Intland s Medical IEC & ISO Template

Transcription

1 Intland s Medical IEC & ISO Template

2 Intland s Medical IEC & ISO Template codebeamer ALM for Medical Device Development Intland s Medical IEC & ISO Template Medical technology development teams are faced with increasing software complexity in high-tech medical device projects. The management of multiple product variants and stringent regulatory standards further increase their challenges. Due to regulations on patient safety, data security, and overall product quality, adequate risk management and compliance are vital for developers of medical technology. IEC Intland s Medical IEC & ISO Template is a preconfigured kit that leverages the advanced capabilities of codebeamer ALM to help you comply with various medical standards and regulations. Used with this template, codebeamer ALM facilitates and accelerates compliance with the international standard IEC 62304, the mandatory regulation for manufacturers of medical devices, as well as IEC and Title 21 CFR Part 11 (FDA). Its advanced features enable a risk-based approach to help comply with ISO codebeamer Medical ALM provides the full functionality of a complex ALM solution. It includes requirements, development and Quality Assurance & test management, as well as comprehensive risk management and variants management features sets. Intland s Medical IEC & ISO Template comes preconfigured with artifacts and workflows to meet the needs of medical technology companies. Severity Catastrophic Major Moderate Likelihood Rare Unlikely Possible Likely IR Almost certain codebeamer ALM is built for Medical Device Development and for Regulatory Compliance (IEC 62304, ISO 14971, US FDA Title 21 CFR Part 11) Minor RR Insignificant IR Inherent Risk RR Residual Risk

3 Intland s Medical IEC & ISO Template Configured for Medical Lifecycles Quality, requirements, design, test, configuration, risk and change management features and all artifacts are preconfigured for medical processes to ensure full traceability and auditability throughout the complete development lifecycle. This greatly facilitates compliance with IEC 62304, ISO 14971, IEC 60601, Title 21 CFR Part 11 (FDA) and other standards. Mature artifact reuse practices and repeatable processes help you cut development and verification time and costs. Variants functionality enables you to manage the parallel development streams of a complex product line. Medical Requirements Review Hub codebeamer ALM s Review Hub (which may be purchased as an add-on) is a powerful tool that helps better satisfy customer needs, and greatly supports compliance audits. It enables you to collect and assign work items for review, and review all changes as well as the impacts of these changes conveniently. Compliance auditors can easily trace changes to specifications, and review all the actions resulting from these changes. Statistics may be simply exported about your reviews to help efficient reporting. Use the Review Hub to manage approvals of all changes to customer specifications with all their relations, and trace their implementation through to testing with minimal effort. Customers, systems, software and architecturerelated trackers are defined to capture and manage all requirements of the medical device. The integrated Traceability Browser shows the dependencies among requirements and risks, as well as all other work item types. A Coverage Browser helps make sure that all your requirements are covered with test cases.

4 Intland s Medical IEC & ISO Template Risk & FMEA codebeamer s medical risk tracker comes with a preconfigured, customizable risk management workflow. A Failure Mode and Effects Analysis (FMEA) template is available to help identify, analyze, prioritize, and plan the mitigation of risks. Risk Matrix Diagrams give you an overview of your overall risk levels. The template fully supports compliance with the risk management stipulations of ISO Medical Wiki The integrated medical wiki fully supports compliance with IEC 62304, as its contents cover the standard s requirements. The medical wiki provides the users of Intland s Medical IEC & ISO Template with domain knowledge and it supports the application and enforcement of rules throughout the entire development lifecycle Intland Software Sales: (EU) , (US)

5 Intland s Medical IEC & ISO Template Medical Document with Templates The document management module is equipped with template documents and process descriptions based on the requirements stipulated by IEC and ISO Medical Product Line with Branching codebeamer ALM s (separately purchased) Variants Package helps you manage the development of multiple product variants. Manage product commonality and variability, unlock efficiencies in product line management, and optimize the reuse of lifecycle artifacts. The Variants Package is a powerful tool that enables you to efficiently manage parallel medical development streams, cutting product development time and costs. Integrated QA & Test QA & Test is integrated in the ALM functionality and uses codebeamer s central repository, letting you conveniently manage testing and quality assurance in a traceable manner. Test cases can be generated automatically from requirements, stored in test sets, and saved in the test case library for reuse. A Test Coverage Browser is available to help you ensure the complete test coverage of your requirements, and to show bidirectional traceability. Release Release in codebeamer ALM enables you to plan your releases (milestones, versions) in a convenient way, to add requirements to sprints using a simple drag-and-drop interface, and to monitor the progress of your processes via statistics and graphs. An interactive Gantt chart helps you plan and manage your releases and sprints. Included in the Variants Package, branching supports multi-stream medical product development processes by allowing you to create development branches off a master development trunk, compare and merge branches, and to create baselines of these branches any time. Upon merging, you ll have granular control over what gets merged and what doesn t. With branching, advanced requirements & test case library management, re-use, and product line management features, the Variants Package greatly simplifies the development of multiple product variations. Branch (BR - ) Comparing Merging Baseline (vx.x) Milestone

