We use modern development practices to document the code and the APIs exposed by our microservices. We use tools to automatically generate developer portals. Is this enough when developing software used in a regulated domain? This talk introduces the audience to the particularities of developing medical device software and the regulatory landscape that you must comply with. I’ll focus on the processes and culture that facilitate compliance, without damaging the team velocity and spirit.

1. Delivering Features at High Velocity in
Regulation Intensive Environments
Vlad Știrbu
CompliancePal
Nordic APIs Platform Summit, Stockholm
23.10.2018

2. CompliancePal
What is regulation intensive environment?
Organizations have to adhere to laws,
regulations, guidelines and specifications
relevant to their business.

3. CompliancePal
Laws and regulations
HIPAA: Health Insurance Portability and Accountability Act
GDPR: General Data Protection Regulation
MDR: Medical Device Regulation

4. CompliancePal
Guidelines and specifications
ISO 13485: Quality management systems
ISO 14971: Application of risk management to medical devices
IEC 62304: Software life cycle processes

5. CompliancePal
Software development processes and activities
https://www.medicaldesignbriefs.com/images/stories/MDB/2017/features/MDB-1017-p24_fig1.jpg

6. CompliancePal
Software safety classification
death or serious injuryC
thorough design documentation
and testing
non-serious injuryB design documentation and testing
no injury or damage to healthA
design documentation and testing
not required

7. CompliancePal
medical device

8. CompliancePal
medical device software

9. CompliancePal
Manifesto for agile software development
Individuals and interactions over processes and tools
Working software over comprehensive documentation
Customer collaboration over contract negotiation
Responding to change over following a plan

10. CompliancePal
Compliance
Officer
The regulated environment agile development
Product backlog Sprint backlog Sprint Product
Documentation
Sprint
Snapshot
Risk management
Documentation
Architecture/
Software/API
Archeology

12. CompliancePal
Agile compliance
Git CompliancePal
Developer Compliance
Officer
commit
notification
status
Team chat
problems
view
Backlog
compliance issues
status

13. CompliancePal
“transition... tasks from being implicitly
performed to explicitly scheduled”
Does Agile Kill Innovation, Jan Bosch
https://www.linkedin.com/pulse/does-agile-kill-innovation-jan-bosch/

14. CompliancePal
Agile compliance practices
compliance checks on code commits
continuous risk management
automation
documentation sprint

15. CompliancePal
vlad@compliancepal.eu