Digital Health & Checklists - Everyone wants one!

Everyone seems to be asking for a checklist when developing a digital app, especially if regulatory approval is necessary to commercialize, so here were go, I am including checklists, I personally like the term aide-memoire, so that you can facilitate, and prioritize your software development efforts, risk management, and usability.

Planning?

1. Have you created a software development plan?
2. Are the different software development phases defined in a software development plan (SDP)?
3. Are the deliverables for each phase of software development defined in the SDP??
4. Are milestones defined??
5. Is traceability of the requirements ensured for audits and risk control measures??
6. Have you defined the acceptance criteria for the verification of the deliverables?
7. Does the documentation in the SDP correspond to the progress of the project??
8. Are the system requirements referenced in the SDP?

Software Requirements?

1. Are the system requirements (including the risk control requirements) included in the software requirements?
2. Are the software requirements not mutually contradictory?
3. Are the software requirements formulated to avoid ambiguity?
4. Are the software requirements formulated to enable the definition of test criteria and execution of tests that will determine whether the test criteria are fulfilled?
5. Can the software requirements be clearly identified??
6. Can the software requirements be traced back to system requirements?
7. Was the risk analysis for the digital health product (SaMD or SiMD) re-evaluated after the definition of the software requirements and modified if necessary?
8. Were the system requirements re-evaluated after the definition of the software requirements and modified if necessary?

Software Release?

1. Is the software up-to-date (latest version)?
2. Have all errors in the error list been corrected?
3. Are the software anomalies documented and do not lead to critical errors?
4. Has debugging and test code been removed from the software??
5. Backup completed?
6. Have configuration statuses been created that include all components?
7. Has the installation guide been created?
8. Have the copyright, license, and legal documents been reviewed?
9. Is the software release documentation ready to go?

Usability?

1. Has the intended purpose of the software product been determined and documented?
2. Have the user profile and operating environment been determined and documented?
3. Have the following points been determined and documented in the specification for the application: (Intended medical indication; Intended patient group; Body part or tissue type; Intended user profile; Intended usage conditions; and Modes of operation)?
4. Have risk control measures been defined and documented for unacceptable risks??
5. Have the safety-relevant functions been defined and itemized??
6. Have the main operating functions been defined and itemized?
7. Has the usability validation plan been created??
8. Is the design of the user interface documented??
9. Is the usability verification documented??
10. Is the usability validation documented?
11. If training is necessary: Have the training materials been created??
12. Are the usability requirements for the software product documented as input to the system requirements?
13. Is the application of the software product specified and documented in the usability engineering file?
14. Are the frequently used functions involving user interaction with the software product defined and documented in the usability engineering file?
15. Have the safety-relevant properties been identified and documented in the usability engineering file?
16. Have the foreseeable hazards, hazardous situations, and related severity been identified and documented in the usability engineering file?
17. Have the main operating functions been identified and documented in the usability engineering file?
18. Are testable requirements provided for usability verification in the usability specification??
19. Are testable requirements provided for the main operating functions in the usability specification?
20. Have the usage scenarios been described and documented??
21. Have the requirements for the user interface been described and documented??
22. Have the requirements needed to determine whether the user can easily recognize the main operating functions been described and documented?
23. Was the user interface designed and implemented as described in the usability specification??
24. Has the implementation of the user interface been verified against the requirements in the usability specification?
25. Have the results of this verification been documented in the usability engineering file?
26. Does the accompanying documentation contain a summary of the application specification for the software product?
27. Does the accompanying documentation contain a concise description of the following points (if relevant for usage)(Functional principle; Significant physical characteristics; Significant performance features and Intended user profile)?
28. If training is required in order for the intended user to safely and effectively use the main operating functions of the software product, have you provided training materials or access to them?
29. If training is required, have you considered the available possibilities for training and contain suggestions on the duration and frequency of training?
30. If training is required, have the intended purpose and user profile has been used as the basis for the training as well as the training materials?

Risk management (ISO 14971)

1. Has a risk management plan been created and does it comply with the requirements from ISO 14971?
2. Has a risk management file been created containing the results from the risk management process (in the form of documents and/or references to the required documents)?
3. Has a risk analysis been performed considering the intended purpose of the medical device, reasonably foreseeable misuse, identification of safety-relevant features, identification of known and foreseeable hazards, and risk assessment for each hazard situation (probability, severity)?
4. Have the risks been evaluated and has the evaluation result been documented in the risk management file?
5. Have risk control measures been taken??
6. Has the implementation of the risk control measures been verified and have the verification results been documented in the risk management file?
7. Have the residual risks been evaluated and have the evaluation results been documented in the risk management file?
8. Has a risk/benefit analysis been performed if the residual risk was considered unacceptable and further risk control measures are not feasible?
9. Have the risks arising due to the risk control have measures been analyzed??
10. Has the overall residual risk been evaluated based on the criteria stipulated in the risk management plan?
11. Has a risk management report been created that documents the results from the review of the risk management process?
12. Has a system been established for collecting and reviewing information about the medical device or similar products from the manufacturing stage as well as from stages that are further downstream?

Risk Management (IEC 62304)

1. Was a risk management process applied in accordance with ISO 14971?
2. Does the software development plan define how to implement software risk management??
3. If relevant: Have risk control measures been incorporated into the requirements??
4. If requirements were defined in the course of software development: Has the risk analysis been re-evaluated and updated?
5. Have the necessary risk control boundaries been defined between software components and has it been ensured that the boundaries are effective?
6. Has it been investigated in the risk management process whether there are software components that can contribute to hazardous situations?
7. Have causes that contribute to a hazardous situation been identified and documented in the risk management file?
8. If a failure or unexpected results produced by software of unknown provenance (SOUP) are the reason that the software component contributes to a hazardous situation: Have published lists of anomalies been evaluated for the SOUP version?
9. If a software component can contribute to a hazardous situation: Have risk control measures been defined and documented?
10. Have the implementations of the risk control measures been verified and has the verification result been documented?
11. Is the traceability hazardous situation -> software component -> cause -> risk control measure -> verification appropriately documented?
12. If changes were made to the software, has it been analyzed whether additional causes were introduced that could contribute to a hazardous situation?
13. If changes were made to the software, has it been analyzed whether additional risk control measures are required?
14. If changes were made to the software, has it been analyzed whether the changes could disrupt existing risk control measures?

Next month will cover a topic that most start-up companies in digital health do not have - a crisis management plan.

Digital Health is here to stay. Let's make sure it is safe, effective, and available to all. Feel free to contact me with your comments, thoughts, and suggestions, or post directly here.