6 Intland s Medical IEC & ISO Template Advanced Workflows & Process Enforcement codebeamer ALM s workflow functionality allows you to define and enforce custom processes by configuring your own workflows. You can also ensure granular access control to certain work items, and can easily set up your workflows to automatically create work items if certain conditions are met. For instance, if a requirement with a high safety rating is submitted by an authorized user, the system can be configured to automatically create both a risk and a test case, ensuring these high-risk items are adequately managed. Workflow visualization helps you trace and show development processes, greatly facilitatng compliance audits. Process Guards & FDA-compliant e-signatures Guards with conditions may also be added to workflows, and FDA-compliant e-signatures may be required for certain steps in the process. This helps ensure that all necessary approvals are done by the appropriate members of your team, and that only authorized personnel can change or add items (naturally, all changes are recorded and documented). codebeamer ALM s e-signatures support compliance with Title 21 Code of Federal Regulations Part 11, as they store all the relevant data about user authorization and the e-signature in human readable format. Customer requirements Customer requirements tests System requirements System requirements tests RISK MANAGEMENT Software requirements SW TESTS FMEA Risk control measures Hazardous situations ARCHITECTURAL AND DETAILED DESIGN SW system SW system tests SW integration tests Risk analysis SW Unit SW item SOUP MAINTENANCE / PROBLEM RESOLUTION PROCESSES Change requests Problem tracker Anomalies / Bugs Feedback

7 Intland s Medical IEC & ISO Template Data Analytics and Reporting codebeamer ALM stores all your important production and historical data in its central repository from requirements through to testing and delivery. Its data analytics and reporting features help make sense of all that data to unlock valuable insights. Search and filter data using queries, visualize it using preconfigured charts and diagrams, send automated reports, and analyze data to support decision-making. Using shareable, exportable automatic data visualization enables you to monitor business KPIs effortlessly, letting you oversee, improve and optimize processes. Dashboards and reports with benchmarks, visualized data, and production insights may be simply created and shared with others. Audit Trail Dashboard In addition to advanced queries, filtering, data visualization, and automated reports, codebeamer greatly supports QA analytics & reporting via its Audit Trail Dashboard. The Audit Trail Dashboard helps simplify and accelerate compliance. A lifecycle-wide audit trail is automatically recorded in codebeamer ALM with all changes to your trackers, fields, workflows and transition diagrams, and an overview of current permissions. All this is accessible with just a few clicks using the comprehensive Audit Trail Dashboard. Using the dashboard, you can create an automatically updated widget with all this lifecycle data, and simply export comprehensive reports to accelerate compliance audits Intland Software Sales: (EU) , (US)

8 Compliance with IEC codebeamer functionalities Chapter of IEC Trackers Configuration Items Medical Wiki Document SCM Repositories Reports Test 4 General requirements 4.1 Quality management system Defined in corporate documentation 4.2 Risk management l l 4.3 Software safety classification l l 5 Software development process 5.1 Software development planning l l Software development plan, updates, definition of standards methods and tools. Test and verification planning, risk management, documentation and configuration planning. 5.2 Software requirements analysis l l l l System-Software-requirements definition, risk control measures, risk evaluation and mitigation. 5.3 Software architectural design l l l Architecture requirements, SOUP definition, hardware requirements, risk control measures and verification. 5.4 Software detailed design l l l Design for software units, interface design, software unit implementation, verification and acceptance. 5.5 Software unit implementation and verification l l 5.6 Software integration and integration testing l l Software integration and integration testing, software units integration, test inteagration, verification, regression test, problem resolution process. Design for software units, interface design, software unit implementation, verification and acceptance. 5.7 Software systems testing l l 5.8 Software release l l l l Software release verification, evaluate residual anomalies, documentation task completation report, archive and repeatability of software releases. 6 Software maintenance process 6.1 Establish software maintenance plan l l 6.2 Problem and modification analysis l Feedback documentation, evaluation and monitoring, safety problem reports, change request analysis, CRQ approval, communication to users. 6.3 Modification implementation l l Use established process to implement modification, re-release modified software system.

