Medical Device Skills skills

Define what and how to log for medical devices: security/safety events, integrity, protection, and retention of logs for compliance and forensics.

Establish patterns for unit tests that verify software units against requirements with safety-class-appropriate rigor.

Ensure integrity of data in storage and transmission using checksums/CRCs/ECC, validation, and redundancy where needed for medical devices.

Define architectural partitioning to contain failures, simplify verification, and align safety classes with appropriate isolation.

Guide creation and maintenance of Software Architecture (SAD) and Design Descriptions (SDD) that support safety, traceability, and compliance.

Ensure deterministic and safe memory usage: static allocation, pools, stack sizing, MPU usage, and corruption detection for medical device firmware.

Define controlled release process for medical device software: versioning, branching, verification, approvals, documentation, and post-release monitoring.

Enable safe and standards-aligned interoperability: HL7 FHIR/IHE profiles, data formats, terminology mapping, and API design for medical data exchange. Use when working on interoperability in medical device software.

Map 21 CFR Part 820 Subpart C — Design Controls to software lifecycle work: design planning, inputs, outputs, review, verification, validation, transfer, and DHF/DMR links, including how software validation (intended use / risk controls) complements verification (requirements and specs). Includes a concise ISO 13485:2016 slice where it overlaps QMS expectations for design and risk (interpretation; align with your notified-body MDSAP scope for EU). Use when working on fda 820 design controls in medical device software.

Identify, prioritize, and mitigate security threats for medical devices, integrating with risk management and informing control selection.

Guide selection and use of cryptography for medical devices: algorithms, key derivation, data at rest/in transit, library choice, and FIPS considerations. Use when working on encryption in medical device software.

Integrate ISO 14971:2019 device risk management into software development: hazard identification, risk evaluation, control implementation, verification, and residual risk documentation. For IEC 62304 Clause 7 software-specific risk activities, also load REG-IEC62304-SWRM. Use when working on iso 14971 in medical device software.

Guide creation, verification, and maintenance of software system requirements derived from system needs (IEC 62304:2006+A1:2015, 5.2)—with content appropriate to the device, risk controls embedded for Class B/C, and evidence that requirements are testable and traceable. Use when working on software requirements in medical device software.

Identify, prioritize, and mitigate security threats for medical devices, integrating with risk management and informing control selection. Use when working on threat modeling in medical device software.

Validate software with real or representative hardware, sensors, actuators, and timing, to uncover integration and safety issues not visible in simulation.

Guide post-release software maintenance per IEC 62304:2006+A1:2015, Clause 6—planning feedback handling, evaluating problems and changes, re-applying development activities when needed, and re-releasing under the same controls as initial release (5.8).

Guide use of the legacy software pathway (IEC 62304:2006+A1:2015, 4.4) when device software was legally marketed before full lifecycle evidence existed—balancing continued use with gap analysis, risk management, and targeted closure activities instead of re-running all of Clauses 5–9 from scratch. Use when working on iec 62304 legacy software in medical device software.

Enable safe and standards-aligned interoperability: HL7 FHIR/IHE profiles, data formats, terminology mapping, and API design for medical data exchange.

Provide concise, high-value inline documentation practices (comments and short docblocks) that improve safety, maintainability, and traceability without cluttering code.

Define controlled release process for medical device software: versioning, branching, verification, approvals, documentation, and post-release monitoring. Use when working on release management in medical device software.

Define how to record, investigate, resolve, and trend software problems (defects, anomalies, complaints) per IEC 62304:2006+A1:2015, Clause 9—linking safety evaluation, change control, verification closure, and test documentation.

Define a constrained C++ subset suitable for medical device firmware, aligned to MISRA C++ guidance: safe types, RAII, limited dynamic features, and predictable behavior. Use when working on embedded cpp in medical device software.

Apply IEC 62443 concepts (secure development lifecycle, component requirements, security levels) to networked medical devices, ensuring threat-aware design, implementation, and verification of cybersecurity controls. Use when working on iec 62443 in medical device software.

Define C coding practices aligned with MISRA C and medical device safety needs: type safety, control flow, memory management, interrupts, and static analysis.