Qualifying Your Vendor
Every medical device manufacturer marketing their device in the US must comply with regulations such as 21 CFR 820.50 Subpart E Purchasing Controls. This applies to all outside components they wish to incorporate into their device, including software. In part, this requires the manufacturer to:
“(1) Evaluate and select potential suppliers, contractors, and consultants on the basis of their ability to meet specified requirements, including quality requirements. The evaluation shall be documented.”
In a practical sense, this means that if they want to build on top of third-party software such as an operating system, they will need to provide their quality or purchasing department information about the development environment of that software. The goal is to be sure that the software is appropriate for the intended use of the medical device itself. The amount of scrutiny a particular component (software or otherwise) is given is determined by the effect its failure would have on the patient using it. A medical device manufacturer may have an in-house questionnaire that they fill out for all of their suppliers. These are often not geared toward software and can be lacking, putting extra pressure on the (poor) engineer that is charged with proving the quality of the software they are about to incorporate into their life-saving device. Without a stamp of approval from the purchasing department, that software isn’t going into any product. A software vendor experienced in the healthcare market will have prepared documentation with this task in mind.