9 Chapter of IEC Trackers Configuration Items codebeamer functionalities Medical Wiki Document SCM Repositories Reports Test 7 Software risk management process 7.1 Analysis of software contributing to hazardous situations l l Identify software items that could contribute to a hazardous situation and potential causes of contribution to a hazardous situation, evaluate published SOUP anomaly lists and prepare documentation. 7.2 Risk control measures l l Define risk control measures, and implement risk control measures in software development. 7.3 Verification of risk control measures l l Identify software items that could contribute to a hazardous situation and potential causes of contribution to a hazardous situation. 7.4 Risk management of software changes l Analyse changes to medical device software with respect to safety, analyse impact of software changes on existing risk control, perform risk management activities based on analyses. 8 Software configuration management process 8.1 Configuration identification l l Establish means to identify configuration items, identify SOUP, identify system configuration documentation. 8.2 Change control l l Approve change requests (CRQ), implement and verify change, provide means for traceability of changes. 8.3 Configuration status accounting l l 9 Software problem resolution process 9.1 Prepare problem reports l l 9.2 Investigate the problem l l 9.3 Advise relevant parties l l 9.4 Use change control process l l 9.5 Maintain records l l 9.6 Analyse problems for trends l l 9.7 Verify software problem resolution l l 9.8 Test documentation contents l l

10 Compliance with US FDA Title 21 CFR Part 11 Chapter in FDA FDA regulation Original Text Relevant codebeamer features Subpart B Electronic Records a b c d e f g h i Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records. The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Protection of records to enable their accurate and ready retrieval throughout the records retention period. Limiting system access to authorized individuals. Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying. Use of operational system checks to enforce permitted sequencing of steps and events, as appropriate. Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand. Use of device (e.g. terminal) checks to determine, as appropriate, the validity of the source of data input or operational instruction. Determination that persons who develop, maintain, or use electronic record/electronic signature systems have the education, training, and experience to perform their assigned tasks. All artifacts/records in codebeamer can be tracked and traced via history data. Permission control can be used to ensure only those with authorization can access data. All documents in codebeamer can be exported to readable industry standard formats. ReqIF and MS Office integration is fully supported, including export and roundtrip export-import functionality. All data is stored in the database (MySQL or Oracle) that can be regularly saved and maintained even during software upgrades. Electronic records with electronic signatures are stored in the database. System administration security rules are fully supported by codebeamer. All administrative changes are recorded. All date and time information regarding creating, modifying or deleting artifacts in codebeamer are logged. Full change history is saved (what was edited by whom, at what point in time). Log files can be exported and supervised by authorized administrators. Electronic signatures attached to records are maintained. Using workflows, a fixed sequence of steps and events as well as status transition rules can be set up in codebeamer in order to enforce certain processes. Security experts are contracted to test codebeamer. Industry standard user authentication, single-sign-on, and role based access is provided to manage system access and record modification. Electronic signatures can be enforced. Guards with workflows are provided for data source validation. It is the responsibility area of the company that is in charge of the maintenance and management of the system. This documentation is a part of FDA 21 CFR QM system docs.

11 Chapter in FDA FDA regulation Original Text Relevant codebeamer features Subpart B Electronic Records j k 1.) and 2.) a b The establishment of, and adherence to, written policies that hold individuals accountable and responsible for actions initiated under their electronic signatures, in order to deter record and signature falsification. Use of appropriate controls over systems documentation including: Adequate controls over the distribution of, access to, and use of documentation for system operation and maintenance. Revision and change control procedures to maintain an audit trail that documents time sequenced development and modification of systems documentation. Signature manifestation Signed electronic records shall contain information associated with the signing that clearly indicates all of the following: 1. The printed name of the signer; 2. The date and time when the signature was executed; and 3. The meaning (such as review, approval, responsibility, or authorship) associated with the signature. The items identified in paragraphs (a)(1), (a)(2), and (a)(3) of this section shall be subject to the same controls as for electronic records and shall be included as part of any human readable form of the electronic record (such as electronic display or printout). Signature record linking Electronic signatures and handwritten signatures executed to electronic records shall be linked to their respective electronic records to ensure that the signatures cannot be excised, copied, or otherwise transferred to falsify an electronic record by ordinary means. It is the responsibility area of the company that is in charge of the maintenance and management of the system. Thus, it is not a system requirement. All documents are managed by codebeamer s integrated document management system. The same rules and system features are applicable for documents that are marked under e. (i.e. all changes, modifications etc. are recorded and logged). Revision and change control are available in the document management subsystem, documents are stored in the active database. Electronic signature in codebeamer contains the following data: The printed name of the signer; The date and time when the signature was executed; and The meaning (such as review, approval, responsibility, or authorship) associated with the signature. Electronic signature records can be displayed in human readable format. Electronic signatures are linked to the adequate electronic record (artifact). They can not be removed, deleted, or attached to another artifact.

