System does not cover all requirements as described in ISO 13485

As we are (lead) auditors, consultants and developers ourselves we know the challenges app developers are facing frequently:▪ Risk management file is incomplete or incorrect. Terms as

hazard and hazardous situation are mistaken.

▪ Principals of a professional software engineering are ignored – in particular during maintenance

▪ The QM-System does not cover all requirements as described in ISO 13485

▪ The company does not follow the own “rules” according to QM-System) appropriately

As we are (lead) auditors, consultants and developers ourselves we know the challenges app developers are facing frequently:▪ Risk management file is incomplete or incorrect. Terms as

hazard and hazardous situation are mistaken.

▪ Principals of a professional software engineering are ignored – in particular during maintenance

▪ The QM-System does not cover all requirements as described in ISO 13485

▪ The company does not follow the own “rules” according to QM-System) appropriately

▪ Documents are not up-to-date and or not approved

We love to support you!

▪Write and review your documents ▪ Establish your lean QM-System ▪ Prepare you for audit ▪ Answer your questions

We love to support you!

▪Write and review your documents ▪ Establish your lean QM-System ▪ Prepare you for audit ▪ Answer your questions

We love to support you!

We help you to pass your audit – safely, fast and cost efficient – and to develop safe and successful apps.

▪Write and review your documents ▪ Establish your lean QM-System ▪ Prepare you for audit ▪ Answer your questions

We love to support you!

www.johner-institut.de/kontakt

We help you to pass your audit – safely, fast and cost efficient – and to develop safe and successful apps.

Prof. Dr. Christian Johner

All our 70+ customers passed audit successfully (with the first attempt)

Prof. Dr. Christian Johner

All our 70+ customers passed audit successfully (with the first attempt)

„Das Resumee der Auditoren war, dass wir in Zukunft mit unserem eingeschlagenen Weg über ein sehr schönes, kleines, nicht teures QA-System verfügen werden, das auch genau zu uns passt. Das hat uns sehr gefreut, und ich möchte Ihnen nochmals danken, denn ohne die Workshops mit Ihnen wäre das Ergebnis nicht so gut ausgefallen.“ (Regina Preysing, Qualitätsmanagerin BodyTel)

Prof. Dr. Christian Johner

All our 70+ customers passed audit successfully (with the first attempt)

„Das Resumee der Auditoren war, dass wir in Zukunft mit unserem eingeschlagenen Weg über ein sehr schönes, kleines, nicht teures QA-System verfügen werden, das auch genau zu uns passt. Das hat uns sehr gefreut, und ich möchte Ihnen nochmals danken, denn ohne die Workshops mit Ihnen wäre das Ergebnis nicht so gut ausgefallen.“ (Regina Preysing, Qualitätsmanagerin BodyTel)

„Mit der praxisnahen Hilfe von Professor Johner und seinem Team konnten wir in wenigen Monaten ein ‚lebbares' QM-System für unser Unternehmen etablieren und erfolgreich nach ISO 13485 zertifizieren. Die angenehme Zusammenarbeit und die Tatsache, dass wir das Projekt in der geplanten Zeit und den geplanten Kosten abschließen konnten, schätzen wir sehr.“ (Dominik Blei, Entwicklungsleiter Gesellschaft für Patientenhilfe)

Some of your customers (from global corporation to 4 person startup)

Johner Institut GmbH Villa Rheinburg Reichenaustr. 1 78467 Konstanz !+49 (700) 697 126 40 mail@johner-institut.de www.johner-institut.de/kontakt

Johner Institut GmbH Villa Rheinburg Reichenaustr. 1 78467 Konstanz !+49 (700) 697 126 40 mail@johner-institut.de www.johner-institut.de/kontakt

Complimentary E-Book: www.johner-institut.de

Johner Institut GmbH Villa Rheinburg Reichenaustr. 1 78467 Konstanz !+49 (700) 697 126 40 mail@johner-institut.de www.johner-institut.de/kontakt

Complimentary E-Book: www.johner-institut.de

Contact us!