Richard Koch has a rare expertise: he guides teams in transforming clinical data into medical products and develops his own medical device software. Based in Switzerland, Richard is at the heart of one of the largest MedTech hubs. His methods are fresh and at the innovation forefront. He aims to combine regulatory standards with Agile principles. IEC 62304 is the main reference for his work as it specifies the processes governing the development of software in medical devices. Many of his customers are companies in the SaMD (Software as a Medical Device) area. These are software developers making Apps that fall under the legal definition of a medical device. Tooling plays a big part in setting his customers up for success. Jira and Confluence, with Marketplace Apps from SoftComply, Zephyr and XRay are among his tools of choice. Recently, Richard added Jira Snapshots for Confluence to his arsenal.
“When developing high-risk products, you need a high level of reliability and security. If the underlying data is properly controlled and can be retrieved with queries, then a large part of the documentation for FDA approval literally creates itself.”
Richard Koch
SaMD IEC 62304 Consultant
in accordRadBee: Hi Richard. You started by installing Jira Snapshots for Confluence for evaluation. What was your verdict?
Richard: I liked the product. I also quickly contacted the development team and asked for more features. The app is useful in many scenarios, but for me- I evaluated it from the SaMD perspective. It is an exciting addition to the SaMD development toolchain because it solves traceability reports. Traceability reports are the dread of SaMD teams as they are such a time drainer.
When developing medical software you need to capture requirements, detailed design, code units, code elements, tests, risks, and so on… And then you need to link them all to each other in a well-knit hierarchical structure
To create traceability reports in Jira you have to link different issue types and display the data in the right way to support verification reviews. With Jira Snapshots it is possible to create a range of horizontal traceability reports. DevOps, Microsoft’s Jira competitor, has this as native functionality. But Jira and Confluence do not.
So Snapshots closes the traceability gap and gives you the functionality you need to create these reports.
RadBee: You’ve given further input to our development team….
Richard: Yes, I asked for filtering and grouping capabilities. Query plugins for Confluence don’t have these functions, so that’s a great addition. In the future Snapshots should also allow users to display full-width fields in a more stacked way to reduce white space on the reports and maximise the information displayed on a Confluence page. Sometimes you have 10 or 12 columns in a report, and at a certain point it needs to be dumped into an A4 PDF file….
RadBee: Why is report clarity so important for your projects?
Richard: Let’s take user stories alone. Acceptance criteria define your software requirements, which in turn mitigate some of the risks you’ve identified. You can sit down with your team to do a verification review by opening Jira the relevant tickets one at a time,- but that’s cumbersome and takes ages. That’s why I’ve already introduced Jira Snapshots to some of my customers.
RadBee: What was the response like?
Richard: Medical device software companies that use Jira need the app. It’s a good product that continues to improve.
RadBee: Please explain what is behind IEC 62304 processes…
Richard: The IEC 62304 is an international standard for how to develop software for a medical device. The FDA recognizes it, so following the standard is part of a compliance strategy for MedTech companies. My customers develop a very wide range of devices. From a diagnostic app or one that controls an insulin pump. Another customer has been working on a project that involves interpreting brain signals. The embedded software runs on a chip in a device that sits between the skull and the scalp.
When you’re dealing with high-risk products like this, reliability and safety are paramount. Traceability demonstrates that you meet that level of safety. It is proof that you’re following the IEC 62304 process.
RadBee: So it’s all about ensuring that the development process meets all the requirements. And it needs to be captured at a glance?
Richard: Yes, it always comes down to the same thing. The traceability of the system and software requirements has to be demonstrated both downw and up the development “V-model”. To ensure a product is verified and validated. In terms of those challenges, native Confluence functionality is limited.
RadBee: Where do you see further potential in the area of medical software and software in medical devices?
Richard: One of the problems I see in the medical device market in general is how we do risk management. We use a risk management matrix where we identify a hazardoussituations, assess the risk, and mitigate the consequences. And unfortunately I still see a lot of companies doing this in excel based documents….
To follow a good risk management process, you gradually build your risk matrix through the product development lifecycle. So the first thing I do is look at my device and do a risk analysis and try to identify potential hazards. and then evaluate the likelihood and the harm that could occur and decide whether the risk is acceptable or not. That’s the first step. Using a ticketing system like Jira, you can create a risk ticket and link it to a product requirement ticket that mitigates the risk. Maybe you find that the user need analysis has already identified the mitigation requirement, and you can link the risk to the user need ticket as well.
As you go into more and more detail, breaking down requirements to individual items and units of code, you create a mini “neural network” of issue types and relationships. The good news is that you don’t have to see all this data in one view but you do need to be able to disaggregate your data and view it via different queries. Using Snapshot based traceability reports makes complicated risk analysis processes very manageable and can provide a lot of confidence to product teams and management .
For ompanies still relying on document-based quality management systems I really encourage them to move to this agile way of working to make compliance with IEC 62304 easier and their products safer. For a long time a word or excel file printed on piece of paper was all we had. Those days are over, and companies need to move from document management systems to content management systems. Confluence with Snapshots is the perfect tool to make this transition.
RadBee: Yes, until today these are still classic workarounds…
Richard: That’s how it is. I develop software without ever opening MS Word and I rarely use Excel. I work with tickets or on a Confluence page, and documentation in a git repository. If have to create a PDF file, I do it for government agency regulatory submissions, but not for me. Data is digital and you don’t need a piece of paper anymore. But for a lot of companies, including the ones I work with, especially those transitioning into digital products from manufacturing, paper is like a security mechanism that they hold on to. The good news is they don’t have to give up their documents, but they do need to manage and control content production.
So, for example, if you have a document with one hundred software requirements, each requirement on that page is a piece of content which will have its own version. One of those requirements might be in its hundredth version because it’s a very difficult requirement and you have to keep reviewing it, while a simple requirement might only ever have one version.
Companies can create their final documents when all the individual requirements are approved. This makes life so much easier because changes are simple and focussed on the individual piece of content only, and not the whole document.
The problem I see is that many Quality Managers trust documents whose data they have never seen in a good format that allows them to conduct proper verification reviews.
Only within an Agile system you can get to the level of detail you need.
RadBee: So can Snapshots for Confluence help make teams more agile?
Richard: Yes, such tools are helpful especially for agile-based quality management. You work more and more on the basis of content, not on the basis of documents. So to get ISO certification, content-based quality management systems are a great opportunity. RadBee can play an important role in showing people how to manage their quality data in compliance with IEC 62304.
RadBee: How far then is the path to a document that you need for FDA submission, for example?
Richard: If done well, much of the documentation for FDA submissions is driven by queries. With a single click, a PDF template exports Confluence pages as official documents. Including compliant headers and footers, and professional formatting. So you manage the underlying data and then the document generates in 30 seconds. For my own product, I can produce a thousand-page document in two minutes from a few mouse clicks. It is Super fast.
You can simplify your life that way. Start by mastering your data, which should be happening as part of the normal course of business in a medical device company. Next, set up your queries to create documents. You’ll still need to read, review and validate, like you would any normal document, but they should be fine if you’ve already processed the data through a controlled workflow process, with appropriate reviews in the ticketing system. If you do make a mistake, just correct the underlying data and run your queries again.
RadBee: Was installing the Snapshots for Confluence app a challenge for you or your customers?
Richard: My software engineering customers like using it, but the people who need it are not developers, they are the Quality and Regulatory Managers. To be honest, the concept is a bit foreign to them but I think that will change in the next few years. Many will need to learn more about Agile processes, systems data management, queries and so on to upskill themselves to keep up with the pace of Software Development teams. An onboarding service through RadBee could be a solution to support these managers.