12 Compliance with US FDA Title 21 CFR Part 11 Chapter in FDA FDA regulation Original Text codebeamer compliance Subpart C Electronic Signature a b Each electronic signature shall be unique to one individual and shall not be reused by, or reassigned to, anyone else. Before an organization establishes, assigns, certifies, or otherwise sanctions an individual s electronic signature, or any element of such electronic signature, the organization shall verify the identity of the individual. Persons using electronic signatures shall, prior to or at the time of such use, certify to the agency that the electronic signatures in their system, used on or after August 20, 1997, are intended to be the legally binding equivalent of traditional handwritten signatures. codebeamer requires a User name (ID) and password to issue electronic signatures. All electronic signatures are generated as unique. The same signature can not be generated twice. User ID and password are required to authenticate the identity of users. All electronic signatures that are successfully created are logged and recorded in the system and are attached to the electronic records. The procedure has to be defined and executed by the company. This can be enforced with the organization s AD system. This has to be managed by the company and can be enforced by their AD system c 1. The certification shall be submitted in paper form and signed with a traditional handwritten signature, to the Office of Regional Operations (HFCJ100), 5600 Fishers Lane, Rockville, MD Persons using electronic signatures shall, upon agency request, provide additional certification or testimony that a specific electronic signature is the legally binding equivalent of the signer s handwritten signature.

13 Chapter in FDA FDA regulation Original Text codebeamer compliance Subpart C Electronic Signature a 1,2,3 Electronic signatures that are not based upon biometrics shall: 1. Employ at least two distinct identification components such as an identification code and password. ( i ) When an individual executes a series of signings during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual. ( ii ) When an individual executes one or more signings not performed during a single, continuous period of controlled system access, each signing shall be executed using all of the electronic signature components. codebeamer requires a User name (ID) and a password to issue each and every electronic signature. All electronic signatures are generated as unique, meaning that authentication is required every time a signature is issued. 2. Be used only by their genuine owners; and b c d e 3. Be administered and executed to ensure that attempted use of an individual s electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals. Ensuring that identification code and password issuances are periodically checked, recalled, or revised (e.g., to cover such events as password aging). Following loss management procedures to electronically deauthorize lost, stolen, missing, or otherwise potentially compromised tokens, cards, and other devices that bear or generate identification code or password information, and to issue temporary or permanent replacements using suitable, rigorous controls. Use of transaction safeguards to prevent unauthorized use of passwords and /or identification codes, and to detect and report in an immediate and urgent manner any attempts at their unauthorized use to the system security unit, and, as appropriate, to organizational management. Initial and periodic testing of devices, such as tokens or cards, that bear or generate identification code or password information to ensure that they function properly and have not been altered in an unauthorized manner. codebeamer can be configured so as to make sure that ID codes and passwords need to be changed periodically. This can be enforced via the organization s AD system. It has to be regulated by the company and measurements have to be taken. Unauthorized access after a number of failed logon attempts can be automatically configured to alert maintenance administration. Notification are sent via . All failed logon attempts are recorded and reports are generated. Further prevention can be enforced with the organization s AD system. This is outside the scope of use of codebeamer; has to be regulated by the company.

14 Medical IEC Template for codebeamer ALM The main benefits of using codebeamer ALM and Intland s Medical IEC & ISO Template codebeamer ALM and Intland s Medical IEC & ISO Template have been designed for use in the medical industry to support compliance with IEC 62304, IEC 60601, ISO 14971, and relevant FDA regulations. Manufacturers of medical devices can benefit from significant cost savings both in terms of time and effort, gapless end-to-end traceability, and complete process control to facilitate compliance. The medical template is flexibly configurable and can be customized to suit all internal processes and practices. It also offers document management, change control, and reporting features to help prepare for compliance audits. Access to domain knowledge: Intland s Medical IEC & ISO Template has been developed with domain experts and contains in-depth domain knowledge based on the IEC and ISO standards and available practices. The combination of codebeamer ALM and Intland s Medical IEC & ISO Template offers a wealth of medical knowledge, a collaborative development platform, and advanced medical process capabilities to support the development of high quality, reliable medical devices and to tackle compliance audits with ease. Requirements Risk Web-based Collaboration Demand Test & QA Workflow with BPM Capabilities Change & Configuration Document & Versioning Audit Trail Dashboard Intland Software Sales: (EU) , (US)

15 codebeamer s ALM comprehensive feature set covers the entire development lifecycle codebeamer ALM is successfully used by: Download our Medtronic case study to learn how the world s largest medical technology company reaches compliance in a scaled Agile development environment using codebeamer ALM

16 Intland s Tool Validation Package Template Intland s Tool Validation Package Template is a separately purchased add-on that helps accelerate and simplify tool verification & validation processes when using codebeamer ALM in safety-critical development. It contains all the assets (use cases, and related manual and automated test cases) that you or any independent auditor will need for tool qualification purposes. For more information, visit: For more details on how codebeamer ALM supports medical device development, and to request Intland s Medical IEC & ISO Template for evaluation, please visit our website: or contact our sales team at: sales@intland.com Alternatively, you can start your free trial of codebeamer ALM right away: