{"id":4905,"date":"2025-01-09T10:50:25","date_gmt":"2025-01-09T09:50:25","guid":{"rendered":"https:\/\/www.bayoomed.com\/?post_type=news&p=4905"},"modified":"2025-01-09T12:18:35","modified_gmt":"2025-01-09T11:18:35","slug":"navigating-the-mdr-jungle","status":"publish","type":"news","link":"https:\/\/www.bayoomed.com\/en\/news\/navigating-the-mdr-jungle\/","title":{"rendered":"Navigating the MDR jungle"},"content":{"rendered":"

Key Insights for Medical Software Development<\/h2><\/h2><\/div>

The European Medical Device Regulation (MDR) is a complex landscape with many regulations and hidden challenges. We have navigated this terrain well and developed innovative, compliant medical software solutions.<\/p>\n

Thanks to our experience with products such as MyIUS (a certified app for monitoring bleeding patterns and managing hormonal intrauterine systems), Companion Med (a combination app and breathalyzer to help patients maintain abstinence) and NeoDoppler (a device for monitoring cerebral blood flow in premature babies), we have equipped ourselves for the MDR environment.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

The challenges under MDR<\/h3><\/h3><\/div>

Developing medical software under MDR is akin to traversing a dense rainforest\u2014fraught with obstacles but full of opportunities for those prepared with the right tools. Here\u2019s how we\u2019ve learned to navigate the most challenging aspects:<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i>
UDI system and QMS integration<\/span><\/div><\/div><\/div><\/div>

Implementing a Unique Device Identification (UDI) system is not just a compliance task\u2014it needs to be seamlessly integrated into the Quality Management System (QMS) and, ideally, into the build pipeline. This integration minimizes manual work and ensures consistency.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i>

Unannounced audits<\/p><\/div><\/div><\/div><\/div>

Being prepared for unannounced audits is essential. Establish Standard Operating Procedures (SOPs) that outline how to act in such cases: provide a comfortable environment, offer refreshments, and promptly assemble your experts to address auditors\u2019 questions. This preparation helps maintain composure and efficiency during audits.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i>
Clinical evaluation<\/div><\/div><\/div><\/div>

Clinical evaluations under MDR require demonstrable safety and performance endpoints, which can be challenging to substantiate retrospectively. Establishing equivalence, especially for software, often necessitates a deep dive into the core algorithm. Be prepared for thorough scrutiny if you choose this path. <\/span><\/p>\n

It\u2019s insufficient to rely solely on a single scientific database. Utilize diverse scientific publication databases to ensure comprehensive coverage and avoid overlooking critical studies.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i>
Cybersecurity measures<\/div><\/div><\/div><\/div>

Auditors expect state-of-the-art cybersecurity measures, including vulnerability scans and penetration tests, even if these are not explicitly required. It is advisable to implement these measures proactively.<\/p>\n

The MDCG 2019-16 rev.1 guideline provides a framework that emphasizes the classic risk management cycle: Plan – Analyze – Evaluate – Mitigate <\/span>.<\/p>\n

Additionally, FDA guidance offer more detailed examples and can serve as valuable extensions.<\/span><\/p>\n

The level of detail in an inspection depends on the auditor\u2019s expertise. If they focus on cybersecurity, be prepared for detailed discussions on risk scores. We have found that using the Common Vulnerability Scoring System (CVSS) has been satisfactory for auditors so far.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i>
Usability and risk management<\/div><\/div><\/div><\/div>

Usability studies and risk management are central to MDR compliance, even though usability is only mentioned in the MDR in the context of Post-Market Surveillance (PMS). Auditors are increasingly focusing on documentation and traceability and require that all measures – even best practices – are explicitly documented. Keep the original records of your suppliers as they might be requested for further inspections.<\/p>\n

This iterative process extends over the entire product life cycle. A one-page summary of tests carried out with a small group is insufficient; comprehensive documentation is required.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/i>
Post-Market Surveillance<\/div><\/div><\/div><\/div>

For software, post-market monitoring includes collecting data from support channels, monitoring the software bill of materials (SBOM), crash reports and compatibility checks with new operating systems or devices. Changes to SOUP (Software of Unknown Provenance) components or the underlying operating systems occur frequently and require constant vigilance. The more your product gains importance on the market, the more feedback you can expect, which requires thorough documentation and analysis.<\/p>\n

Trend analysis and effective data collection methods are essential for producing the Periodic Safety Update Report (PSUR) and maintaining compliance. Selecting the right statistical methods is critical. Recommended methods include Weibull analysis (as recommended in ISO 24971), Nelson’s rules (as recommended in ISO\/TR 20416), the Mann-Kendall test or the Neumann trend test (for normally distributed populations).<\/p>\n<\/div><\/div><\/div><\/div><\/div>

Survival tips for the MDR landscape<\/h3><\/h3><\/div>